Please note: This English version is provided for convenience only. Only the German version is legally binding.
With this privacy notice, we inform you below about the processing of your personal data when using our chatbot. Use of the chatbot is voluntary.
ThinkingTech GmbH expressly declares that this data is used only for the stated purpose and is not passed on to third parties. All information is treated confidentially in accordance with the applicable data protection regulations.
1. Definitions
Personal data
According to Art. 4 No. 1 of the General Data Protection Regulation ("GDPR"), personal data is any information relating to an identified or identifiable natural person. This includes information such as your first and last name, address, phone number, email address and also your IP address.
Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.
Processing
Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.
Pseudonymization
Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.
Controller or controller responsible for processing
The controller or controller responsible for processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor
A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
Recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether a third party or not. However, public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.
Third party
A third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
Consent
Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to them.
2. Applicability
This privacy policy applies to our chatbot. As a rule, however, our chatbot is embedded on our customers' own websites.
We therefore cannot accept responsibility for our customers' websites or the handling of your personal data in that context. Please refer directly to the respective website for information on how your data is handled. For questions about processing on the respective website, please contact the relevant controller.
This privacy policy contains all the necessary data protection information about the chatbot. You can also contact our data protection officer with any questions.
3. Responsible body / data controller
The controller responsible for the processing of personal data by the chatbot is (see Legal Notice):
ThinkingTech GmbH
Darmstädter Str. 5
64625 Bensheim
Germany
Phone: +49 170 5987255
Email: info@melibo.de
Authorized representatives:
Felix Stelzer, Leon Stelzer
Data protection officer:
Jens Engelhardt
NOTOS Xperts GmbH
Heidelberger Str. 6
64283 Darmstadt, Germany
+49 6151 520 10 0
datenschutz@notos-xperts.de
4. General information on the legal bases
Insofar as we obtain the data subject's consent for processing operations involving personal data, Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for processing personal data.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.
Insofar as processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 (1) (c) GDPR serves as the legal basis.
If vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.
If processing is necessary to protect a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6 (1) (f) GDPR serves as the legal basis for processing.
5. Chatbot
Scope and type of data processing
Our chatbot processes the personal data that is entered. You can use the chatbot without entering your personal data.
Nevertheless, we must collect certain personal data to ensure the chatbot's functionality:
· IP address
· Time and date of your request
· Content of your request
You are free to choose the content of your request – please do not include any personal or sensitive personal information in free text (name, address, payment details, etc.). Please note that all data you provide will also be processed by our chatbot.
The legal basis for processing by the chatbot is Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in offering you a chatbot to improve your user experience. We have concluded a data processing agreement with the website operator pursuant to Art. 28 GDPR that governs how and for what purposes we may process data.
Since use of the chatbot is voluntary, we assume when you use it that processing by the chatbot to answer your questions is also in your interest. There is therefore no indication that your rights are restricted by the chatbot's processing.
We evaluate data for statistical purposes to measure demand, analyze chat histories, improve the chatbot's answer quality and fix errors. We therefore have no way of attributing this data to a specific person. This data is not combined with other data sources. Beyond this, we do not store any further personal data when you use the chatbot.
Data is not passed on to third parties or otherwise evaluated unless there is a legal obligation to do so (Art. 6 (1) (c) GDPR).
All collected data is deleted after 30 days at the latest.
IBM Watson Assistant
Our chatbot works with IBM Watson Assistant from IBM. This allows us to better understand customers and respond to their needs.
For this purpose, data may be forwarded to IBM. You can find more information in IBM's privacy policy: https://www.ibm.com/de-de/privacy?lnk=flg-priv-dede.
Log and statistical data
Each time our chatbot is accessed, the dialogs are saved in a log file. They are used exclusively to improve the dialogs and for error analysis and are not passed on to third parties. The IP address is the only personal data stored during use, but it is not processed further. The data does not allow chat users to be identified.
Security
Your questions and analytics data are transmitted to the chatbot securely via SSL encryption (transport encryption). Access to the chatbot's systems is protected by firewalls that prevent unauthorized external access.
Our systems are located on Microsoft Azure servers in Frankfurt am Main, Germany. We are certified to ISO 27001 and ISO 9001.
Hyperlinks to third-party websites
The chatbot may contain hyperlinks to other providers' websites if the website operator has set them up. In these cases, you are redirected from the website operator's site directly to another provider's website. You can recognize this, among other things, by the change of URL. After the redirect, we cannot accept responsibility for the confidential handling of your data, as we have no influence over whether these public or private bodies comply with data protection regulations. Please inform yourself directly on their websites about how these public or private bodies handle your personal data.
6. Rights of users and data subjects
With regard to the data processing described in more detail below, users and data subjects have the right:
- to confirmation as to whether data concerning them is being processed, to information about the data processed, to further information about the data processing and to copies of the data (see also Art. 15 GDPR);
- to rectification or completion of inaccurate or incomplete data (see also Art. 16 GDPR);
- to the immediate erasure of data concerning them (see also Art. 17 GDPR) or, alternatively, where further processing is necessary pursuant to Art. 17 (3) GDPR, to restriction of processing in accordance with Art. 18 GDPR;
- to receive the data concerning them that they have provided and to have this data transmitted to other providers/controllers (see also Art. 20 GDPR);
- to lodge a complaint with the supervisory authority if they believe that the data concerning them is being processed by the provider in breach of data protection regulations (see also Art. 77 GDPR). The supervisory authority responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information
Prof. Dr. Alexander Rossnagel, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
Furthermore, the provider is obliged to inform all recipients to whom data has been disclosed by the provider of any rectification or erasure of data or restriction of processing carried out pursuant to Articles 16, 17 (1) and 18 GDPR. However, this obligation does not apply if such notification is impossible or involves disproportionate effort. Notwithstanding this, users have the right to information about these recipients.
Users and data subjects also have the right under Art. 21 GDPR to object to the future processing of data concerning them, insofar as the data is processed by the provider in accordance with Art. 6 (1) (f) GDPR.