Please note: This English version is provided for convenience only. Only the German version is legally binding.
1. Controller
ThinkingTech GmbH
Darmstädter Str. 5
64625 Bensheim
Germany
Phone: +491705987255
Email: info@melibo.de
Authorized representatives:
Felix Stelzer, Leon Stelzer
2. Data protection officer
If you have any questions about data protection, you can contact our data protection officer at any time:
Jens Engelhardt
NOTOS Xperts GmbH
Heidelberger Str. 6
64283 Darmstadt, Germany
Phone: +49 6151 520 10 0
Email: datenschutz@notos-xperts.de
3. General information on data processing
We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Processing is based in particular on Art. 6(1)(b) GDPR for the performance of a contract, Art. 6(1)(c) GDPR for compliance with legal obligations, Art. 6(1)(f) GDPR to protect legitimate interests and Art. 6(1)(a) GDPR on the basis of consent. Where processing is based on consent, it can be withdrawn at any time with effect for the future.
4. Hosting and technical infrastructure
4.1 Server log files
When you visit our website, information that your browser automatically sends to us is recorded in server log files. This includes in particular the IP address of the requesting device, date and time of access, pages and files accessed, amount of data transferred, browser type and version, operating system and the referrer URL. Processing serves to ensure smooth operation and IT security on the basis of Art. 6(1)(f) GDPR. Server log data is generally deleted after 30 days at the latest.
4.2 Cloudflare
We use Cloudflare, a service of Cloudflare Inc., 101 Townsend Street, San Francisco, CA 94107, USA, as a content delivery network and for DDoS protection of our website.
This involves processing in particular IP addresses, technical access data and the security cookies _cf_bm and _cfuvid. Processing is based on Art. 6(1)(f) GDPR. Cloudflare Inc. is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 GDPR have also been concluded.
More information: https://www.cloudflare.com/privacypolicy/
5. Cookies and consent management
We use cookies and similar technologies. Technologies that are not technically necessary are only used with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. We set technically necessary cookies on the basis of Section 25(2) TDDDG without separate consent. You can withdraw your consent at any time with effect for the future via our consent management tool.
We use the following cookies on our website:
5.1 Piwik PRO (consent management)
We use Piwik PRO, a service of Piwik PRO GmbH, Knesebeckstraße 62/63, 10719 Berlin, Germany, as a consent management platform to manage and document consents.
This involves processing in particular consent status and timestamps. The legal basis is Art. 6(1)(c) GDPR. As Piwik PRO is based in Germany, no transfer to third countries takes place.
More information: https://piwikpro.de/blog/datenschutz/
5.2 Consent management
You can withdraw your consent to the use of tracking and analytics technologies at any time by changing your privacy settings here.
6. Contacting us
When you contact us (e.g. by email, phone or via social media), your details are processed to the extent necessary to respond to your inquiry. The legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual inquiries and Art. 6(1)(f) GDPR for other inquiries.
6.1 HubSpot
We use HubSpot, a service of HubSpot Ireland Ltd., 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland, as a CRM system for customer communication, sales management and marketing.
This involves processing in particular contact data, communication data and usage data related to website interactions. The legal basis is Art. 6(1)(b) and (f) GDPR; for marketing cookies additionally Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. HubSpot Inc., USA, is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 GDPR have also been concluded.
More information: https://legal.hubspot.com/privacy-policy
7. Live chat and AI assistant
We use our own AI chatbot service melibo to provide an intelligent assistant on our website. This involves processing in particular the necessary connection data (IP address), the content of the conversation and background information needed to answer inquiries. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. You can withdraw your consent at any time by reloading the website without opening the chatbot. After the conversation ends, dialogs are stored in anonymized log files to improve the service. Data is transmitted with SSL encryption.
8. Newsletter
We only send our newsletter with your prior consent via the double opt-in process. This involves processing in particular your email address, IP address and the time of sign-up and confirmation. The legal basis is Art. 6(1)(a) GDPR. We measure reach as part of sending the newsletter. You can withdraw your consent at any time via the unsubscribe link in the newsletter or by email to legal@melibo.de.
8.1 Brevo
We use Brevo, a service of Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, to send our newsletter. This involves processing in particular email addresses, delivery data and interaction data. A data processing agreement pursuant to Art. 28 GDPR has been concluded. As Brevo is based in Germany, no transfer to third countries takes place.
More information: https://www.brevo.com/legal/privacypolicy/
9. Analytics and tracking
We only use analytics and tracking technologies with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. This involves processing in particular usage behavior, interactions, device information and truncated IP addresses. The purpose is to analyze and optimize our website and improve the user experience.
9.1 Piwik PRO Analytics
We use Piwik PRO Analytics, a service of Piwik PRO GmbH, Knesebeckstraße 62/63, 10719 Berlin, Germany, to analyze usage behavior on our website. This involves processing in particular page views, time on page, interactions and device and browser information. We use IP masking, which rules out any direct personal identification. As Piwik PRO is based in Germany, no transfer to third countries takes place.
More information: https://piwikpro.de/blog/datenschutz/
9.2 Google Analytics
We use Google Analytics, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze website usage. This involves processing in particular page views, time on page, interactions and device and browser information. The IP address is truncated within the EU. Google LLC, USA, is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 GDPR have also been agreed.
More information: https://policies.google.com/privacy
9.3 Microsoft Clarity
We use Microsoft Clarity, a service of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, for behavioral analysis on our website (e.g. mouse movements, clicks, scrolling). This involves processing in particular pseudonymized IP addresses, device type, operating system, browser information and interactions. Microsoft Corporation, USA, is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 GDPR have also been agreed.
More information: https://privacy.microsoft.com/en-us/privacystatement
9.4 Visual Website Optimizer (VWO)
We use Visual Website Optimizer (VWO), a service of Wingify Software Private Limited, 340, Ground Floor, Sector-30, Gurgaon 122001, India, to run A/B tests and analyze user behavior (e.g. heatmaps, click analysis). This involves processing in particular usage behavior, click and interaction data and the cookies _vis_opt_s and _vis_opt_test_cookie. Standard contractual clauses pursuant to Art. 46 GDPR have been agreed for the transfer to India.
More information: https://vwo.com/privacy-policy/
10. Online advertising
10.1 Google Ads and Google conversion tracking
We use Google Ads and the associated conversion tracking, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to place and evaluate online ads. This involves setting cookies that record clicks, pages visited and conversion events and enable user-based ad targeting (remarketing). Google LLC, USA, is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 GDPR have also been agreed.
More information: https://policies.google.com/privacy
10.2 LinkedIn Insight Tag
We use the LinkedIn Insight Tag, a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, to measure the success of our LinkedIn campaigns and for remarketing. This involves processing in particular the URL, referrer, IP address, device and browser information and timestamps. LinkedIn Corporation, USA, is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 GDPR have also been agreed.
More information: https://www.linkedin.com/legal/privacy-policy
10.3 Meta Pixel (Facebook)
We use Meta Pixel, a service of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, to measure the success of our Facebook and Instagram ads and for remarketing. This involves processing in particular page views, interactions and device information. The data may be linked to other data from your Facebook or Instagram account. Meta Platforms Inc., USA, is certified under the EU-US Data Privacy Framework; standard contractual clauses pursuant to Art. 46 GDPR have also been agreed.
More information: https://www.facebook.com/privacy/policy
11. Embedded content and tag management
11.1 Google Tag Manager
We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage website tags. Tag Manager itself does not process any personal data and does not set cookies. It enables the integration of other services, each subject to its own legal basis. The legal basis for using Tag Manager is Art. 6(1)(f) GDPR.
More information: https://policies.google.com/privacy
11.2 Weglot
We use Weglot, a service of Weglot SAS, 9-11 Rue des Colonnes, 75002 Paris, France, to provide multilingual content on our website. This involves processing in particular page content for translation and technical access data (IP address, browser language, timestamp). The legal basis is Art. 6(1)(f) GDPR. As Weglot is based in France (EU), no transfer to third countries takes place. A data processing agreement pursuant to Art. 28 GDPR has been concluded.
More information: https://www.weglot.com/privacy
12. Social media presence
We maintain online presences on social networks and process user data there in order to communicate with active users or provide information about us. The legal basis is Art. 6(1)(f) GDPR. Please note that data may be processed outside the EU when you visit our online presences. For data protection inquiries, we recommend contacting the respective providers directly.
Facebook: https://www.facebook.com/about/privacy
LinkedIn: https://www.linkedin.com/legal/privacy-policy
YouTube: https://policies.google.com/privacy
13. Transfer of personal data
As part of our data processing, data may be transferred to other bodies or companies. In such cases, we conclude data processing agreements pursuant to Art. 28 GDPR. Where data is transferred to third countries outside the EU/EEA, we ensure that this only takes place on the basis of appropriate safeguards pursuant to Art. 46 GDPR (in particular standard contractual clauses) or on the basis of certification under the EU-US Data Privacy Framework.
14. Storage period
Personal data is deleted as soon as the respective purpose of processing no longer applies, unless statutory retention obligations prevent this. Statutory retention obligations arise in particular under commercial and tax law (usually 6 to 10 years). Specific storage periods can be found in the respective sections of this privacy policy.
15. Your rights and right to lodge a complaint
You have the following rights regarding your personal data:
Right of access (Art. 15 GDPR): You can request information about the data we process.
Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR): You can request the deletion of your data, unless statutory retention obligations prevent this.
Right to restriction (Art. 18 GDPR): You can request the restriction of processing.
Right to data portability (Art. 20 GDPR): You can receive your data in a common format or request its transfer to another controller.
Right to object (Art. 21 GDPR): You can object at any time to the processing of your data based on legitimate interests.
Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent given at any time with effect for the future.
You also have the right to lodge a complaint with the competent supervisory authority.
16. Changes to this privacy policy
We reserve the right to amend this privacy policy as needed to keep it in line with current legal requirements and changes to our services. The current version is always available on our website.