Privacy Policy

This Privacy Policy describes which personal data we process, for which purposes and on which legal bases, who may receive it and how long we store it. It also explains the rights you have under data protection law and how you can exercise them.

Please read this Privacy Policy carefully. If you have any questions about the processing of your personal data, you can contact us or our Data Protection Officer at any time using the details provided in the "Contact" section.

This Privacy Policy applies to the processing of personal data for which we act as a data controller. Where we process personal data on behalf of our business customers as a data processor, the agreements concluded with the respective customer — in particular our Data Processing Agreement — govern that processing. See the section "Controller and Processor Roles" for further details.

The controller responsible for the processing of personal data described in this Privacy Policy is:

• Netex GmbH
• Uhlandstr 30
• 82256 Fürstenfeldbruck
• Germany
• Email: contact@mondo.chat
• Phone: +49 36327558970

Our Data Protection Officer supports us in ensuring compliance with data protection requirements. You can reach our Data Protection Officer at: dpo@netex.de

If you have questions about this Privacy Policy or about the processing of your personal data, please contact us by email at contact@mondo.chat.

This Privacy Policy applies to the processing of personal data in connection with our website and our business communications, in particular for the following groups of people:

• Visitors of our website
• Prospective customers who contact us or request information
• Registered users and customers of the Mondo platform
• Employees and agents of our customers who use the platform on behalf of their organisation
• Contacts and end users who communicate with our customers through the platform, where this Privacy Policy applies accordingly

For personal data that our customers process with the Mondo platform — for example the messages of their own end users — the respective customer is generally responsible as the controller. Our role and responsibilities in that case are described in the section "Controller and Processor Roles" and in our Data Processing Agreement.

Depending on the context, we act either as a controller or as a processor within the meaning of the GDPR. This distinction determines who is responsible for determining the purposes and means of a processing operation.

When we act as a controller

We act as a controller in particular when we determine the purposes and means of the processing ourselves — for example when you visit our website, contact us, request information about our services, register for an account, use our services as a customer, or subscribe to our newsletter.

When we act as a processor

When a business customer uses the Mondo platform to communicate with its own customers and contacts, we process the personal data involved on behalf of that customer. In this case, the customer determines the purposes and means of the processing and remains the controller, while we act as a processor.

As a processor, we process such data only on documented instructions from the customer and support the customer in fulfilling its own obligations under data protection law. In particular, our customers are responsible for:

• Determining the purposes of the processing and the appropriate legal bases
• Providing their end users with the privacy information required by law
• Configuring the platform, including retention settings, in a lawful manner
• Responding to data subject requests of their end users where applicable
• Ensuring that they are permitted to transfer the relevant personal data to us and to the providers used to deliver the communication channels

The detailed rights and obligations of the parties are set out in our Data Processing Agreement, which forms part of the contractual documentation for business customers.

The personal data we process depends on the services you use, the information you provide and the configuration chosen by our customers. In principle, we distinguish the following categories:

Information you provide to us directly

• Identification data, such as your name
• Contact information, such as your email address and phone number
• Company and business information, such as the name of your organisation and your role
• Account and authentication information, such as login credentials
• Content you submit, such as messages in contact or support requests
• Preferences, such as your communication and marketing preferences

Information collected automatically

• Technical information, such as your IP address, device type, browser type and operating system
• Log data, such as the time of access, the pages or resources requested and the status of a request
• Usage information, such as how you interact with our website and services
• Information derived from cookies and similar technologies, where used

Information processed through connected channels and integrations

• Message content and communication metadata from the channels connected to the platform, such as email, web chat, WhatsApp, Messenger, Instagram, Telegram, Signal, Google Business Messages and voice telephony
• Sender and recipient identifiers, such as phone numbers, email addresses and user names on messaging or social media platforms
• Conversation metadata, such as timestamps, delivery and read status, and routing information
• Media files and attachments shared within conversations, where applicable

Information processed on behalf of our customers

Where our customers use the Mondo platform to communicate with their end users, we process the personal data contained in those communications on behalf of and according to the instructions of the respective customer. We do not use this data for our own purposes. The categories of data processed in this context depend on the channels and features the customer has enabled.

We collect personal data in particular in the following ways:

• When you submit information through forms on our website, such as the contact form
• When you register an account for the Mondo platform and when you log in to it
• When you contact us, for example by email, phone or through our support channels
• When you subscribe to our newsletter, where offered
• When you use the Mondo platform and its features
• When communication channels such as email, messaging services or telephony are connected to the platform by our customers
• When integrations with third-party services are used
• Automatically through server logs and, where used, cookies and similar technologies

We process personal data for the following purposes:

• Providing the Mondo platform and its omnichannel communication features
• Creating, managing and administering customer accounts
• Authenticating users and securing access to the platform
• Responding to contact requests and providing customer support
• Communicating with prospective customers, customers and other interested parties
• Ensuring the security, integrity and availability of our systems and preventing fraud and abuse
• Operating, maintaining and improving our website, systems and services, including analytics
• Administering the contractual relationship, including invoicing where applicable
• Complying with legal obligations, such as retention requirements under commercial and tax law
• Sending marketing communications, such as newsletters, where permitted or consented to
• Providing AI-powered functionality, where enabled, as described in the section "AI and Automated Processing"

We process personal data only if a legal basis within the meaning of Article 6 of the GDPR applies. Depending on the processing activity, we rely in particular on the following legal bases:

• Consent, Article 6(1)(a) GDPR — for example for the subscription to our newsletter and for marketing communications where we ask for your consent. You may withdraw your consent at any time with effect for the future.
• Performance of a contract or pre-contractual measures, Article 6(1)(b) GDPR — for example for the provision of the Mondo platform, account management, authentication and responding to inquiries about our services.
• Compliance with a legal obligation, Article 6(1)(c) GDPR — for example retention obligations under commercial and tax law.
• Legitimate interests, Article 6(1)(f) GDPR — for example to ensure the security and stability of our systems, to prevent fraud and abuse, to document and handle support requests and to further develop our services, provided that your interests or fundamental rights and freedoms do not override these interests.

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You have the right to object to processing based on legitimate interests as described in the section "Your Rights".

Where we process personal data as a processor on behalf of a customer, the customer is responsible for establishing an appropriate legal basis. In that case, our processing is carried out on the customer's instructions within the framework of our agreement.

The Mondo platform enables businesses to manage conversations with their end users across multiple communication channels. Depending on the configuration of the respective customer, these may include:

• Web chat and website messaging
• Email
• Messaging services such as WhatsApp, Telegram and Signal
• Social media channels such as Messenger and Instagram
• Google Business Messages and RCS messaging
• Voice telephony, including interactive voice response (IVR) features

The personal data processed in this context depends on the channels and integrations enabled by the customer and on the content of the communication. It may include message content, sender and recipient identifiers, conversation metadata and media files, as described in the section "Categories of Personal Data We Process".

Communication channels are provided by third-party providers, such as messaging networks and telephony providers. These providers act as independent controllers for their own processing, for example the delivery of messages, and have their own privacy policies.

For conversations between our customers and their end users, the customer acts as the controller and we act as a processor, as described in the section "Controller and Processor Roles".

The Mondo platform can include AI-powered functionality that supports communication between businesses and their end users. Depending on the features enabled by the respective customer, this may include:

• AI-assisted responses and suggested replies, including knowledge-base assisted responses
• Automated classification and routing of conversations
• Conversation summaries and agent assistance
• Translation of messages
• AI-based voice and email automation, such as automated call and email handling
• Workflow automation and automated actions within conversations

Whether and which AI features are used is determined by the configuration of the respective customer. The processing of personal data through AI features therefore depends on this configuration and on the content of the respective conversations.

Where AI providers are involved in providing these features, they process personal data within the scope of their agreements with us. For detailed information about the providers involved, the processing locations and the retention of data in connection with AI features, please contact us using the details in the "Contact" section.

The AI features of the platform are designed to support communication and to assist agents. Automated decisions within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you are not made by default. Should such processing be enabled in individual cases, we or the responsible customer will provide the legally required information.

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device when you visit a website. Similar technologies include, for example, local storage in your browser.

Depending on their purpose, cookies can be assigned to the following categories:

• Strictly necessary cookies, which are required for the operation of the website and the platform, for example to maintain sessions and security
• Functional cookies, which enable extended functionality, such as remembering selected settings
• Analytics cookies, which help us understand how the website is used so that we can improve it
• Marketing cookies, which are used to deliver and measure marketing content, where used

We are currently finalising the detailed documentation of the cookies and similar technologies used on our website. This section will be updated accordingly. If you have questions about the technologies used, please contact us using the details in the "Contact" section.

You can control the use of cookies through your browser settings. Please note that blocking or deleting cookies may affect the functionality of our website, and that strictly necessary cookies cannot be disabled without affecting the operation of the site.

To use the Mondo platform, an account is required. When an account is created, we process the information necessary for the registration, in particular:

• Name and contact details of the responsible user, in particular the email address
• Information about the customer organisation, where applicable
• Authentication information, such as a password or other login credentials

We use this information to create and manage the account, to authenticate users, to secure access to the platform and to administer the contractual relationship. The legal basis is generally the performance of a contract, Article 6(1)(b) GDPR, and, where required, compliance with legal obligations, Article 6(1)(c) GDPR.

Account data is stored for the duration of the account's existence. After an account is terminated, we delete the account data unless statutory retention obligations or other legitimate reasons, such as the defence of legal claims, require further storage.

When you use our contact form, we process the information you provide, in particular your first and last name, your email address and your message. Optionally, you can provide additional information, such as your company, your phone number and the subject of your request.

We use this information solely to handle your request and to communicate with you about it. The legal basis is Article 6(1)(b) GDPR, insofar as your request concerns the initiation or performance of a contract; otherwise we rely on our legitimate interest in responding to your request, Article 6(1)(f) GDPR.

If you contact our customer support, for example by email or phone, we process the information you provide in order to handle your support request, to document the communication and to improve our support processes. The legal basis is generally the performance of the customer contract, Article 6(1)(b) GDPR, or our legitimate interest in providing effective support, Article 6(1)(f) GDPR.

We store requests and related communications for as long as necessary to handle them and to answer follow-up questions, and beyond that only where statutory retention obligations apply.

Where we offer a newsletter or other marketing communications, we use your data — in particular your name and email address — to send you the relevant information. We send marketing communications only with your consent, Article 6(1)(a) GDPR, or where permitted by law, for example within an existing customer relationship, Article 6(1)(f) GDPR.

You can unsubscribe from our newsletter at any time, either by using the unsubscribe link contained in every marketing email or by contacting us. Withdrawing your consent takes effect for the future; the lawfulness of the processing carried out until the withdrawal remains unaffected.

We share personal data only where this is necessary for the purposes described in this Privacy Policy, where we are legally required or permitted to do so, or where you have consented. In particular, recipients may include:

• Hosting and infrastructure providers that operate the systems used to provide our website and platform
• Providers of communication channels and related services that are required to deliver messages, such as email, messaging and telephony providers
• Service providers that support our business operations, for example in the areas of IT, customer communication and administration
• Professional advisers, such as lawyers, auditors and tax consultants, where necessary
• Authorities, courts and other public bodies, where we are legally required or permitted to disclose data

When we engage service providers, they process personal data on our behalf as processors, within the framework of the applicable agreements. We select service providers carefully and impose contractual obligations on them to protect personal data.

We do not sell personal data.

For the provision of the platform, we engage subprocessors that may process personal data on our behalf, in particular on behalf of our business customers. Subprocessors are engaged only on the basis of agreements that impose data protection obligations corresponding to those in our agreements with our customers.

Our Data Processing Agreement contains further information on the use of subprocessors, the notification of changes to the subprocessor list and the rights of customers in this regard.

Our website and platform are provided using infrastructure and service providers that may process personal data in countries outside the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR — for example an adequacy decision of the European Commission or standard contractual clauses.

If you would like further information about the safeguards applied to specific transfers, please contact us using the details in the "Contact" section.

We store personal data only for as long as necessary to fulfil the purposes for which it was processed, unless statutory retention obligations require longer storage.

The retention period depends on the respective data category and processing purpose. In particular, we take into account:

• The performance of the contract and the administration of the customer relationship
• Statutory retention obligations, for example under commercial and tax law
• The defence of legal claims and the resolution of disputes
• Security and the prevention of abuse

Where we process personal data as a processor on behalf of a customer, the retention and deletion of the data is governed by the agreements with the respective customer, including our Data Processing Agreement. After the end of the contractual relationship, customer data is deleted or anonymised in accordance with the agreed arrangements.

We take appropriate technical and organisational security measures to protect personal data against accidental or intentional manipulation, loss, destruction and unauthorised access. Our measures include in particular:

• Access controls and the principle of least privilege for access to systems and personal data
• Secure authentication for access to the platform
• Role-based authorisation concepts, including granular permissions for users of the platform
• Encryption of data transmission and encryption of stored data, where appropriate
• Logging and monitoring of system activities, including audit logs
• Backup concepts to ensure the availability and resilience of the systems
• Processes for the management of security incidents

Our security measures are continuously reviewed and adapted to technical developments. Despite all care, no method of transmission over the internet and no storage system can be guaranteed to be completely secure, so absolute protection of your data cannot be assured.

Despite the measures described above, security incidents cannot be ruled out entirely. We have processes in place to detect, contain and remedy security incidents affecting personal data and to assess the associated risks.

Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we notify the competent supervisory authority without undue delay and, where required, no later than 72 hours after becoming aware of the breach, in accordance with Article 33 GDPR. Where a breach is likely to result in a high risk to affected individuals, we inform them in accordance with Article 34 GDPR.

Where we act as a processor for a customer, we notify the respective customer of a personal data breach without undue delay in accordance with our agreement and support the customer in fulfilling its notification obligations.

As a data subject whose personal data we process, you have the following rights under the conditions of the GDPR:

• Right of access, Article 15 GDPR — to obtain information about the personal data we process
• Right to rectification, Article 16 GDPR — to have inaccurate personal data corrected
• Right to erasure, Article 17 GDPR — to have personal data deleted, for example where it is no longer necessary for the purposes for which it was collected
• Right to restriction of processing, Article 18 GDPR — to restrict the processing of your personal data
• Right to data portability, Article 20 GDPR — to receive personal data that you have provided to us in a structured, commonly used and machine-readable format
• Right to object, Article 21 GDPR — to object at any time, for reasons arising from your particular situation, to processing based on legitimate interests, and to object at any time to processing for direct marketing purposes
• Right to withdraw consent, Article 7(3) GDPR — to withdraw a given consent at any time with effect for the future
• Rights relating to automated decision-making and profiling, Article 22 GDPR

These rights may be subject to statutory limitations — for example where the processing is necessary for the performance of a contract, where legal obligations require storage, or where the rights of other individuals conflict with your request.

To exercise your rights, please contact us or our Data Protection Officer using the details provided in the "Contact" section. We will respond to your request without undue delay and in any event within one month of receipt.

Where we process personal data on behalf of a customer, please address your request primarily to the respective customer as the controller. We will support the customer in handling your request where required.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR.

As our company is based in Germany, the supervisory authority competent for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA). Further information can be found at lda.bayern.de.

Our website and services are directed at businesses and professional users. We do not knowingly collect personal data from children.

Insofar as consent is required for the processing of personal data of children in connection with information society services, we obtain it in accordance with the applicable legal requirements, in particular Article 8 GDPR.

If you believe that a child has provided us with personal data without the required consent, please contact us. We will delete such data where required.

Our website may contain links to third-party websites and services, for example social media platforms or map services. This Privacy Policy does not apply to such third-party services. The respective providers are responsible for their own data processing; we recommend reading their privacy policies.

The same applies to communication channels and integrations that are connected to the Mondo platform. The providers of these services act as independent controllers for their own processing and provide their own privacy information.

We may update this Privacy Policy from time to time, for example due to legal developments, changes in our services or products, technical changes or changes in our processing activities.

The current version of this Privacy Policy is available on our website. The "Last updated" date at the top of this page indicates when it was last revised. Where a change affects the processing of personal data of our customers' end users, the respective customer is responsible for informing the affected individuals where required.

In the event of material changes, we will inform registered users and customers appropriately, for example by email or through the platform.

If you have questions about this Privacy Policy or about the processing of your personal data, please contact us:

• Netex GmbH
• Uhlandstr 30
• 82256 Fürstenfeldbruck
• Germany
• Email: contact@mondo.chat
• Phone: +49 36327558970
• Data Protection Officer: dpo@netex.de