1. name and contact details of the person responsible

The controller pursuant to Article 4 (7) GDPR is:

Machwürth Team International GmbH

Dohrmanns Horst 19

27374, Visselhövede

Germany

Phone: +49-4262-9312-0

E-mail: info@mwteam.com

2. general information on data processing

We appreciate your visit to our website and are committed to protecting your personal data. We always process your personal data in accordance with the statutory regulations, in particular the General Data Protection Regulation (GDPR).

Personal data is any information relating to an identified or identifiable natural person ("data subject"), e.g. name, email address, IP address or user behavior.

3. scope of data processing

Processing only takes place if there is a legal basis. This is particularly the case if:

• you have given your consent (Art. 6 para. 1 lit. a GDPR),
• the processing is necessary for the performance of a contract (Art. 6 para. 1 lit. b GDPR),
• the processing is necessary for a legitimate interest (Art. 6 para. 1 lit. f GDPR), or
• the processing is required by law (Art. 6 para. 1 lit. c GDPR).

4. cookies and cookie banners

Our website uses cookies. These are small text files that are stored locally in the cache of your browser. They are used to make our website more user-friendly.

With the help of cookies we can:

• Create statistics on how visitors use our site,
• Show you personalized content,
• automatically recognize you on repeated visits.

Consent management with Complianz

On this website, we use the Complianz GDPR/CCPA Cookie Consent tool to obtain your consent to the use of certain cookies. Only if you actively click "Agree" will the corresponding cookies be set. No non-essential cookies are used in advance. The consent is logged and stored.

You can revoke your consent at any time via the cookie banner or change your cookie settings.

5. server log files

When you visit our website, our provider automatically collects the following data in so-called server log files:

• IP address
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access is made (referrer URL)
• Browser and, if applicable, the operating system of your end device

This data is only stored temporarily and is required to display the website without errors and to analyze security-related incidents. It is stored for a maximum of 14 days, after which it is deleted.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in ensuring the stability and security of the website).

6. team members (AWSM Team Pro)

On our website, we present individual team members with names, photos and possibly other personal data (e.g. e-mail, position). The publication is based on the consent of the respective persons.

Every team member has the right to withdraw their consent at any time. If you as a team member would like to have your data removed, please contact us at datenschutz@mwteam.com.

7. member roles and access (Members Plugin)

Our website uses the Members plugin to set up different user roles and authorizations. If registered users exist, their data (e.g. user name, e-mail, role affiliation) is only stored for the purpose of access management.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in access control).

8. elementor

The plugin itself does not store any personal data. However, if content such as texts or images containing personal data are integrated, this is done in accordance with the applicable regulations.

9. password protect

A password is required to access protected content. No login attempts are saved or analyzed.

10 UpdraftPlus - Backup/Restore

Backups of the website are regularly created and stored externally. These also contain personal data, if such data is available on the website. External storage locations are carefully checked and GDPR-compliant.

11. weglot Translate

Translations are processed on the server side. Texts may be transmitted temporarily and stored temporarily. We only use providers with clear data protection guidelines and European server locations where possible.

12. external media / fonts / scripts

If we integrate external resources, we also observe data protection-compliant integration here. Where applicable, this is only done with the consent of the cookie banner.

This website uses fonts (“Google Fonts”) provided by Google. To do this, your browser downloads fonts from a Google server. In the process, data is automatically transmitted to Google (e.g., IP address, language settings, screen resolution). Google may store this data.

The integration takes place in the interest of a uniform and appealing presentation of our content (Art. 6 para. 1 lit. f GDPR). Further information on Google Fonts can be found at:

https://developers.google.com/fonts/faq

13. Information on Data Processing for the MTI Conversa Demo Account

IMPORTANT USER NOTICE BEFORE STARTING A CALL

Please do not enter any real personal data belonging to third parties (e.g., customers' real names, actual complaint or case numbers, contact information) in the chat or voice input fields. The free-text input is forwarded directly to external language models for processing.

Data Controller and Contact Information

The controller, as defined by the General Data Protection Regulation (GDPR) and other national data protection laws and regulations, for the processing of personal data in connection with this demo access is:

Machwürth Team International GmbH

19 Dohrmanns Horst, 27374 Visselhövede

Authorized Representative: Hans-Peter Machwürth

Email: h-p.machwuerth@mwteam.com

Website: conversa.mticonsultancy.com

Data Protection Officer / Designated Point of Contact:

Karsten Bretfeld

Tel. +49-4262-9312-32

Email: datenschutz@mwteam.com

Scope and Type of Data Processed

When you use the free MTI Conversa demo access (which is available without registration or a user account), we process the following categories of personal data:

• Conversation Content: Free-form text that you enter into the chat window during the conversation.
• Voice recordings (optional): Audio data is recorded as soon as you enable the microphone function for voice input.
• Usage and metadata per message: message timestamp, sequential conversation number, character count, AI response time, and HTTP status codes. (Content is not stored in the usage log.)
• Session Data & Cookies: Technically necessary session cookies used to maintain the active session.
• IP Address & Security Hash: The IP address is recorded in plain text in the web server log files. Within the application itself, the IP address is used exclusively as a hash value for a request counter (to prevent excessive use or abuse).
• Evaluation & Feedback: Total score generated at the end of the session, along with a detailed explanation and feedback on the conversation that took place.
• Contact Information: Email address and phone number for our internal staff to contact you.

Purposes and Legal Bases for Processing

Your data is processed for the following purposes and on the basis of the legal grounds specified:

• Provision of the demonstration / demo access: Processing of the data entered to conduct the interactive AI conversation. The legal basis is Article 6(1)(b) of the GDPR (pre-contractual relationship) and, alternatively, Article 6(1)(f) of the GDPR (legitimate interest in demonstrating our product portfolio).
• Prevention of Abuse & Cost Containment: Tracking request limits via IP hash. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest; see Recital 49 of the GDPR regarding the prevention of abuse and ensuring network and information security).
• Operational Reliability & Troubleshooting: Analysis of system logs (status codes, performance). The legal basis is Article 6(1)(f) of the GDPR.
• Technically necessary cookies: Storage of the session cookie to maintain the connection in accordance with Section 25(2)(2) of the Telecommunications and Digital Services Data Protection Act (TDDDG) (absolutely necessary).
• Legitimate interest: We use your email address and phone number exclusively to contact you (e.g., to respond to inquiries, to process orders). Legal basis: Art. 6(1)(b) of the GDPR (contract-related communication); otherwise, Art. 6(1)(f) of the GDPR (legitimate interest).

Recipients and Data Processors

To provide these features, we use selected service providers under data processing agreements (Art. 28 of the GDPR). We have entered into appropriate data processing agreements with all service providers:

• OpenAI: Used for speech recognition (dictation/Whisper), text-to-speech (read aloud), translation of learning materials, and generation of avatar images. [Contracting entity as listed on the account: OpenAI OpCo LLC].
• AI language model: The model integrated into Workllow (GPT-4o-min (latest)). [OpenAI OpCo LLC].
• Web Hosting & Infrastructure: Host Europe / Strato AG, with server management via ISPConfig / Apache Web Server (Domain: conversa.mticonsultancy.com).

Data Transfer to Third Countries

To the extent that data is transferred to recipients outside the European Union (EU) or the European Economic Area (EEA) (particularly the U.S.), this is done on the basis of adequate data protection safeguards:

• Existence of an adequacy decision by the European Commission (e.g., the EU-U.S. Data Privacy Framework—DPF), provided that the respective U.S. provider is certified under the DPF.
• Alternatively, based on Standard Contractual Clauses (EU Standard Contractual Clauses—SCCs) pursuant to Article 46(2)(c) of the GDPR, along with additional security measures.

Retention period

Microphone Use and Automatic Evaluation

Voice Input & Microphone

Access to your device's microphone is granted only after you have explicitly authorized it in your browser. The recording is sent directly to the data processor for conversion to text and is not stored as an audio file within Conversa itself.

Automatic Scoring

At the end of the demo, the AI model analyzes the conversation and generates a score along with brief feedback. This evaluation is intended solely to provide immediate feedback during the demonstration. The demo version does not involve automated decision-making in individual cases with legal effects (Art. 22 GDPR). (Note: If results are used by customers in the future for personnel evaluations, the responsibility under data protection law lies with the respective customer.)

Rights of Data Subjects

You have the following rights with respect to your personal data vis-à-vis the data controller:

• Right of Access (Art. 15 of the GDPR): The right to access your processed data.
• Rectification & Erasure (Art. 16, 17 GDPR): Right to have inaccurate data corrected or erased.
• Restriction of Processing (Art. 18 GDPR) & Data Portability (Art. 20 GDPR).

Right to File a Complaint with a Supervisory Authority (Art. 77 of the GDPR):

You have the right to file a complaint with a data protection supervisory authority regarding our processing of your personal data. The supervisory authority with jurisdiction over us is:

Denis Lehmkemper, P.O. Box 221, 30002 Hanover, 0511 120-4500, poststelle@lfd.niedersachsen.de]

Link Placement and Accessibility

In accordance with the requirements, this privacy policy must be linked to or incorporated in the following locations:

• Directly below the demo access registration form (start of data processing).
• Always accessible in the footer of the currently running application package.

14. Retention Period

Personal data is only stored for as long as is necessary for the respective purpose or as required by law. Examples

• Backup files: maximum 90 days
• Logs: only as long as necessary for security and recovery
• User account data: until deletion by the user or expiry of the purpose limitation

15. Rights of the Data Subject

As a user, you have the following rights:

• Information (Art. 15 GDPR): You can request information about your data stored by us.
• Rectification (Art. 16 GDPR): Incorrect data can be rectified.
• Deletion (Art. 17 GDPR): You can request the erasure of your data, provided there is no statutory retention requirement.
• Restriction of processing (Art. 18 GDPR): Under certain conditions, processing may be restricted.
• Objection (Art. 21 GDPR): You can object to the processing.
• Data portability (Art. 20 GDPR): You can receive your data in a structured, commonly used format.

To exercise these rights, simply send us a message to datenschutz@mwteam.com.

16. Data Security

We use technical and organizational measures to protect your personal data from loss, destruction, access, modification or dissemination. Nevertheless, we cannot guarantee complete data security.

17. Right to File a Complaint with the Supervisory Authority

If you believe that the processing of your data violates applicable data protection law, you have the right to lodge a complaint with the competent data protection supervisory authority.

z. e.g. State Commissioner for Data Protection of Lower Saxony (LfD)

18. Changes to This Privacy Policy

We reserve the right to amend this privacy policy as necessary in order to adapt it to new legal or technical circumstances. You will always find the current version at

https://www.mticonsultancy.com/datenschutz

Status of the privacy policy: 12.06.2025