Hallo Marco Hallo Marco

Template for your privacy policy

If your business uses Hallo Marco, you are responsible for the data of your callers and customers and must inform them (Art. 13 GDPR). You can copy the following text into your privacy policy. Version 1.2, as of 27 October 2026. The German version is at hallomarco.de/datenschutz-textbaustein.

How to use it:

  • Replace the information in square brackets and delete the paragraphs on channels you do not use.
  • Check the legal bases for your business. Medical practices and law firms should best agree the wording with their data protection officer or professional chamber.
  • The text is a template and not legal advice. It does not replace a review of your own privacy policy.
  • On the phone, Marco does not inform callers of every detail. Keep the text available on your website and give its address on request.

AI assistant for phone, messages and website chat

We use the AI assistant Hallo Marco of Bavarian Valley UG (haftungsbeschränkt), Passauer Str. 21, 81369 Munich, Germany. It answers calls on our behalf [and replies to messages via WhatsApp, email and the chat on our website]. At the beginning of every conversation, it says that you are talking or writing to an AI assistant. Bavarian Valley processes the data on our behalf under Art. 28 GDPR on the basis of a data processing agreement. We remain the controller.

Which data: your phone number or sender address, date, time and duration of the conversation, the content of the conversation as text, a summary of your request and the information you give us, such as name, contact details and preferred appointment.

What for: to answer your questions, take down your request, arrange appointments and call you back. The assistant makes no decisions with legal effect for you; people in our business decide on your request.

Legal basis: Art. 6(1)(b) GDPR where your request concerns a contract or steps prior to a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to be reachable for you and to handle enquiries quickly. [For medical practices: if you share health data with us, we process it under Art. 9(2)(h) GDPR in conjunction with § 22(1) no. 1(b) of the German Federal Data Protection Act (BDSG), where necessary for your treatment.]

How it works technically: Calls are answered by a telephony provider with an EU region. Speech recognition and speech output and the AI language model that understands your request and replies run at providers that also process data in the USA. The search in our knowledge runs in Germany. Conversation histories and summaries are stored in Germany. Bavarian Valley names the providers used at hallomarco.com/dpa (Annex 2). Transfers to the USA are based on the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

Retention: We delete conversations, summaries [and recordings] after [30 / 90 / 365] days unless we need them for longer, for example because an order [or treatment] results from them, or must retain them by law. Your contact details, such as name and phone number, are kept so that we recognise you when you get in touch again, until we delete them or you request their erasure.

[Recording: Calls are recorded so that we can follow your request precisely. You are informed before the recording starts. If you do not want the call to be recorded, please end it and write to us at [email address] instead. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future. We delete recordings together with the conversation.]

[Website chat: The chat on our website only loads when you open it. It sets no cookies. So that the conversation is kept when you move between our pages, only a conversation identifier is stored in the storage of your browser tab and deleted when you close the tab (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). To protect against abuse, your IP address is processed briefly for rate limits (Art. 6(1)(f) GDPR).]

[WhatsApp: If you write to us via WhatsApp, WhatsApp Ireland Limited (Meta) also processes your messages on our behalf, also outside the EU. The use of WhatsApp itself is also governed by the terms and privacy policy of WhatsApp that you accepted as a WhatsApp user. If you do not want this, call us or send us an email. We only send reminders via WhatsApp if you have agreed.]

[Email: Emails to [email address] are read by the assistant, which prepares a reply. [An employee checks the reply before it is sent.]]

[Appointments: If you arrange an appointment, the assistant enters it in our calendar at [Google / Microsoft]. You receive a confirmation by email [or SMS].]

Your rights: You have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests, and the right to lodge a complaint with a data protection supervisory authority. Please contact us for this: [contact of your business].