Data Protection

Melster Consulting GmbH, as the operator of this website, takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. Using this website involves the collection of various personal data. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

The following notes give a simple overview of what happens to your personal data when you visit this website. Detailed information on data protection is available in the privacy policy set out below.

Please note that data transmission over the internet (for example, when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

 

Controller

The controller responsible for data processing on this website is:

Melster Consulting GmbH
Josef-Orlopp-Straße 32-36
10365 Berlin

Phone: +49 30 555751830
Email: info@melster-consulting.gmbh

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data (such as names, email addresses, and similar).

 

Data Processing in the ASPICE Pro Application

This section covers the ASPICE Pro AI assistant itself, separately from the general website data described below.

Where is your data stored, and which third parties are involved?

Everything persistent is stored in Germany on Hetzner infrastructure: application, databases, knowledge graph, backups. Model inference runs transiently on an EU endpoint (Google Vertex Europe, via OpenRouter). Vercel serves static frontend assets only. Stripe handles billing and never sees content. No sub-processor outside the EU/EEA stores content at rest. Records of processing, technical and organisational measures, and a per-sub-processor transfer assessment are available for review on request.

 

Is your data used to train models? Does it leave Europe?

No training, no retention, inference stays in Europe. Inference is pinned to an EU endpoint under a zero-data-retention policy, enforced per request in code, and it fails closed: if the EU endpoint is unavailable the request fails rather than routing elsewhere. Nothing is stored outside Germany. Embeddings are computed once and stored on our own infrastructure.

 

Data processing agreement (DPA)

Melster Consulting GmbH acts as your processor under Art. 28 GDPR for data processed through ASPICE Pro. We conclude a data processing agreement with business customers as part of the engagement. Behind it: records of processing (Art. 30 GDPR), technical and organisational measures (Art. 32 GDPR), a per-sub-processor third-country transfer assessment, and a documented breach-notification process.

 

What happens to your data if something goes wrong?

Your data in ASPICE Pro is your working sessions and your account. Automated daily backups run on German infrastructure with tiered retention. For a dedicated deployment, continuity arrangements such as off-site backup targets and restore objectives go into the contract, sized to your requirements.

 

Data Collection on This Website

How do we collect your data?

Some data is collected because you provide it to us. This can be data you enter in a contact form, for example. Other data is collected automatically, or after your consent, by our IT systems when you visit the website. This is mainly technical data (such as browser, operating system, or the time the page was accessed). This data is collected automatically as soon as you enter this website.

 

What do we use your data for?

Some of the data is collected to ensure the website is provided without errors. Other data may be used to analyse how visitors use the site.

 

What rights do you have regarding your data?

You have the right, at any time and free of charge, to obtain information about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this and any other questions about data protection.

 

What data is stored in the log file?

The provider of the website automatically collects and stores information in what are known as server log files, which your browser automatically transmits to us. These are:

  • Browser type and version

  • Operating system used

  • Referrer URL

  • Host name of the accessing device

  • Time of the server request

  • IP address

 

This data is not combined with data from other sources. It is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of the website. The server log files are collected for this purpose.

 

How long do we store the data?

Unless a more specific storage period is stated within this privacy policy, your personal data remains with us until the purpose for its processing no longer applies. If you make a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data (such as retention periods under tax or commercial law). In the latter case, deletion takes place once these grounds no longer apply.

 

How is the data encrypted?

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from "http://" to "https://", and by the padlock symbol in your browser bar. When SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.

 

What happens to data from the contact form?

If you send us enquiries via the contact form, your details from the enquiry form, including the contact data you provide there, are stored with us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent. This data is processed on the basis of Art. 6(1)(b) GDPR, provided your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR), or on your consent (Art. 6(1)(a) GDPR), if this was requested. The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (for example, once your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

 

What happens to data from an enquiry by email, phone, or fax?

If you contact us by email, phone, or fax, your enquiry, including all resulting personal data (name, enquiry), is stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. This data is processed on the basis of Art. 6(1)(b) GDPR, provided your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR), or on your consent (Art. 6(1)(a) GDPR), if this was requested. The data you send us through such enquiries remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (for example, once your matter has been fully processed). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

 

External hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host's servers. This may include IP addresses, contact enquiries, meta and communication data, contract data, contact data, names, website visits, and other data generated through a website. The host is used for the purpose of fulfilling our contractual obligations towards our prospective and existing customers (Art. 6(1)(b) GDPR), and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR). Our host will only process your data to the extent necessary to fulfil its service obligations, and will follow our instructions regarding this data.

We use the following host:
LANGHOFF Online Services
Josef-Orlopp-Straße 32-36
10365 Berlin

 

Data processing agreement with our host

To ensure GDPR-compliant processing, we have concluded a data processing agreement with our host.

 

Your Rights

Withdrawing your consent

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of any data processing carried out before your withdrawal remains unaffected.

 

Right to lodge a complaint

In the event of a breach of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work, or the place of the alleged breach. This right exists regardless of any other administrative or judicial remedy.

 

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

 

Access, deletion, and rectification

Within the scope of applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of the processing, and, where applicable, a right to the rectification or deletion of this data. You can contact us at any time regarding this and any other questions on personal data. For your ASPICE Pro account specifically, your account and personal data can be exported in a structured, machine-readable format, and deleted, under Arts. 15, 17, and 20 GDPR, at no cost.

 

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing applies in the following cases:

  • If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of this verification, you have the right to request the restriction of the processing of your personal data.

  • If the processing of your personal data has been or is unlawful, you can request the restriction of data processing instead of its deletion.

  • If we no longer need your personal data, but you need it to assert, exercise, or defend legal claims, you have the right to request the restriction of the processing of your personal data instead of its deletion.

If you have objected under Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it is not yet clear whose interests prevail, you have the right to request the restriction of the processing of your personal data. If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent, or for the assertion, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.