Privacy policy
Draft. This text has not yet been approved by a lawyer.
This is a translation for your convenience. The German version is the legally binding one.
1. Controller
MFM Elektrotechnik e.K., Hauptstr. 8, 31515 Wunstorf, email: support@mfm.energy.
This policy applies to the website mfm-voice.com and to the MFM Voice service, which connects a Loxone Miniserver to Amazon Alexa.
2. Visiting the website
When you open the website, our server processes technically necessary data: IP address, time, page requested, volume of data transferred and the information sent by your browser. We need this data to deliver the page and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR.
Cookies: The website sets a single cookie, and only if you change the language. It remembers your choice of language. This cookie is technically necessary (§ 25(2) TDDDG). A consent banner is therefore not required.
Audience measurement: This website does not measure its audience. There is no analytics tool and no third-party service embedded.
Fonts: The font is loaded from our own server. Nothing is retrieved from a font provider.
3. Account and use of the service
If you create an account and use MFM Voice, we process:
- Account data: email address, password as a hash (bcrypt), account status.
- Connection data of your Miniserver: address, user name and password. We store the password exclusively in AES-256 encrypted form. It is decrypted only at runtime, in order to establish a connection to your Miniserver on your behalf.
- Device data: name, room and type of the devices you share.
- Link to Alexa: an access token that connects your MFM Voice account to your Amazon account. We do not receive your Amazon password.
- Payment data: subscription status and your customer ID with Stripe. Card details and bank details are processed exclusively by Stripe.
The legal basis is the performance of the contract with you (Art. 6(1)(b) GDPR).
Voice commands: Amazon recognises your voice command and sends us the recognised command, for example “Licht Küche ein” (kitchen light on). We convert it into a control command to your Miniserver. We do not receive or store audio recordings. They remain with Amazon and are subject to Amazon’s privacy notice.
Access to your Miniserver: Access takes place via Loxone remote access with the credentials you have stored, and only to carry out commands and status queries that you have triggered. A Miniserver can only ever be connected to one MFM Voice account.
4. Contact form, partner enquiry, cancellation form
Messages sent through our forms reach us by email. We process the information you provide there in order to deal with your request (Art. 6(1)(b) and (f) GDPR). We log cancellations made through the “Cancel contracts here” form with the date and time of receipt, because we have to prove receipt (Art. 6(1)(c) GDPR in conjunction with § 312k BGB, German Civil Code).
5. Emails
We send you emails that are necessary for the contract: confirmation of the email address, password reset, notices about the trial period, invoices, acknowledgement of receipt of a cancellation. You receive promotional emails only if you have given your consent.
6. Recipients and processors
| Service provider | Purpose |
|---|---|
| Hetzner Online GmbH, Germany | Operation of the servers in Nuremberg |
| Amazon (Alexa, Amazon Web Services) | Speech processing; receipt of the Alexa commands in the EU (Ireland region) |
| Stripe Payments Europe Ltd., Ireland | Payment processing, invoices |
| STRATO AG, Germany | Server for sending email |
Stripe and Amazon may also process data in the USA. The basis for this is the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework and, where necessary, standard contractual clauses.
7. Storage period
We store your data for as long as your account exists. You can remove a connected Miniserver yourself in MFM Voice at any time; its connection data and device list are deleted with it. We delete your account on request to support@mfm.energy. Statutory retention periods, for example for invoices, remain unaffected. We delete the access logs of the web server after 14 days.
8. Your rights
You have the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability and the right to object. You can withdraw consent at any time. You can remove the link to Alexa at any time in the Alexa app. To have your account deleted, send an email to support@mfm.energy.
Please send requests to support@mfm.energy.
You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen).