Medius privacy policy
Medius is a communication workspace that businesses, mainly hotels and other hospitality companies, use to answer the people who contact them by e-mail, website chat, WhatsApp, Facebook Messenger, Instagram and telephone. This policy explains which personal data Medius processes, for whom and how. Medius is provided by DALMOS SYSTEMS, obrt za informatičke usluge, vl. Noa Matas, Šibenik, Ulica Sedmog kontinenta 1 (MBO 99393786).
Who is responsible for your data
The business you contact through Medius (our customer, for example a hotel) is the controller of your personal data: it decides why and how your messages and calls are processed. Dalmos Systems processes that data only on the customer’s behalf and on its documented instructions, as its processor under a data processing agreement (Article 28 GDPR).
Dalmos Systems is the controller only for the data it needs to run its own business: the contact and billing details of its customers, its correspondence with them and the security of the service. Enquiries sent through dalmossystems.com are covered by the privacy policy of this website.
What data Medius processes
About the people who contact our customers: e-mails with their headers, senders, recipients and attachments; website chat messages and files, and the name and e-mail address if they are entered in the chat form; WhatsApp, Facebook Messenger and Instagram messages and media together with the name and identifier the platform provides (for WhatsApp, the phone number), only if the customer has connected these channels; for telephone, only if the customer uses it: phone numbers, the time, duration and outcome of calls, voicemail messages, answers to caller surveys (the keys pressed) and call recordings, which are made only where the customer has switched recording on under its own recording policy; and contact lists the customer imports for call campaigns.
About the customer’s staff who use Medius: name, work e-mail address and the identifier of their Microsoft Entra ID account (staff sign in with their organisation’s Microsoft account), role, availability, settings and their activity in Medius, such as assignments, replies, notes and calls.
Notes, categories and links to records in the customer’s own CRM that the customer’s staff add to conversations.
Technical data needed to deliver and protect the service, such as IP addresses and request details. The website chat sets no cookies, uses no persistent visitor identifier and does not store visitors’ IP addresses. Our application logs record technical identifiers and counts, not the content of messages.
What the data is used for
Medius uses this data only to provide the service to the customer: to receive, route and deliver messages and calls, to show conversations to the customer’s staff and let them search them, to keep them in step with the customer’s CRM, to produce reports and statistics for the customer, to protect the service against spam and abuse, to keep it secure and to help the customer when it asks for support.
We do not sell personal data, do not use it for advertising or marketing profiles, and do not use the content of conversations to train AI models.
The chat assistant
A customer can switch on an AI chat assistant in its website chat. The assistant answers visitors from information the customer has provided, such as the texts of its website, and hands the conversation to a person when the visitor asks for one or when it cannot help.
Visitors’ messages to the assistant are processed by Azure OpenAI Service in Microsoft Azure within the European Union. Microsoft does not use these prompts and answers to train or improve its models; to prevent misuse, Microsoft may keep flagged content for review within the same geography. We do not write the content of these conversations to our logs.
Legal basis
The customer decides on the legal basis of its processing, typically the performance of a contract or steps before one (Article 6(1)(b) GDPR), its legitimate interest in answering enquiries and running its business (Article 6(1)(f)), its legal obligations (Article 6(1)(c)) or consent where the law requires it, for example for certain call recordings. Dalmos Systems processes this data under the data processing agreement with the customer (Article 28 GDPR).
For the data of our customers’ contact persons, our basis is the contract with the customer and our legitimate interest in managing it (Article 6(1)(b) and (f) GDPR), and our obligations under accounting and tax law (Article 6(1)(c)).
Where the data is stored
Medius runs in Microsoft Azure. Our customers’ data is stored and processed in Azure data centres in the European Union; the chat assistant and the text-to-speech service that reads out telephone menu prompts also run in Azure in the European Union. Our test systems, which hold test data and no customer data, run in Azure in Switzerland and Italy.
Some of the providers listed below may process data outside the EU and the EEA, for example Cloudflare’s global network, or Meta’s messaging platforms when a customer uses them. Such transfers rely on the safeguards of the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses.
Service providers
Microsoft (Microsoft Azure), our sub-processor: hosting, databases, file storage, caching, messaging, key management and monitoring of Medius; Azure OpenAI Service and Azure AI Search for the chat assistant; and Azure AI Speech for telephone menu prompts; all in the European Union.
Cloudflare, our sub-processor: secure delivery and protection of the Medius web address (encryption in transit, firewall), bot protection for the website chat where it is switched on (Cloudflare Turnstile), and relaying the encrypted audio of calls made with the browser phone (Cloudflare Realtime TURN). Cloudflare does not store the content of messages.
Services that the customer chooses and connects, under its own agreements with them (they are not our sub-processors): the customer’s e-mail provider (for example Microsoft 365, Google Gmail or another IMAP and SMTP provider); Meta Platforms for WhatsApp, Facebook Messenger and Instagram; other messaging providers such as Vonage; the customer’s telephone system and carrier; and the customer’s own Microsoft Dataverse or Dynamics 365 environment, into which Medius writes e-mails, conversations and calls on the customer’s instructions.
Dalmos Systems staff access customer data only when this is necessary to operate the service or when the customer asks for support.
How long the data is kept
Messages (e-mails, chats and messages from WhatsApp, Messenger and Instagram) are kept as long as the customer decides: the customer can set a period between 30 days and 100 years, after which Medius deletes them automatically, or keep them until it deletes them itself.
Call records, including voicemail messages and survey answers, are kept for 13 months unless the customer sets a period between 1 and 120 months. Call recordings are deleted automatically at the end of the period set in the customer’s recording policy. The history of how conversations were assigned is kept for 13 months by default (the customer can set 30 days to 100 years), statistics for reports for 36 months by default (1 to 120 months) and notifications for at most 30 days. A customer can suspend deletion (legal hold) where the law requires it.
Files that no conversation refers to any more are deleted after 7 days. Deleted data remains in backups for a limited time and then expires automatically: at present 7 days for database backups, 30 days for deleted files and 90 days for earlier versions of files. Technical logs, which contain identifiers and counts but no message content, are kept for 90 days.
When a customer stops using Medius, its access ends and, after a notice period of 30 days unless agreed otherwise, all of its data is deleted from Medius; the backup periods above then apply. Data that Medius wrote into the customer’s own CRM remains under the customer’s control.
Data for which Dalmos Systems is the controller, such as contracts, invoices and correspondence with customers, is kept for the duration of the contract and afterwards for as long as Croatian accounting and tax law requires.
Security
Data is encrypted in transit and at rest. Each customer’s data is kept separate from every other customer’s data in the database (row-level security). Staff sign in through their organisation’s Microsoft Entra ID; the Medius services use managed identities without stored passwords, and mailbox passwords and keys are kept in Azure Key Vault. Access is limited to what each role needs.
Your rights
Under the GDPR you have the right of access to your data, to rectification and erasure, to restriction of processing, to object and to data portability, and to withdraw your consent at any time where processing is based on consent.
If you contacted a business that uses Medius, please send your request to that business, because it decides about your data. Medius gives the business a tool that finds and deletes one person’s data across e-mails, chats, messages, calls, recordings and attachments. If you write to us instead, we forward your request to the business without delay and help it to answer.
For data for which Dalmos Systems is the controller, write to hello@dalmossystems.com. We answer within one month.
You may lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, www.azop.hr, or with the supervisory authority of the EU country where you live or work.
Deleting data received through Facebook, Instagram or WhatsApp
How to request the deletion of messages and identifiers that Medius received through Facebook Messenger, Instagram or WhatsApp is explained step by step on the Medius data deletion page (link below).
Changes and contact
We update this policy when Medius or the law changes and show the date of the current version at the top. Questions: hello@dalmossystems.com, or by post to Ulica Sedmog kontinenta 1, 22000 Šibenik, Croatia.