Privacy Information Regarding AI Chatbots

1. Account and Login Information

• Data from your UniAccount (e.g., name, ID, email address)
• Encrypted login token
• Purpose: Login and management of permissions

2. Inputs and chat histories

• Your input and uploaded files
• Responses from the chatbot
• Purpose: To process your requests and store conversations so you can review and continue them

3. Technical log data

• IP address
• Times of access
• Purpose: Operation, error analysis, and system security

4. Feedback

• Ratings and comments
• Related questions and answers
• User ID
• Purpose: Quality assurance and improvement of the chatbot. Anonymous test questions with no personal references are created from the feedback.

The data comes from the university’s central login system, from your own entries, and from your browser. Personal data may also be contained in the university’s websites and documents, which the chatbots access as a source of information.

Processing is carried out on the basis of Article 6(1)(e) of the GDPR in conjunction with Section 3(1) of the Hessian Data Protection and Freedom of Information Act (HDSIG). The chatbots support the university in fulfilling its duties. For the processing of employee data for the provision and use of the chatbots as work tools, Art. 6(1)(b) of the GDPR (employment or service contract) also applies.

Providing data is voluntary. However, you cannot use the chatbots without login credentials.

No automated decision-making takes place in individual cases pursuant to Article 22 of the GDPR. The chatbots are designed to assist you; technical review and decision-making remain the responsibility of the appropriate personnel.

Within the university, access is granted only to those who need it to perform their duties: authorized administrators at the IT Service Center (ITS) as well as the staff responsible for the knowledge base and the analysis of feedback.

In addition, we engage service providers who act on our behalf and in accordance with our instructions (processors under Article 28 of the GDPR):

• an IT service provider for the administration and maintenance of the chatbot platform
• Operators of the language models, with headquarters and data centers located in the EU; your input is processed there solely for the purpose of generating a response and is not stored afterward

Your data will not be transferred to countries outside the EU or the European Economic Area.

We store your data only as long as necessary for the respective purpose.

• Account and login information: Deleted after 12 months of inactivity.
• Chat histories and uploaded files: Deleted after 12 months of inactivity. Users can delete their data themselves at any time, either individually or in its entirety.
• Technical log data: Deletion period not yet determined.
• Feedback: Deleted after the feedback has been processed. The analyses generated from this feedback do not contain any personal data and are reused.

You have the following rights with respect to your personal data vis-à-vis the University of Kassel:

• Access to stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), even if you cannot delete chats yourself within the interface
• Restriction of processing (Art. 18 GDPR)
• Objection to processing on grounds relating to your particular situation (Art. 21 GDPR)

To exercise your rights, please contact the Data Protection Officer (contact information above).

You have the right to file a complaint with a data protection supervisory authority. The authority responsible for the University of Kassel is:

The Hessian Commissioner for Data Protection and Freedom of Information

• Mailing address: P.O. Box 31 63, 65021 Wiesbaden
• Phone: 0611 1408-0
• Website: www.datenschutz.hessen.de