Privacy Policy for Chat-AI

For what purpose will personal data be processed?

The processing of personal data by the centrally provided LLM AI application Chat-AI in everyday work at TUD Dresden University of Technology is carried out exclusively for the following purposes:

• Support in research, text and idea generation,
• Facilitation of administrative and organisational activities,
• Creation or evaluation of image material,
• Evaluation of audio material,
• Promotion of teaching, research and administration through digital assistance functions.

Who is responsible for data processing and to whom can data subjects turn?

Responsible in the sense of Art. 4 No. 7 GDPR is TUD Dresden University of Technology.

Responsible Department

TUD Dresden University of Technology
Der CDIO
Prof. Lars Bernard

Tel.: +49 (0)351 463-41100
Email: cdio@tu-dresden.de

Data Protection Officer

Data Protection Officer of the TUD Dresden University of Technology
Mr Jens Syckor
01062 Dresden

Tel.: +49 (0)351 463-32839
Email: informationssicherheit@tu-dresden.de

Which personal data will be processed?

When using the AI application, the following data is processed:

• User data such as surname, first name, ZIH login, email address, user ID
• Device and usage data (e.g. browser type, operating system, IP address, times of use)
• Cookies for service provision
• Search queries (prompts) and interactions
• Voice recordings when using VoiceAI.

What is the legal basis for processing personal data?

The legal basis for use is generally Art. 6(1)(a) GDPR (consent). Use is therefore voluntary. By using Chat-AI for the first time, you consent to the processing of personal data for use.

The legal basis for the use of prompts with personal content data is consent (Art. 6 (1) (a) GDPR) or § 3 (1) SächsDSDG for data processing with low intensity of intervention. This is the responsibility of the structural unit that uses AI for the specific data processing.

When processing personal data for the performance of a contract to which the data subject is party, Article 6(1)(b) GDPR serves as the legal basis.

How long is personal data stored?

Your personal data will be deleted upon request or after five years of inactivity as a user. The web server software logs are deleted after 90 days. The length of the request and the length of the response, the timestamp of the request and the user ID are stored for one year for billing purposes.

All Chat-AI data displayed in the browser is only stored on the client side in the user's browser and is only transmitted to the servers for the necessary processing when requested by the user, i.e. while the data is being processed by the backend models. After the end of a session in the browser, no user input is available.

Will personal data be transferred to third parties?

TUD Dresden University of Technology uses the following IT service provider to provide the AI application:

Gesellschaft für wissenschaftliche Datenverarbeitung mbH Göttingen (GWDG)
Burckhardtweg 4
37077 Göttingen

What are the basic rights of data subjects?

• Right to voluntary nature and revocation (Art. 7 (3) GDPR)

  Consent may be refused or revoked at any time informally and without giving reasons to the controller.

• Right to information (Art. 15 GDPR)

  Data subjects have the right to obtain at any time information on the data processed concerning them and on the possible recipients of such data. They are entitled to receive a reply within a period of one month after submitting the request.

• Right of correction, deletion and restriction (Art. 16 - 18 GDPR)

  The persons concerned may at any time request TUD Dresden University of Technology to correct or delete their personal data or to restrict the processing of such data.

• Right to data transferability (Art. 20 GDPR)

  The persons concerned can demand that TUD Dresden University of Technology transfers their personal data to them in a machine-readable format. Alternatively, they may request that the personal data provided by you be transferred directly to another responsible party, as far as this is possible.

• Right of objection (Art. 21 GDPR)

  You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) GDPR. The controller shall no longer process the personal data unless the controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

• Right of appeal (Art. 77 GDPR)

  Data subjects can contact the Data Protection Officer of TUD Dresden University of Technology at any time and, in the case of a complaint under Art. 77 GDPR, a supervisory authority for data protection. The responsible supervisory authority for TUD Dresden University of Technology is:

  Sächsische Datenschutz- und Transparenzbeauftragte
  Frau Dr. Juliane Hundert
  Maternistraße 17
  01067 Dresden
  Email: post@sdtb.sachsen.de
  Telephone: +49 (0)351 85471-101
  www.datenschutz.sachsen.de

To exercise these rights, notification in text form (letter or email) to the controller is sufficient.