Data controller

The data controller within the meaning of Article 4(7) of the GDPR and other national data protection laws of the Member States, as well as other data protection provisions, is:

University of Duisburg-Essen

Duisburg Campus:
Forsthausweg 2
47057 Duisburg
Tel.: +49 203 379-0
Fax: +49 203 379-3333

Essen Campus:
Universitätsstraße 2
45141 Essen
Tel.: +49 201 183-0
Fax: +49 201 183-3536

Website: www.uni-due.de

The University of Duisburg-Essen is represented by its Vice-Chancellor:

Prof. Dr Barbara Albert
rektorin@uni-due.de
Duisburg Campus
Tel.: +49 203 379-2465
Essen Campus
Tel.: +49 201 183-2000
Website: www.uni-due.de/de/rektorat/rektorin.php

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Contact person / Data Protection Officer

Dr Kai-Uwe Loser
(Official Data Protection Officer for the University of Duisburg-Essen)
Wasserstraße 221
44799 Bochum

Tel.: +49 234 322-8720
kai-uwe.loser@uni-due.de
Website: www.uni-due.de/verwaltung/datenschutz

General information on data processing

Overview of the service

The ChatAI service consists of several components, notably a web front-end and a large language model in the back-end. The service is operated by the GWDG on behalf of the UDE (data processing on behalf of a third party). The front-end provides users with a web interface enabling them to enter queries directly via their browser. Furthermore, users can select the desired model and configure certain settings. The front-end forwards all queries to the selected model back-end. For data protection reasons, a distinction is made between models hosted locally by GWDG on behalf of the UDE and external models from other providers, with the external models being clearly labelled as such.

The back-end is hosted via the GWDG platform SAIA. It receives all requests and forwards them to the relevant model. In the case of external models, the requests – more specifically, the history transmitted via the browser, including the intermediate text of the models as entered by the user – are forwarded to the external provider. For self-hosted models, the requests are processed solely on GWDG’s systems.

Scope of the processing of personal data

As a general rule, we process our users’ personal data only to the extent necessary to provide a fully functional website and to deliver our content and services.

Legal basis for the processing of personal data

Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.

Where the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Article 6(1)(d) of the GDPR serves as the legal basis.

Use of the ChatAI website (front end)

Description and scope of data processing

Every time chat-ai.academiccloud.de is accessed, the system automatically collects data and information from the computer system of the accessing device.

The following data is collected in all cases:

• Date of access
• Name of the operating system installed on the accessing device
• Name of the browser used
• Source system via which access took place
• The IP address of the accessing device

The data is also stored in our system’s log files. This data is not stored together with any other personal data relating to the user.

All ChatAI data displayed in the browser is stored solely on the client side within the user’s browser and is only transmitted to the servers when the user makes a request requiring such processing; that is, whilst the data is being processed by the backend models. Once a browser session has ended, no user input remains.

General Use of Models

Description and Scope of Data Processing

For billing purposes, the following data is stored and logged on the GWDG server for every request:

• Date of the request
• User ID
• Length of the request and response

Depending on whether locally hosted models or external models are used, slightly different data protection regulations apply.

No liability can be accepted for the automatically generated responses. Responses may be entirely incorrect, contain incorrect partial information, or include unlawful content.

Duration of storage

The billing data is stored for one year.

Use of self-hosted models

Description and scope of data processing

In order to use the models hosted by the GWDG, users’ inputs and queries are processed on the GWDG’s systems. Protecting the privacy of user enquiries is of fundamental importance to us. For this reason, when used in conjunction with the self-hosted models, our service neither stores the content of your enquiries (chat history) nor does it store prompts or responses on permanent storage at any time.

Duration of storage

The input data is stored on the GWDG server only whilst it is being processed by the large language models themselves, i.e. whilst the data is being processed on the user’s own systems.

Use of external models from OpenAI

In order to use OpenAI’s models, we forward the relevant request (the user’s input) from our server to Microsoft’s servers (an external service provider). The following data is forwarded in order to provide the service:

• ​User enquiries

The GWDG does not pass on any information about the users themselves. However, users’ enquiries are passed on unfiltered; this means that any personal information contained within the enquiry itself is passed on to the external service provider.

The GWDG service is strictly based on Data Processing Addendum .

Data processing generally takes place in Europe; any transfer of data to the USA occurs in exceptional cases, in accordance with an adequacy decision under the European General Data Protection Regulation.

Requests to the external service provider, which have been anonymised by the GWDG servers, are logged for up to 30 days in accordance with the Microsoft Data Processing Addendum, exclusively in the event of an attempted misuse, for example to create sexualised or hateful content. This occurs automatically when the backend detects an attempted abuse. It cannot be ruled out that legitimate requests may be incorrectly classified as attempted abuse and logged.

Right to object and right to rectification

The collection of the user’s input and its processing by Microsoft are essential for the provision of the external models. Consequently, the user has no right to object.

Use of partner models from research

Description and scope of data processing

The GWDG has research partners who host models externally on their computing resources. To this end, the GWDG forwards the relevant user request to the research partner. Information about the users themselves is not forwarded in the process. However, user requests are forwarded unfiltered; this means that personal data contained within the request itself is forwarded to the research partners. The GWDG has both a research agreement and a data processing agreement with the relevant research partners. The models hosted by the research partners are clearly identified in the ChatAI web interface by the suffix ‘(Research Partner)’. Use of these models is at your own risk.

Rights of data subjects

See the University of Duisburg-Essen’s privacy policy:
www.uni-due.de/de/datenschutz.php