Privacy Policy | B2C “AI-powered support chat”
AI-powered support chat (chatbots)
We use an AI-powered support chat to efficiently answer inquiries from prospects and customers, process support requests, and improve our customer service.
2.1 Processed data
When you use the chat, we process – depending on the content and usage – in particular:
- Communication/content data : Messages you enter, as well as system-generated replies, and any attachments/information you transmit in the chat.
- Master data/contact details (if provided or required for processing): e.g. name, email address, telephone number, customer number, ticket number.
- Usage and technical data : e.g. IP address, timestamp, device/browser information, log data (depending on integration/provider).
2.2 Purpose of processing
- Processing and responding to inquiries (pre-contractual/contractual)
- Creation and processing of support tickets, documentation of the support case
- Quality assurance, error analysis, abuse and fraud prevention (e.g. protection against spam/attacks)
- Operation, maintenance and improvement of the stability of the support channel
2.3 Legal Basis
- Art. 6(1) b GDPR (contract/pre-contractual measures), insofar as the chat is used for the initiation or performance of contracts.
- Art. 6(1) f GDPR (legitimate interest) in efficient customer communication, IT security, abuse prevention and in the optimization of our support process.
- Article 6(1) a GDPR (consent) only applies insofar as it is necessary in individual cases (e.g., if the chat is only loaded after consent to non-essential cookies/tracking).
2.4 Recipient / Service Provider
To provide and operate the chat and to generate responses, we use service providers who process data on our behalf (Data Processors pursuant to Art. 28 GDPR). These include, in particular:
- Chatbot platform (e.g. Chatbase) for managing/integrating the chatbot; Chatbase provides, among other things, a Data Processing Addendum (DPA) and information on sub-processors for this purpose.
- AI modeling services (e.g., OpenAI via API) are used to generate responses. For OpenAI, business data is not used for training by default, unless explicitly opted in.
- Support/ticket system (if used) for documenting and processing requests.
2.5 Third-country transfer
If data is transferred to countries outside the EU/EEA (e.g., the USA) as part of the service provider chain, this is done on the basis of suitable guarantees, in particular EU standard contractual clauses, as well as supplementary technical and organizational safeguards.
2.6 Storage duration
We generally only store chat and support content for as long as necessary to process your request and document the support process. Afterwards, the data is deleted or anonymized, unless legal retention obligations apply. Technical log data (e.g., security/error logs) is usually stored for a shorter period and then deleted or anonymized.
2.7 No input of sensitive data
Please do not transmit any special categories of personal data (Art. 9 GDPR; e.g., health data), payment details, or login credentials in the chat. If you do transmit such information, we will only process it to the extent necessary to handle your request.
2.8 Model training / Improvement
We do not use chat content to train AI models with personal data unless we obtain explicit consent. For OpenAI, data from business/API usage is not used for training by default, except with opt-in.
2.9 Data subject rights / Attribution of chat histories
You can exercise your data subject rights (e.g., access, erasure) in accordance with legal requirements. To enable us to assign a chat history, information such as date/time, email address used, or a ticket number is helpful.