Please note that AI-generated answers may be incomplete, misleading or incorrect. For important or legally relevant matters, we recommend having the information confirmed by our responsible staff.
Limits of AI-generated answers
The chatbot generates its answers automatically. Despite careful configuration, information may be incomplete, inaccurate, misleading or outdated.
The answers are for general information only and do not constitute a binding commitment or – unless expressly agreed otherwise – individual legal, tax, medical, financial or other professional advice.
Please verify important information and contact our responsible staff for binding statements or individual concerns.
What data is processed?
When you use the chatbot, the following data in particular may be processed:
- Chat content: the questions, messages and other texts you enter, as well as the answers generated by the chatbot.
- Technical data: for example timestamps, technical session identifiers, connection and error data and – depending on the technical configuration – IP address, browser information and other technical metadata.
- Context information: where applicable, information retrieved from the company information we provide in order to answer your question.
Which personal data is processed also depends on what information you enter in the chat window yourself.
Please do not enter any unnecessary personal or confidential information into the chatbot. This includes in particular passwords, bank and payment details, ID data, health data, special categories of personal data and confidential business or contract information.
Please do not use the chatbot to transmit such information, unless we have expressly provided a separate, suitable process that has been reviewed for data protection compliance.
Purposes and legal bases of processing
We process the data generated when you use the chatbot in order to:
- understand your requests and answer them automatically,
- provide information about our products, services and business processes,
- ensure the technical function and security of the chatbot,
- detect and fix technical errors,
- prevent misuse, to the extent this is done within the services used.
Processing is carried out on the basis of the applicable statutory provisions.
- Art. 6(1)(b) GDPR may apply if processing is necessary to take steps at your request prior to entering into a contract or to perform a contract.
- Art. 6(1)(f) GDPR may apply if we have a legitimate interest in the efficient handling of requests, user-friendly communication or IT security, and your interests or fundamental rights do not override it. Our legitimate interest then lies in providing individual and fast customer service support.
- Art. 6(1)(a) GDPR: Where consent is required for individual processing operations and has been obtained, processing is based on that consent. Consent that has been given can be withdrawn with effect for the future.
The legal basis used in each case must be determined based on our specific use of the chatbot. Not every legal basis mentioned automatically applies to all processing operations.
Recipients and technical service providers
We use a technical service provider to operate the chatbot:
ASKVIANA.de – operated by ourselves
It processes the data transmitted via the chatbot in accordance with our instructions and on the basis of a data processing agreement pursuant to Art. 28 GDPR, where the requirements for commissioned processing are met.
The following services in particular may be used for hosting and AI processing:
- Microsoft Azure: hosting of the backend infrastructure required for the chatbot.
- Microsoft Foundry and the AI models provided there: technical processing of requests and generation of answers.
The content transmitted via the chatbot is sent to the AI service used in order to answer the request.
Under the data protection terms that apply to Microsoft Foundry models provided via Azure, inputs and generated answers are generally not used to train the general foundation models. The terms of the service actually used and its configuration apply to the specific processing.
Abuse monitoring by the AI service
Microsoft may carry out automated checks as part of the abuse monitoring that applies to the respective AI service. Under certain conditions, selected inputs and answers may be stored and reviewed by authorized persons to investigate possible misuse.
This processing is separate from the regular storage in our chatbot system. It is subject to the applicable terms of the Microsoft service used.
Deleting a chat history in our chatbot therefore does not necessarily mean that data already processed as part of separate abuse monitoring is deleted at the same time at all technical service providers.
Further information on data processing by Microsoft can be found in the documentation on data privacy and security for Microsoft Foundry and on abuse monitoring.
Place of processing and third-country transfers
Our chatbot runs on Microsoft Azure infrastructure. European processing regions are used for the services employed, as far as the specific configuration supports this.
The actual place of processing depends in particular on the selected Azure region, the deployment type of the AI model and the features used. For certain deployment types, processing may also take place in other regions within the respective geographic zone.
Processing exclusively in Germany or exclusively within the European Economic Area is only guaranteed to the extent that it is technically and contractually ensured for all relevant processing operations.
Where personal data is transferred to third countries in connection with the services used, this is done only in compliance with the requirements of Art. 44 et seq. GDPR. Information on the transfer mechanisms and safeguards that may be used is available from us on request.
The region Azure Germany West Central has been selected for hosting.
Retention period and deletion
Chat histories
In regular operation, chat histories are automatically deleted from the chat storage of our chatbot system no later than one hour after they were created.
You can also delete the chat yourself at any time using the trash icon in the chat window, provided this function is available. Manual deletion removes the chat in question from the chat storage of our system.
Technical logs
Technical logs and metadata are processed only to the extent necessary for operation, security, troubleshooting or compliance with legal obligations. Separate, purpose-dependent retention periods apply to this data.
Our own technical logs are deleted after 30 days at the latest, unless longer retention is necessary and legally permissible in an individual case.
Storage at technical service providers
Separate storage and deletion terms may apply to data that external technical service providers process as part of their own technical processes. This applies in particular to any data stored for abuse monitoring of the AI service.
Automatic or manual deletion of the chat in our system therefore does not necessarily result in the immediate deletion of all technical logs or separately stored data at all service providers involved.
No use for training general AI foundation models
We do not process chat content for the purpose of training general AI foundation models.
Under the applicable Microsoft data protection terms, the Microsoft Foundry models provided via Azure generally do not use inputs and outputs to train the general foundation models.
This is to be distinguished from the use of information that we provide to configure our chatbot and to answer questions. Such approved knowledge sources may be processed as part of the agreed chatbot function and used to generate context-based answers.
Automated decision-making and profiling
The chatbot is used to answer requests automatically and to provide information.
In the configuration intended for our use, no automated decision-making takes place that produces legal effects concerning you or similarly significantly affects you. Profiling for this purpose is likewise not intended.
Should we use the chatbot for such functions in the future, we will review the associated data protection requirements separately and provide the required information.
Your data protection rights
Subject to the statutory requirements, you have the right in particular to:
- obtain access to the personal data concerning you (Art. 15 GDPR),
- have inaccurate personal data rectified (Art. 16 GDPR),
- request the erasure of your personal data (Art. 17 GDPR),
- request restriction of processing (Art. 18 GDPR),
- receive the personal data you have provided, to the extent provided by law, in a structured, commonly used and machine-readable format, or request its transmission to another controller (Art. 20 GDPR),
- object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
- withdraw any consent you have given at any time with effect for the future, where processing is based on that consent.
These rights do not apply without limitation in every case. Statutory exceptions and requirements may apply.
To exercise your rights, please contact: datenschutz@askviana.de
Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.
Data security
We take appropriate technical and organizational measures to protect personal data against loss, unauthorized access, unlawful disclosure and other unlawful processing.
The security measures are selected taking into account the type of data processed, the technology used and the associated risks, and are adjusted where necessary.
Changes to this privacy information
We may amend this privacy information if the technical design of the chatbot, the service providers used or the legal requirements change.
The current version is published on this website.
