Data Privacy Notice - GWDG AI Services
1. General Information
(Applicable to all services)
Data Processor (GWDG Contact)
The data controller responsible for data processing in accordance with Article 4(7) of the GDPR and other national data protection laws of EU member states, as well as other data protection regulations, is:
Represented by the managing director. The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.
Contact Person / Data Protection Officer
Purpose of Data Processing
We process personal data of our users only to the extent necessary to provide a functional website and our content and services.
The collection of user inputs via our website and the processing of user inputs on our systems is necessary to generate responses using the selected AI service.
Log file storage is necessary to ensure the functionality of the website. Additionally, these data help us optimize the website and ensure the security of our IT systems. Data will not be used for marketing purposes in this context.
Processing of personal data of our users generally occurs only after obtaining the user’s consent. An exception applies in cases where prior consent is not practically possible and the processing is permitted by law.
Legal Basis for Processing Personal Data
Where we obtain consent from the data subject for processing personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. For processing personal data necessary to fulfill a contract of which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing necessary for pre-contractual measures. Where processing personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis. In cases where the processing of personal data is necessary to protect vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis. Where processing is necessary to protect a legitimate interest of our company or a third party, and the interests, rights, and freedoms of the data subject do not override this interest, Article 6(1)(f) GDPR serves as the legal basis.
Rights of Data Subjects
You have various rights regarding the processing of your personal data. These are listed below, with references to the relevant articles (GDPR) or sections (BDSG (2018)) for more detailed information.
Right to Information (GDPR Art. 15, BDSG §34)
You may request confirmation from the controller whether personal data concerning you is being processed by us. This includes the right to obtain information about whether the personal data are transferred to a third country or an international organization.
Right to Rectification (GDPR Art. 16)
You have the right to rectification and/or completion from the controller if the personal data concerning you that are being processed are inaccurate or incomplete. The controller must carry out the rectification without delay.
Right to Erasure / “Right to be Forgotten” / Right to Restriction of Processing (GDPR Art. 17, 18, BDSG §35)
You have the right to demand the immediate erasure of your personal data from the controller. Alternatively, you may request the restriction of processing from the controller. Restrictions are specified in the GDPR and BDSG under the mentioned articles or sections.
Right to Notification (GDPR Art. 19)
If you have exercised your right to rectification, erasure, or restriction of processing with the controller, the controller is obligated to inform all recipients to whom the personal data concerning you have been disclosed about this rectification or erasure of data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.
Right to Data Portability (GDPR Art. 20)
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. Additionally, it should be noted that data portability for mass data/user data is limited to technical readability. The right to data portability does not include the conversion of data created by the user in a proprietary format into a “common” or standardized format by the controller.
Right to Object (GDPR Art. 21, BDSG §36)
You have the right to object to processing if it is based solely on a balancing of interests by the controller (see GDPR Art. 6(1)(f)).
Right to Withdraw Consent (GDPR Art. 7(3))
You have the right to withdraw your data protection consent at any time. The legality of processing based on consent up to the time of withdrawal is not affected by the withdrawal.
Right to Lodge a Complaint with a Supervisory Authority (GDPR Art. 77)
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
Scope of Application in Case of Individual Agreements
If you access our AI services through your organization, the policies and data protection notices of your organization apply. In the event of a conflict between these data protection provisions and the terms of one or more agreements with GWDG, such as a data processing agreement concluded with GWDG, the terms of these agreements shall prevail. Fundamental obligations always take precedence over these general provisions. In case of doubt, you can inquire at your institution which data protection guidelines apply to you.
2. General Technical Data Processing During Use of AI Models
Description and Scope of Data Processing
For billing purposes, the following data are stored and logged on GWDG’s servers with each request:
- Timestamp of the request
- User ID
- Length of the request and length of the response
These data are also stored in our system’s log files. These data are not stored together with other personal data of the user. Depending on whether locally hosted models or external models are used, slightly different data protection regulations apply. No liability can be assumed for the automatically generated responses. Responses may be entirely incorrect, contain false partial information, or may contain unlawful content.
Duration of Storage
Billing data are stored for one year.
Scope of Processing of Personal Data
We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Processing of personal data of our users generally occurs only after obtaining the user’s consent (GDPR Art. 6(1)(a)). An exception applies in cases where prior consent is not practically possible and the processing is permitted by law.
3. Service-Specific Modules
3.1 ChatAI Service
Overview of the Service
The ChatAI service consists of several components, particularly a web frontend and large language models in the backend. The frontend provides users with a web interface to enter user requests directly via browser. Additionally, users can select the desired model and make certain settings. The frontend forwards all requests to the selected model backend. For data protection reasons, a distinction is made between models hosted locally by GWDG and external models from other providers, with external models clearly marked as such.
The backend is hosted via GWDG’s SAIA platform, which receives all requests and forwards them to the corresponding model. In the case of external models, requestsâspecifically, the user’s history including intermediate text from the models and any “memories” created by the userâare forwarded to the respective external provider. For self-hosted models, requests are processed only on GWDG’s systems.
Additionally, users can activate so-called tools (“GWDG Tools” in the frontend, “Tools” in the OpenAI API) via the frontend or API. Tools intervene in user requests and provide a wide range of extended functionalities. Most offered tools use services provided by GWDG. However, some functionalities (e.g., web search) can only be provided by external services, and these functionalities are marked with a data protection warning in the frontend.
Use of the ChatAI Web Interface (Frontend)
Description and Scope of Data Processing
Every time chat-ai.academiccloud.de is accessed, the system automatically collects data and information from the accessing computer system.
The following data are collected in every case:
- Timestamp of access
- Name of the operating system installed on the accessing device (User-Agent)
- Name of the browser used (User-Agent)
- IP address of the accessing device
These data are also stored in our system’s log files. Storage of these data together with other personal data of the user does not occur.
Info
All data displayed in the browser by ChatAI are stored only client-side in the user’s browser and are transmitted to the servers only when the user requests processing, i.e., while the data are being processed by the backend models. After the end of a session in the browser, no user inputs are available anymore.
Use of GWDG-Hosted Models
Description and Scope of Data Processing
To use the models hosted by GWDG, user inputs/requests are processed on GWDG’s systems. Protecting the privacy of user requests is of fundamental importance to us. Therefore, our service, in combination with the locally hosted models by GWDG, does not store the content of user requests (chat history) or any requests or responses at any point on persistent storage.
Duration of Storage
User inputs are stored on GWDG’s servers only during the processing by the large language models themselves, i.e., while the data are being processed on our own systems.
Use of External Models from Azure
Description and Scope of Data Processing
To use Azure’s models, we forward the respective request (user input) from our server to Microsoft’s servers (external service provider). The following data are forwarded to fulfill the service:
- User request
Information about the users themselves is not forwarded by GWDG. However, the user request is forwarded unfiltered, meaning personal information contained within the request itself is transmitted to the external service provider.
GWDG’s service strictly adheres to the Data Processing Addendum (learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy, www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA). This means there is an adequacy decision under the EU General Data Protection Regulation, but data transfer to third parties cannot be excluded by GWDG.
Anonymized requests from GWDG servers to the external service provider are logged for up to 30 days under Microsoft’s Data Processing Addendum, exclusively in the case of a misuse attempt, e.g., to generate hate or sexually explicit content. This occurs automatically when the backend detects a misuse attempt. It cannot be excluded that legitimate requests are mistakenly classified as misuse attempts and logged.
Right to Object and Removal
The collection of user input and processing by Microsoft is mandatory for using external models. Although users still have the right to object, objecting means the use of external models is no longer possible.
Use of Research Partner Models
Description and Scope of Data Processing
GWDG has research partners who host models externally on their computing resources. In this case, GWDG forwards the corresponding user request to the research partner. Information about the users themselves is not forwarded. However, user requests are forwarded unfiltered, meaning personal data contained within the request are transmitted to the research partners. The data processing is based on an agreement on joint responsibility between GWDG and the respective research partners. The models hosted by research partners are clearly marked in the ChatAI web interface with “(Research Partner)”. Use of these models is at the user’s own risk.
Use of Models at LUIS
Leibniz University IT Services (LUIS) operate an inference cluster as part of the KISSKI project, providing large language models. These models are marked with LUIS in the ChatAI service menu.
Description and Scope of Data Processing
To use the models hosted at LUIS, user inputs/requests are processed on LUIS’s systems. Protecting the privacy of user requests is of fundamental importance to us. Therefore, our service, in combination with the models hosted at LUIS, does not store the chat history or questions or answers at any point on persistent storage.
Duration of Storage
User inputs are stored on the LUIS server only during the processing by the language models themselves, i.e., while generating a response to the request.
Use of Tools / GWDG Tools
Tools extend the capabilities and power of ChatAI, e.g., through web search, vector databases, external MCP servers, or image/audio generation. Unless explicitly stated otherwise, tools are provided internally by GWDG. Web search and MCP server services are external services. Tools must be selected by users in the frontend via opt-in or requested via API. The tools provided by GWDG are typically made known to the selected model, which then decides based on the user request whether to use one or more toolsâe.g., if the user requests image generation. In such cases, tools are called with parameters dependent on the user request. The vector database (Arcana) is a special case. All tool activities are transparently displayed in ChatAI for users.
GWDG-Internal Tools
Description and Scope of Data Processing
GWDG-internal tools such as image generation receive the model’s request (e.g., ‘generate an audio output “Hello Data Protector”’), process it, and provide the result to the models. At no point are requests or responses (including artifacts like images) permanently stored, but responses and artifacts are directly returned to users.
Vector Database / RAG System / Arcana
The Arcana system of GWDG provides users with a database that makes datasets searchable in ChatAI and uses them as references. The entire system is provided internally by GWDG and consists of a web UIâthe RAG managerâand integration into ChatAI.
Description and Scope of Data Processing
Generally, a distinction is made between the role of the developer and the user. The developer provides context data used to build an index server-side. This index is persistent/stored and can be used across multiple sessions and by multiple users. The index is used to provide users access to a large language model that can utilize specific knowledge from the provided context data to answer users’ individual requests. The developer uploads the data via the RAG manager, where they are stored and indexed in various datasets called Arcanas. An Arcana can be shared with any number of people. Each user must know the name of the Arcana or its ID. It is important to clarify that any person with access to the Arcana can access the contained knowledge.
The context data provided by the developers are indexed server-side into an Arcana and secured with a password. The Arcana is then exported into the context of the open-source models in Chat AI or via API, if an ID is provided by the users.
Duration of Storage
The context data provided by developers are stored permanently until explicitly deleted by the developers. User requests and responses are still stored only locally on users’ client systems, as described in the section “Use of Self-Hosted Models.” The request is only present on GWDG’s servers during the processing of the request.
External Tools
For external tools, the purpose and function is to forward parts of the user request. GWDG cannot assume liability for the use of external tools!
Description and Scope of Data Processing
The external service provider (e.g., Google) receives the search request requested by the model and the search results are displayed as references. For external MCP servers, function arguments are passed. No additional information about the users is transmitted, nor are information about user browsers, etc., passed. If the model decides to use personally identifiable data entered by users, e.g., by being asked to search for a person online, this is exactly the intended functionality.
Duration of Storage
The information is not stored at GWDG. A search engine or MCP server may store the requested query.
3.2 Image AI Service
Overview of the Service
ImageAI is an AI-powered image generation service. The HPC architecture (High Performance Computing) is utilized by the ImageAI service, which uses the FLUX.1 [fast] model to generate images from user data. User data remain secure. The user-friendly web interface allows users to use the service very intuitively and create the desired image very quickly.
The main component of this service is image generation, accessible via the web interface.
Use of the Image-AI Web Interface
Every time image-ai.academiccloud.de/ is accessed, the system automatically collects data and information from the accessing computer system.
The following data are collected in every case:
- Access date
- Name of the operating system installed on the accessing device
- Name of the browser used
- Source system via which the access was made
- IP address of the accessing device
These data are also stored in our system’s log files. These data are not stored together with other personal data of the user. All data displayed in the browser by Image-AI are stored only client-side in the user’s browser and are transmitted to the servers only when the user requests processing, i.e., while the data are being processed by the backend models. After the end of a session in the browser, no user inputs are available anymore.
3.3 Voice AI Service
Overview of the Service
The service enables users to:
- Translate speech streams: Use AI technology to translate speech streams into text in various languages.
- Create meeting notes: Automatically generate written notes from the user’s voice input in online meetings using AI technology.
Service Specification: The service consists of two main parts:
- Processing of uploaded audio files: This part processes audio files uploaded by users.
- Processing of streaming audio from BBB: This part captures and processes streaming audio from BigBlueButton (BBB).
Use of Voice AI
Description and Scope of Data Processing
Every time our website is accessed, our system automatically collects data and information from the accessing computer system.
To use the Voice-AI services hosted by GWDG, user requests/inputs are captured by the website and processed on HPC resources. Protecting the privacy of user requests is of fundamental importance to us. Therefore, our service does not store your audio file or BBB conversation, nor do we store requests or responses on persistent storage. The only exception is BBB transcription, which is written in Etherpad and uses local MySQL and contains audio transcription results over 500 MB stored in our GWDG storage, both of which are deleted after 30 days. The number of requests per user and the respective timestamps are recorded so we can monitor system usage and perform accounting.
The following data are stored to fulfill the service:
- Access date
- Name of the operating system installed on the accessing device
- Name of the browser used
- Source system via which the access was made
- IP address of the accessing device
- These data are also stored in our system’s log files. These data are not stored together with other personal data of the user.
3.4 Protein AI Service
Overview of the Service
The Protein-AI service consists of several components, particularly a web frontend and backend models (alphafold2/boltz). The frontend provides users with a web interface to enter query sequences directly via a browser. Additionally, users can select the desired model and adjust certain settings. The frontend forwards all requests to the selected backend model. The backend is operated via the GWDG platform, which receives all requests and forwards them to the corresponding model.
Use of Protein AI
Every time protein-ai.academiccloud.de/ is accessed, the system automatically collects data and information from the accessing computer system. The following data are collected:
- Access date
- Name of the operating system installed on the accessing device
- Name of the browser used
- Source system via which the access was made
- IP address of the accessing device
These data are also stored in our system’s log files. These data are not stored together with other personal data of the user. After the user’s input sequences are processed by the backend model, they are deleted; only the output result is retained on GWDG’s secure “Data Mover” node for 30 days.