psi-overflow

Privacy information

This page explains which personal data psi-overflow processes when you ask a question, and what rights you have.

Controller

Otto-Friedrich-Universität Bamberg
Kapuzinerstr. 16, 96047 Bamberg
Phone: +49 951 863-0
Email: ul.datenschutz@uni-bamberg.de

Operated by

Lehrstuhl für Privatsphäre und Sicherheit in Informationssystemen (PSI)
Phone: +49 951 863-2661
Email: dh.psi@uni-bamberg.de

Data protection officer

Thomas Loskarn
Kapuzinerstr. 25, 96047 Bamberg
Phone: +49 951 863-1030
Email: datenschutzbeauftragter@uni-bamberg.de

If you ask the tutors

Purposes of the processing

Questions asked through psi-overflow are collected so that they can be answered in the tutorials of the course they belong to, and so that tutors can review them and, where appropriate, publish them on the course's list of open questions.

Legal basis

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by sending a question. It is given within a task in the public interest, Art. 6(1)(e) GDPR in conjunction with the Bavarian Higher Education Act (BayHSchG) and Art. 4 of the Bavarian Data Protection Act (BayDSG): teaching and the support of students are public tasks of the university, which psi-overflow serves. You can withdraw your consent at any time with effect for the future; since questions are stored anonymously, please quote the wording of your question (see “Your rights”). The withdrawal does not affect the lawfulness of the processing before it.

Categories of personal data

When you submit a question, the following is stored:

  • the text of your question
  • the passage you selected, together with a short piece of text before and after it
  • the address of the page you asked from, and the section marker of that page
  • the tutorial slot you chose
  • the time at which the question was submitted

Obligation to provide data

Asking a question is voluntary. There is no obligation to use psi-overflow, and not using it has no consequences for your studies. You can also ask the same questions in the tutorial itself, or send them by email to your tutors or to the lecturers of the course. Without the text of a question there is nothing to answer, so it is the one entry that cannot be left out.

Recipients of the data

Your question is visible to the tutors and administrators of the course it was asked in. No data is passed to third parties outside the university, and none is transferred to a third country.

A question may be shown on the course's public list of open questions once a tutor has reviewed it. That list is visible to anyone who has its address. Please do not include personal data in your question, neither your own nor that of other people.

Retention period

A question is deleted automatically 180 days after it has been answered. A question that is not answered is deleted automatically 365 days after it was asked.

What remains of a deleted question for the course's statistics are counts that cannot be traced back to anyone: how many questions were asked in each hour, on each page and for each tutorial, in which way, whether they were published, and how long they took to be reviewed and answered.

If you ask Susi (AI assistant)

Purposes of the processing

When you choose Susi, your messages are answered by an AI model, using the page you are on and other pages of the course website as material. If a message contains a topical question the tutors could answer in a tutorial, it may be passed on to them as an anonymised question, so it can be answered in a tutorial too.

Legal basis

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by choosing “Ask Susi (AI assistant)”. You can withdraw it at any time with effect for the future: switching to “Ask the tutors” ends the chat and deletes it at once. The withdrawal does not affect the lawfulness of the processing before it.

Categories of personal data

In a chat with Susi, the following is processed:

  • the text of your messages and of Susi's answers
  • the address of the page you are on, and the content of that page and of other course pages Susi reads
  • a passage you selected, together with a short piece of text before and after it
  • the tutorial slot you chose, if any, and the language of the page

For each course and day, the number of requests, the amount of text processed and its cost are counted.

Obligation to provide data

Using Susi is voluntary. Asking the tutors is always available instead, with the same value for your question, and choosing it has no disadvantage for you. You can also ask your question in the tutorial itself, or send it by email to your tutors or to the lecturers of the course.

Recipients of the data

To be answered, everything you write in the chat, and so your questions, is sent together with the passages you selected and the page content to OpenRouter, Inc., USA, which passes it on to the AI provider Amazon Web Services, Inc. / Google LLC, USA. Pages Susi reads are fetched by our own server from the course website; only their content goes to the provider, as part of the chat. The service is configured so that the provider may neither store the content nor use it for training.

OpenRouter, Inc., USA and Amazon Web Services, Inc. / Google LLC, USA are located in the USA. Using Susi is therefore a transfer of personal data to a third country (Art. 44 ff. GDPR): your questions, and everything else you send in the chat, are sent to the USA. The transfer is based on your explicit consent (Art. 49(1)(a) GDPR), which you give by choosing “Ask Susi (AI assistant)”. Please be aware of its risks: data protection in the USA may not be at the level of the EU. US authorities may be able to access the data, for example for surveillance, without you being told, and you may have no effective legal remedy against it. If you do not want this, ask the tutors instead.

A question passed on to the tutors from a chat has already been part of that transfer: it comes from what you wrote to Susi, and the AI model worded it. Once passed on, it is stored at the university and treated like any other question: it is visible to the tutors and administrators of the course, and may appear on the public list of open questions after a tutor has reviewed it.

Retention period

A chat, its messages and the page contents sent in it are deleted 30 minutes after its last activity at the latest, and at once when you start a new chat or switch to “Ask the tutors”.

The daily usage numbers per course, and how many chats were started and messages sent in each hour, are totals that cannot be traced back to anyone, and are kept for the course's cost accounting and statistics.

A question passed on from a chat is deleted automatically like every other question: 180 days after it has been answered, or, if it is not answered, 365 days after it was passed on.

Automated decision-making

Whether a message of yours contains a question that is passed on to the tutors, and how that question is worded, is decided by the AI model, without a person being involved. This decision has no legal effect on you and does not affect you in a similarly significant way (Art. 22 GDPR): the question is passed on without anything that identifies you, a tutor reviews it before it may be published, and your chat is answered either way. There is no profiling.

Applies to both ways

Local storage in your browser

The question form stores entries in your browser's local storage, and only once you use it: for all courses, one entry with whether you chose to ask the tutors or Susi, so you are not asked again, the width you gave the chat's sidebar, so it opens that wide again, the language you picked, in the chat or on these pages, so it is shown in that language again, and whether you have confirmed that starting a new chat or switching to the tutors deletes your chat with Susi, so that question does not come up again; and for each course whose website you use it on, at most three more: the tutorial you last chose, so it is preselected next time, and, while you chat with Susi, the ID of that chat, so it survives a page reload, and a random value that tells your other open tabs of the same course website that the chat has changed, so they show the same conversation. This value contains no chat content and no personal data, and is removed together with the chat's ID when you start a new chat or the chat ends. The entries serve only the function you asked for (§ 25(2) no. 2 TDDDG), are never sent anywhere by themselves, and you can delete them at any time in your browser's settings.

Protection against abuse

A salted hash of the IP address a request comes from is counted for a short time: for every request the question form on a course website sends, from loading it to sending a question, for opening a course's list of open questions, and for signing in to the administration. Its only purpose is to keep the service usable by preventing automated mass requests. The legal basis is Art. 6(1)(e) GDPR in conjunction with Art. 4 BayDSG.

Separately from what you send, and not linked to it, a salted hash of your IP address is counted for the abuse limit described above. The salt rotates daily, so the hashes cannot be linked across days.

The salted IP hashes used for the abuse limit are deleted after 48 hours.

Server log files

Every request to psi-overflow, including those the question form on a course website sends, is recorded in the log of its web server, with:

  • the IP address of the requesting device
  • the date and time of the request
  • the requested address
  • the HTTP status code of the answer

The log serves IT security and stable operation, for example to find faults and to fend off attacks. The legal basis is Art. 6(1)(e) GDPR in conjunction with Art. 4 BayDSG. The log files are deleted automatically.

Your rights

Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17) and to restriction of processing (Art. 18), and, where their conditions are met, to data portability (Art. 20) and to object (Art. 21). To exercise them, contact the controller or the data protection officer named above.

Please note: questions are stored anonymously. Without additional information that lets us identify your question, we may not be able to act on such a request (Art. 11 GDPR). It usually helps to quote the wording of your question.

Supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is:

Der Bayerische Landesbeauftragte für den Datenschutz
Postfach 22 12 19, 80502 München
Phone: +49 89 212672-0
Email: poststelle@datenschutz-bayern.de
https://www.datenschutz-bayern.de