Data protection information of Ruhr-University Bochum for the AI chat portal “GPT@RUB”

We would like to inform you below about the processing of personal data in connection with the use of “GPT@RUB”.

Responsible in the sense of data protection law

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is Ruhr-University Bochum. Further contact details can be found in the central data protection declaration at www.rub.de/datenschutz.

Purpose of the processing

The AI chat portal can be used for information gathering, research, technical and creative support and content creation. It is therefore used as part of the fulfillment of tasks for research and teaching. The portal is linked to the research company OpenAI, which is based in the USA.

RUB students and staff can use the portal's functions by logging in with their RUB-LoginID and password.

Insofar as personal data of students is processed, Art. 6 para. 1 lit. e GDPR is the legal basis. For employees, the service is provided for the fulfillment of official duties and § 18 DSG NRW and Art 6 para. 1 lit. b is the legal basis for data processing.

What data is processed?

Various types of data are processed when using “GPT@RUB”. The following personal data is processed:

User details: Your RUB ID and password are required for login. Entered user data is checked for access authorization via the RUB Identity Management. The RUB ID is also stored on the server and is not transmitted to OpenAI. There is no user account assigned to individual users at OpenAI.

Chat data: The text entries you have made are processed and used as the basis for responses by the OpenAI services. You can also view your previous chat history and search for corresponding content in the chat.

Session cookies: A session cookie is set in the application to determine related requests when using the service.

User preferences: To save settings across sessions, user data is linked to selected settings in the front end. These are stored on the server side.

OpenAI has been instructed and has agreed not to use chat histories for further training of the AI.

“GPT@RUB” itself processes the text entries that you enter via the dialog box or the terms that you search for in chat histories. The function for temporarily saving chat histories must be activated in the profile settings. Chat histories can be saved for up to 180 days. Chat histories are automatically and permanently deleted at around 4:00 a.m. by default.

Personal data from third parties should not be used in the chat.

Recipients / forwarding of data

Chat entries are forwarded to OpenAI. No identifiers and IP addresses are visible to OpenAI. Personal data entered in connection with registration on the “GPT@RUB” portal will not be passed on to third parties unless they are intended to be passed on. Please note that your own entries in the chat, which contain personal data, will be processed.

OpenAI has contractually agreed to carry out the processing within the European Union. OpenAI has also been instructed and has agreed not to use chat histories for further training of the language model/AI.
Your rights as a data subject

You have the right to information about the personal data concerning you. You can contact us at any time for information. You also have the right to rectification or erasure or to restriction of processing, insofar as you are legally entitled to do so. Finally, you have the right to object to processing within the scope of the statutory provisions.

You also have the right to data portability within the framework of data protection regulations.

Storage duration of data

We generally delete personal data when there is no need for further storage to fulfill the above-mentioned purposes. If you have activated personal chat histories in the profile settings, chat histories can be stored for a maximum period of 180 days according to your personal settings. Once this period has expired, data that is not relevant to billing, such as message, audio and image content and session meta information, will be deleted. If you have not activated the option, daily sessions are permanently deleted every morning at around 4:00 am.
Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint about our processing of your personal data with a data protection supervisory authority. The supervisory authority responsible for Ruhr-University is the State Commissioner for Data Protection and Freedom of Information NRW.