Controller: Hamburg University of Technology (TUHH). Contact details of the controller and the data-protection officer: https://www.tuhh.de/tuhh/datenschutz.html. Operated by: Institute of Circular Resource Engineering and Management (CREM), Blohmstraße 15, 21079 Hamburg, contact Alexander Hofmann, alexander.hofmann@tuhh.de.

1. Login. You log in via the TUHH computing centre's Shibboleth service. Your password is entered only there. The assistant receives only a pseudonymous identifier ("persistent ID") that differs for every service. Your name, e-mail address, matriculation number and study programme are not transmitted.

2. What data is processed

• When you use the assistant: your questions, the assistant's answers, timestamps, your conversation history (linked to your pseudonymous identifier), references to the course-material passages used, and your optional feedback (thumbs up/down, comment).
• Technically necessary: the web server logs IP address, time, requested address and browser identifier (access log). The login service logs logins with the pseudonymous identifier. Only technically necessary session cookies are set. No tracking, no third-party analytics.

3. Purposes. Providing the learning assistant, showing your previous conversations, security and troubleshooting, improving the service and teaching based on feedback and pseudonymised usage statistics. 

4. Legal basis.[To be set by the data-protection officer, e.g. Art. 6(1)(e) GDPR in conjunction with the Hamburg Higher Education Act (teaching), or consent under Art. 6(1)(a) GDPR.]

5. Where data is processed. Only on a TUHH server. The language model runs locally. Questions and answers are not sent to external services and are not used to train AI models. There are no recipients outside TUHH.

6. Retention

• Conversations and feedback: until the end of the semester + 60 days or until you delete them. You can delete individual conversations in the app at any time.
• Backups: 30 days (deleted conversations are gone from the backups after that at the latest).
• Web server access logs: 14 days. Application logs: 30 days. Login service logs: 30 days.

7. Your rights. You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and objection (Art. 21), and the right to lodge a complaint with the supervisory authority, the Hamburg Commissioner for Data Protection and Freedom of Information. Contact the person named above. Because we only know a pseudonymous identifier, a request may need your help (logging in to the assistant).

8. Voluntary use and notes. Use is voluntary and doesn't affect your grades. AI answers can be wrong. There is no automated decision-making within the meaning of Art. 22 GDPR.