Data protection information on the use of personal data Chatbot

This data protection information is issued in compliance with the German Federal Data Protection Act (BDSG) and the EU General Data Protection Regulation (GDPR) applicable from 25 May 2018 as well as all other relevant data protection regulations. This information is subject to the applicable legal provisions in their current version.
This data protection information relates to the collection, processing and use of personal data within the meaning of the BDSG and GDPR by the controller. Personal data are individual details about personal or factual circumstances of an identified or identifiable natural person ("data subject"). The agreement concerns the use of personal data (address data).

1. responsibility for data processing
Controller:
Münsterland e.V.
Verein zur Förderung des Münsterlandes
Airportallee 1
am FMO Flughafen Münster/Osnabrück
48268 Greven
info@muensterland.com

Data Protection Officer:
Mr Markus Heinrich, lawyer
c/o Wolter Hoppenberg Rechtsanwälte Partnerschaft mbB
Münsterstraße 1-3
59065 Hamm
Email: datenschutz@muensterland.com

2. object and purpose
The purpose of the processing is the operation and provision of an AI-supported chatbot on the muensterland.com website for the automated response to user enquiries about tourist offers, content and services in the Münsterland region.
The purpose of the processing is to provide visitors with user-friendly, fast and interactive access to information and to continuously improve the quality and completeness of the content provided. For this purpose, user input is processed in order to provide suitable answers.
In addition, selected chat requests are evaluated in anonymised or pseudonymised form, in particular those for which no suitable answer could be generated or for which the answer was not rated as helpful by the user. The evaluation serves exclusively to optimise the content of the chatbot and the underlying information base.
No further processing for other purposes, in particular for profiling or marketing purposes, takes place.

3. duration and scope of processing
We only collect and use personal data to the extent necessary for the purposes of processing.
The processing of personal data in the context of the AI-supported chatbot takes place exclusively to the extent and for the duration necessary to provide the chat function and to achieve the defined purposes.
In the ongoing chat, user input and technical session data (e.g. session ID) are processed in order to enable coherent communication within the respective session. This data is not stored permanently, but is deleted after the session has ended.
Chat requests are only stored in exceptional cases, namely if no suitable answer could be generated for a request or if an answer was deemed unhelpful by the user.
In these cases, the requests in question are anonymised or pseudonymised before being stored and are only stored in an access-restricted system. Personal content is removed or made unrecognisable as far as technically possible.
The stored data is only kept for a limited period of time and then deleted or completely anonymised. Further processing, in particular profiling or use for marketing purposes, does not take place.

4. recipients of your data
We only transfer your personal data to third parties if this is permitted by law or if you have given your consent. If personal data is transferred, we always take into account the technical and organisational measures of the recipients in accordance with Article 32 GDPR.
As part of the operation of the AI-supported chatbot, personal data may be processed by technical service providers who are entrusted with the provision, hosting and maintenance of the system. These service providers act exclusively on the basis of an order processing contract in accordance with Art. 28 GDPR and are contractually obliged to implement suitable technical and organisational measures in accordance with Art. 32 GDPR to protect the data.
The chatbot uses an AI language model from the provider Mistral AI, 15 Rue des Halles, 75001 Paris, France. If data is processed by this provider, this is also done exclusively within the framework of order processing permitted under data protection law.
No further transfer of data to third parties, in particular for advertising or marketing purposes, takes place.

5. your rights
You have the right to obtain information about the personal data concerning you (Art. 15 GDPR). You can also request the correction of incorrect data (Art. 16 GDPR). In addition, under certain conditions, you have the right to erasure of data (Art. 17 GDPR), the right to restriction of data processing (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR). You have the right to withdraw your consent for future processing (Art. 7 para. 3 GDPR). In addition, you may also have a right to object in accordance with Art. 21 GDPR in the event of processing in the context of a legitimate interest. You also have the right to lodge a complaint with the competent supervisory authority for data protection if you are of the opinion that the processing of your personal data is not lawful.
The address of the supervisory authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4
40213 Düsseldorf
Phone: 0211/38424-0
Fax: 0211/38424-999

6. legal basis
The processing of your personal data for the dispatch of our magazine is based on the following legal bases of the General Data Protection Regulation (GDPR):
The processing is mainly based on Art. 6 para. 1 lit. f GDPR, as there is a legitimate interest in the provision and operation of a user-friendly, digital information service. The legitimate interest lies in particular in efficiently answering user enquiries, improving the quality and timeliness of the content provided and optimising the chatbot by evaluating selected, anonymised or pseudonymised enquiries.
Processing is limited to what is necessary, does not create profiles and is subject to short storage periods. Users can use the chatbot voluntarily and are informed transparently about the data processing. The interests or fundamental rights of the data subjects therefore do not outweigh the aforementioned legitimate interests.
Insofar as the chatbot is used to answer specific enquiries in connection with existing or initiated contractual or user relationships, the processing of personal data is additionally carried out on the basis of Art. 6 para. 1 lit. b GDPR, insofar as this is necessary for the implementation or initiation of corresponding measures.

7. further information on data protection
Further information on data processing can be found on our privacy policy on the homepage at https://www.muensterland.com/datenschutzerklaerung/.