Information on the processing of personal data in connection with the use of HM-AI

Hochschule München (hereinafter also referred to as ‘the University’, ‘HM’, ‘we’ or ‘us’) makes HM-AI available to all members of the university community, thereby offering an opportunity to integrate artificial intelligence (AI) into their work processes. It also creates a space where, with pedagogical support, an understanding of how Large Language Models (LLMs) work can be developed and guidance on effective prompts can be provided.

Below, we set out the purposes for which we process your personal data, the legal basis for such processing, the duration of such processing, and the rights you have in relation to the processing of your personal data, provided that you use HM-AI.

Please take the time to read our privacy policy, as it contains important information about how we handle your personal data.

Contents of these notes

Wherever we use the term ‘data’ in this text, we are referring exclusively to personal data as defined by the GDPR.

Visiting our website

Whenever you visit the HM-KI website, we process your personal data only to the extent necessary to display the website on your devices in the best possible way. It is generally possible to use the website without providing any personal data.

We say ‘in principle’ because we process your IP address briefly to enable you to view the website.

The IP address, also known as an Internet Protocol address, is an address used in computer networks to identify and access web servers or individual end devices. In order for the data packets that make up the page accessible at https://ai.lab.hm.edu to be assembled on your end device and displayed as a web page, two IP addresses are required: yours and ours.

Server log data (log files)

In order for our web server to fulfil your data request, it must know your IP address, i.e. ‘process’ it. Every time you visit our website, our system automatically collects data and information from your device’s system. This involves the processing of data. This data is usually stored automatically in a log file. This data is not combined with any other personal data. When you visit our website, you transmit information to our web server via your internet browser. During an active connection for communication between your internet browser and our web server, this information is recorded, i.e. logged. Our website is hosted on the university’s domain. We would therefore like to refer you to the information available via the link below for further details, particularly regarding the purpose and legal basis:
https://www.hm.edu/datenschutz/datenschutzhinweis_webseitenbesuchende.de.html

Using the HM-IA and logging in to the restricted-access area

HM-IA is a so-called Generative Pre-trained Transformer (GPT) and is based on OpenAI’s API. The university makes the application available to all members of the university community with an active and valid university account. Access is granted via the university’s single sign-on authentication process. As part of the authentication process, the system checks whether an active university account exists. The username and password stored in the Identity Management (IDM) or Campus Management System (CMS) are transmitted to Shibboleth. To this end, the restricted-access ChatGPT area is linked to the university’s IDM and CMS.

Once you have successfully registered, you can use OpenAI’s ChatGPT service via the account created for you by the university. Your login details will not be passed on to OpenAI.

Recipients when using the linked software

The GPT we use is a service provided by OpenAI OpCo, LLC, based at 3180 18th Street, San Francisco, California, USA. We have entered into a Data Processing Addendum (DPA) with OpenAI, as well as the Standard Data Protection Clauses (Clause 7 of the DPA) to safeguard data transfers to the USA. Consequently, unless we have expressly stated otherwise here, OpenAI processes the data provided on our behalf and in accordance with our instructions.

Nevertheless, we would ask you to refrain from entering personal data into the GPT.

Use of our GPT is subject to OpenAI’s Terms of Service, which can be found at the following link: https://openai.com/policies.

Purpose and legal basis

Registration – that is, the submission of your personal details for the purpose of authenticating your access rights – takes place on the basis of your consent in accordance with Article 6(1)(a) and Article 4(11) in conjunction with Article 7(4) of the GDPR. You give us your implied consent by logging in to the restricted-access area. Your consent is, of course, voluntary and you may withdraw it at any time with future effect by logging out of the service.

Further information on data protection

If you have any questions regarding the processing of your data, please feel free to contact the Data Protection Officer (datenschutzbeauftragter@hm.edu ).

Further information on data protection, in particular regarding your rights as a data subject and details of the data controller, can be found at the following link: https://hm.edu/datenschutz .

Last updated: 6 November 2023

The information on this page was translated into English for your convenience. In case of any discrepancies between the English and German versions, the German version shall prevail.