Privacy notice for the online Student Advice Centre (instant chat and registration, chatbot) and online appointment booking

Data controller

HM Hochschule München University of Applied Sciences

Lothstraße 34
D-80335 München
Tel.: +49 89 12 65 - 0
Fax: +49 89 12 65 - 3000
Email: kommunikation@hm.edu
Website: www.hm.edu

HM Hochschule München University of Applied Sciences is a public-law body. It is legally represented by its President, Prof. Dr Martin Leitner.

Government Data Protection Officer

The Data Protection Officer at Hochschule München can be contacted by email at datenschutzbeauftragter@hm.edu and by telephone on +49 9951 99990-500.

Scope, purposes and legal basis of the processing

Use of online-studienberatung.hm.edu and the services it offers is voluntary. You can also still arrange an appointment for the Student Advice Centre in person or by telephone.

Live Chat Consultation

(a) Anonymous use is possible

If you use the instant chat as an unregistered user, you are not obliged, as someone seeking advice, to provide personal data such as your name or any other information relating to you. The counselling service is always available on an anonymous basis. You will not be asked to provide any personal data.

(b) Personal use

However, should you voluntarily provide personal information, the legal basis for the processing of such data is your consent in accordance with Article 6(1)(a) and Article 7 of the GDPR.

The recipient of the data is the Student Adviser and the platform operator (zone35 GmbH & Co. KG, using the ‘assisto’ platform) under a data processing agreement with Hochschule München.

Any personal data you enter via the instant chat will be treated confidentially and will be permanently deleted after 7 days.

However, you can also use the chat as a registered user. In this case, your data will remain stored in your account and will be automatically deleted one year after your last login if the account remains inactive.

You may withdraw your consent at any time without giving a reason via beratung@hm.edu. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. Your data will then be deleted from the chat logs.

Data processing in connection with registration

From the moment you register as a user, the data you enter or which is automatically generated through your use of the site will be processed. Insofar as this data relates to you personally and not merely to a fictitious identity, it constitutes personal data. Consequently, the relevant data protection laws also apply to online Student Advice Centre.hm.edu.

Below, we explain what information we collect during your registration and how it is used.

When registering, please enter your username, telephone number, email address, degree programme (optional) and message (optional). As a student at HM, you must also enter your first name and surname. This information is stored in a database. Once you have logged in, you can view this information at any time by clicking on

Click on ‘My details’ (top right-hand corner of the screen). By registering, you will be registered as a user of the online student advisory service.

We use the personal data you provide solely for the purpose of coordinating appointments as part of our Student Advice Centre.

The legal basis for data processing is Article 6(2) and (3) of the GDPR, in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG), Article 6(1)(e) of the GDPR, and Article 60(1) of the Bavarian Higher Education Act (BayHSchG). For the optional fields, as well as for the storage of your name and contact details beyond the specific consultation appointment, the legal basis is your consent (Article 6(1), first sentence, point (a) of the GDPR).

The data stored in your personal profile is visible only to the advisers at Hochschule München. It is not shared within the university. Another recipient is the platform operator (zone35 GmbH & Co. KG, using the ‘assisto’ platform) under a data processing agreement with Hochschule München.

Your data will be stored for a period of one year from the date of registration and will then be deleted, provided the account is no longer actively used. You can also have your personal data stored in your profile deleted at any time via the settings in your profile. Your data will then be deleted within one month of us receiving your request for deletion.

Data processing in connection with appointment enquiries

Below, we explain what information we collect when you make an appointment enquiry and how it is used:

To request an appointment, you must register as a user and provide your username, telephone number, email address, degree programme (optional) and a message (optional). If you are a student at HM, you must also enter your first name and surname. This data is stored in a database. Once you have logged in, you can view this data at any time by clicking on ‘My details’ (top right-hand corner of the screen).

We use the personal data you provide solely for the purpose of coordinating appointments as part of the Student Advice Centre, and it is used exclusively to inform and prepare the advisers. The data stored in your personal profile is visible only to the advisers at Hochschule München. It is not shared within the university.

Another recipient is the platform operator (zone35 GmbH & Co. KG, operating under the name ‘assisto’) under a data processing agreement with Hochschule München.

Data processing in connection with the use of the chatbot

(a) Purpose and scope of data processing

When using the chatbot for online advice, selected webpages from the Studies department are searched (‘crawled’). This only takes place in response to an enquiry from the person seeking advice and solely for the purpose of answering that specific enquiry. The data processed in this way is not stored permanently or used for any other purposes (e.g. for AI training).

The processing covers the content, including any personal data, published on the websites of the Studies Department at Hochschule München. The relevant categories of data may include the names and contact details (telephone number, email address, room number) of the staff members named on these pages. As a rule, however, the contact details consist of non-personal functional email addresses.

Chatbot chat histories are stored in the Botpress instance operated by zome35 in order to optimise the quality of the responses generated by the chatbot. The chat histories are evaluated by HM staff members, and the chatbot’s knowledge base is then manually updated by zone35 staff members as required. Any personal data contained in the chat histories is not transferred to the knowledge base. The chat histories are deleted by zone35 staff members once they have been evaluated.

To ensure the chatbot functions correctly, only cookies that are technically necessary are set.

(b) Legal basis

The legal basis for data processing is Article 6(1)(e) of the GDPR in conjunction with Article 4 of the Bavarian Data Protection Act (BayDSG) and the provisions of the Bavarian Health Care Act (BayHIG), as the processing is necessary for the performance of our duties as a public body (provision of a service for the purposes of online counselling).

(c) Recipients of the data

The chat histories are accessible only to selected and authorised individuals from the chatbot operator (zone35, the university’s data processor) and to HM staff members from the Student Advice Centre.

If those seeking advice request to be put through to the Student Advice Centre staff members by clicking the relevant button, the content of the chatbot conversations is forwarded to the Student Advice Centre staff members,

The chatbot is also operated using the online service provided by Botpress Inc. (a sub-processor for the university), which in turn utilises standard large language models (LLMs), with the provider of the LLM used acting as a sub-processor for the university (currently: OpenAI).

The IP addresses of users seeking advice are only transmitted to Botpress Inc. and are not forwarded to OpenAI.

The input and output in the chatbot are not used for training AI models from zone35, Botpress or OpenAI.

Through the use of sub-processors, it is intended that the IP addresses of website visitors, as well as the information collected on HM’s websites for the purpose of responding to enquiries from those seeking advice, will be transferred to the USA (to Botpress Inc. and, where applicable, to OpenAI). There is no intention to transfer any further personal data.

(d) Retention period

Chat histories are stored for as long as is necessary to fulfil the university’s public duties.

Rights of those affected

Under the General Data Protection Regulation, you have the following rights:

As a user, you have the right to obtain information about the personal data held about you (Article 15 of the GDPR).

If inaccurate personal data is processed, you have the right to have it rectified (Art. 16 GDPR). You can amend or rectify the personal data you provided during registration at any time via your profile.

Where the legal conditions are met, data subjects may request the erasure or restriction of processing (Articles 17 and 18 of the GDPR). You may have your stored personal data erased at any time via your profile. Your data will then be erased within one month of receipt of your erasure request.

If consent has been given for data processing, or if there is a contract for data processing and the data processing is carried out using automated means, you may have a right to data portability (Article 20 of the GDPR).

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of that consent prior to its withdrawal (Article 7 of the GDPR).

You have the right to request information as to whether automated decision-making, including profiling, takes place (Article 22 of the GDPR).

Data subjects have the right to object at any time to the processing of their data on grounds relating to their particular situation, where the processing is carried out solely on the basis of Article 6(1)(e) or (f) of the GDPR (Article 21(1), first sentence, of the GDPR).

Should the rights set out above be exercised, the public authority will check whether the legal requirements for doing so have been met.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for Hochschule München is the Bavarian State Commissioner for Data Protection. The Commissioner can be contacted using the following details:

Postal address
: PO Box 22 12 19
, 80502 Munich

Address:
Wagmüllerstraße 18
, 80538 Munich
Tel.: +49 (0) 89 212672-0
Fax: +49 (0) 89 212672-50
Email: postoffice@datenschutz-bayern.de
Website: www.datenschutz-bayern.de

Further information regarding our Privacy Policy

Further information on data protection at Hochschule München, in particular regarding the use of our website and your rights, can be found at www.hm.edu/datenschutz .

Hochschule München reserves the right to amend the Privacy Policy from time to time to ensure that it always complies with current legal requirements or to reflect changes to the services described in the Privacy Policy, for example when new services are introduced. The new Privacy Policy will then apply to any subsequent visits to the website.

If you have any questions, please feel free to contact the Data Protection Officer (datenschutzbeauftragter@hm.edu ) or send an email to: beratung@hm.edu .

Last updated: 2 April 2025

The information on this page was translated into English for your convenience. In case of any discrepancies between the English and German versions, the German version shall prevail.