Data Protection

In the following, we would like to explain how we process your data in the context of the “Amsl” application (the application) and the accompanying study on the use of applications to support self-regulated learning (the study).

Responsible party

The responsible party for data processing within the meaning of the GDPR and other data protection regulations is:

Karlsruhe Institute of Technology (KIT), Kaiserstrasse 12, 76131 Karlsruhe, Germany

Tel.: +49 721 608-0

Fax: +49 721 608-44290

Email: info@kit.edu

The Karlsruhe Institute of Technology is a public corporation. It is represented by Prof. Dr. Oliver Kraft (on behalf of the President of KIT).

Data Protection Officer

The KIT Data Protection Officer can be contacted at:

Email: datenschutzbeauftragter@kit.edu Postal address: P.O. Box 6980, 76049 Karlsruhe, Germany, with the addition “Die Datenschutzbeauftragte” (The Data Protection Officer)

Rights

You have the following rights with regard to personal data concerning you:

• Right to confirmation as to whether data concerning you is being processed and to information about the data being processed, to further information about data processing, and to copies of the data (Art. 15 GDPR),
• Right to rectification or completion of inaccurate or incomplete data (Art. 16 GDPR),
• Right to immediate erasure of data concerning you (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to receive the data concerning you and provided by you, as well as to transfer this data to other controllers (Art. 20 GDPR).

You also have the right to complain to the supervisory authority about the processing of your personal data by the Karlsruhe Institute of Technology (KIT) (Art. 77 GDPR). The supervisory authority within the meaning of Article 51(1) GDPR for KIT is, in accordance with Section 25(1) LDSG

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg

Address: Lautenschlagerstraße 20, 70173 Stuttgart Postal address: P.O. Box 10 29 32, 70025 Stuttgart Tel.: 0711/615541-0 Fax: 0711/615541-15 Email: poststelle@lfdi.bwl.de

Purpose of data processing

KIT processes your personal data exclusively for specified, explicit, and legitimate purposes. The purpose of the data processing in question is to provide the application and support the implementation of the study.

Legal basis for data processing

The legal basis for the processing of your personal data is your consent in accordance with Art. 6 (1) (a) GDPR.

Consent is given voluntarily. Consent can be revoked at any time with effect for the future. Effect for the future means that revoking consent does not affect the lawfulness of processing based on consent before revocation.

There are no disadvantages if consent is refused or revoked.

Personal data

When using the above-mentioned application and study, we process personal data relating to you. According to Art. 4 No. 1 of the EU General Data Protection Regulation (GDPR), personal data is any information relating to an identified or identifiable natural person.

Personal data for personal communication with the user

The data described in this section is used for personal communication with the user. This data is treated as strictly confidential and is not used for research purposes.

• Name

Personal data for conducting the study

The study covers the following research purposes with the specified personal data concerning you:

1. Evaluation of usage by user groups
   • Data used: Demographic data (date of birth, gender, degree program, and semester)
   • Evaluation: The data is used to determine the typical behavior of user groups, in particular to ensure that all potential user groups are equally addressed by the offer. The data is only evaluated in aggregated form. No evaluation of individual user data takes place
2. Evaluation and improvement of user-friendliness in relation to components of the system
   • Data used: Interaction data (date, time, and current component of the application of user interactions).
   • Evaluation: Interaction data is used to check and improve the quality of the service. The data is only evaluated in aggregated form. No evaluation of individual user data takes place.
3. Evaluation and improvement of user-friendliness in relation to individual interactions with the system.
   • Data used: User input requested by the system (free text fields of the chatbot).
   • Evaluation: User input is used to ensure and improve the comprehensibility of the system. The data is processed without user assignment, but may contain your personal data if you disclose it in your conversation with the chatbot. Individual inputs are treated as strictly confidential and are not published or passed on to third parties.
4. Provision of AI assistance. In particular, the generation of chat messages, summaries, and writing assistance.
   • Data used: Input in the learning journal and chat messages sent.
   • Evaluation: To provide the AI-driven parts of the application, your chat inputs and associated metadata (date, time) may be sent to OpenAI OpCo, LLC. The data will only be passed on to the third parties listed here and only for the direct processing of user input.
5. Evaluation of the effectiveness of the application
   • Data used: Input in questionnaires on psychological topics such as self-regulation.
   • Evaluation: The data is statistically evaluated together with the data from A and D (excluding names) in order to determine statements about the effect of individual components of the chatbot. The data is only evaluated in aggregated form. No evaluation of individual user data takes place.

All data collected during the study will be treated as strictly confidential and stored, processed, and evaluated in pseudonymized form. This ensures that no conclusions can be drawn about you. A table will be created that allows the numerical code to be assigned to a specific person (last name, first name). This assignment table and the declaration of consent will be stored separately from the research data and exclusively in paper form. Only the study management will have access to the assignment table.

The assignment table, including contact details and the declaration of consent, will be destroyed immediately after completion of the study so that no assignment to your person is possible. The numerical code will then also be removed from the research data. The research data will be stored for a period of ten years.

The study results will be published exclusively in aggregated form. Participation in the study is voluntary. You will not suffer any disadvantage if you decide not to participate in the study. Even if you have signed the declaration of consent, you can withdraw from participation at any time with or without giving reasons. If you wish, the data collected will be deleted in whole or in part. This is only possible until the allocation table and contact details have been deleted. After that, it will no longer be possible to allocate the data to individual persons.

Recipients

Your personal data will only be transferred to selected third parties. Specifically, these are:

• OpenAI OpCo, LLC: In order to provide the AI-driven parts of the application, your chat entries and associated metadata (date, time) may be sent to OpenAI OpCo, LLC.

If, in exceptional cases, it is necessary for external service providers to process personal data on our behalf, we carefully select these providers and bind them contractually. The service providers in question work exclusively according to our instructions. We ensure this through strict contractual regulations, technical and organizational measures, and supplementary controls.

Personal data will not be transferred to third countries outside the EU or the EEA or to an international organization. Automated decision-making, including profiling, does not take place.

Storage period

The assignment table, including contact details and the declaration of consent, will be destroyed immediately after completion of the study. The research data will be stored for a period of ten years.