Privacy Policy: Chatbot

Daikon Solutions UG (haftungsbeschränkt) (hereinafter "Daikon") is pleased that you are using our chatbot. Data protection and data security when using our chatbots are very important to us. We would therefore like to inform you here about which of your personal data we collect when you use the chatbot and for what purposes it is used.

As changes in the law or changes to our internal company processes may occur, we reserve the right to amend this privacy policy. We therefore recommend that you review it regularly. The current version can be viewed, saved and printed at any time in the same place.

The controller within the meaning of the EU General Data Protection Regulation (hereinafter: GDPR (DSGVO)) and other national data protection laws of the member states as well as other data protection provisions is:

Daikon Solutions (UG) haftungsbeschränktGarzweilerweg 1650829 Köln, GermanyPhone: +49 1633 66 1888Email: contact@daikon-solutions.deWebsite: www.daikon-solutions.de

This privacy policy applies to our chatbot, which is implemented on the websites of our business partners.

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, information such as your name, your age, your address, your telephone number, your date of birth, your email address, your IP address or your user behaviour. Information that we cannot relate to you (or can only relate to you with disproportionate effort), e.g. because the information has been anonymised, is not personal data.

The processing of personal data (e.g. collecting, retrieving, using, storing or transmitting it) always requires a legal basis or your consent. Processed personal data is erased as soon as the purpose of the processing has been achieved and there are no longer any statutory retention obligations to be observed.

Where we process your personal data in order to provide certain services, we inform you below about the specific processes, the scope and purpose of the data processing, the legal basis for the processing and the respective storage period.

Daikon offers chatbot solutions for website operators. When you, as a visitor, access such a website and use the embedded chatbot, the following processing steps are carried out:

Among other things, the processing includes forwarding your requests to external providers for processing, for matching product information and for optimising the quality of the responses. The data collected is also used to continuously improve the performance of our chatbot and the user experience.

When the chatbot is used, the following personal data is processed:

• Content entered (prompts) and its timestamps
• IP addresses
• Browser type, operating system
• Chat histories (including all messages and responses exchanged during use).

The processing is based on Art. 6(1) lit. f GDPR (legitimate interest): insofar as it is necessary for the use of the chatbot or for improving our service, analysing usage behaviour, error management and preventing misuse.

Daikon generally uses your personal data only to provide the functionality of our chatbot that you have requested. For the technical implementation, we use specialised IT service providers. These service providers process personal data exclusively on our behalf and only to the extent necessary to provide the service. Data is not passed on to third parties for other purposes, in particular for advertising purposes.

Some of our service providers or their subcontractors are based in, or process data in, so-called third countries outside the European Union or the European Economic Area. These include in particular:

• OpenAI, L.L.C. (USA) for reformulating user queries, similarity search and generating the final responses,
• Cohere Inc. (Canada) for evaluating and selecting suitable results,
• Zillis Inc. (USA) for providing the document database and the similarity search against the user question.

Personal data is transferred to these third countries exclusively in compliance with the legal requirements of Art. 44 et seq. GDPR. In doing so, we ensure that either an adequacy decision recognised by the EU Commission exists (e.g. for Canada) or appropriate safeguards within the meaning of Art. 46 GDPR are in place, for example through the conclusion of EU standard contractual clauses. Our service providers are contractually obliged to comply with European data protection standards.

Where processing takes place in the EU (e.g. via AWS server locations in the EU), we ensure through appropriate contractual, technical and organisational measures that the data protection requirements of the GDPR are met.

Daikon stores IP addresses, chat histories and metadata for up to 12 months in order to enable evaluations of this data to improve the system. Longer storage may take place if statutory retention obligations or legitimate interests require it.

As a data subject whose personal data is processed, you have the following rights under the GDPR (DSGVO):

• Pursuant to Art. 15 GDPR, you can request information about your personal data processed by us. In particular, you can request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, any transfer to third countries or to international organisations, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details.
• Pursuant to Art. 16 GDPR, you can request without undue delay the rectification of inaccurate personal data or the completion of your personal data stored by us.
• Pursuant to Art. 17 GDPR, you can request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
• Pursuant to Art. 18 GDPR, you can request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful, we no longer need the data and you oppose its erasure because you need it for the establishment, exercise or defence of legal claims. You are also entitled to the right under Art. 18 GDPR if you have objected to the processing pursuant to Art. 21 GDPR.
• Pursuant to Art. 20 GDPR, you can request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or you can request its transmission to another controller.
• Pursuant to Art. 7(3) GDPR, you can withdraw consent once given to us at any time. As a result, we may no longer continue the data processing based on this consent in the future.
• Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence, your place of work or our company headquarters for this purpose.

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1) sentence 1 lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data, provided that there are grounds for this arising from your particular situation or the objection is directed against direct marketing. In the case of direct marketing, you have a general right to object, which we will implement without you having to specify a particular situation.

We are committed to protecting your privacy and treating your personal data confidentially. In order to prevent manipulation, loss or misuse of your data stored with us, we take extensive technical and organisational security measures, which are regularly reviewed and adapted to technological progress. These include, among other things, the use of current encryption standards such as secure data transmission via the HTTPS protocol (TLS).

We would point out, however, that due to the structure of the internet it is possible that the rules of data protection and the security measures mentioned above are not observed by other persons or institutions outside our area of responsibility. In particular, data disclosed without encryption (for example, when sent by email) may be read by third parties. We have no technical influence on this. It is the responsibility of the user to protect the data they provide against misuse by encryption or in any other way.

We reserve the right to update the contents of this privacy policy to keep it current with changes to our services or the legal situation. Please check our website regularly for the latest version.