LibreChat

Information in accordance with the information obligation under Art. 13 GDPR

This supplementary declaration contains information on how and to what extent and for what purpose personal data is processed in the context of the use of the LibreChat service (https://chat-ai.tu-clausthal.de) of Clausthal University of Technology. The general data protection declaration that also applies to the websites of Clausthal University of Technology can be viewed at (https://www.tu-clausthal.de/datenschutz/). There you will find information on connection data that is also transmitted by your end device as soon as you visit a web instance of Clausthal University of Technology.

Further contact persons

The technical provision of LibreChat is carried out by the computer center of TU Clausthal. Technical inquiries can be directed to support@rz.tu-clausthal.de.

Legal basis for the processing of personal data

The legal basis depends on the respective purpose of use.

The basis for the processing of personal data is basically § 17 para. 1 NHG. Insofar as personal data of employees of Clausthal University of Technology is processed, the legal basis is also Art. 88 GDPR i.V.m. § SECTION 12 NDSG.

Insofar as the processing of personal data is based on the voluntary consent of the data subject, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis.

LibreChat

LibreChat (https://chat-ai.tu-clausthal.de) is the configured version of the open source software LibreChat. This software is operated in the IT infrastructure of Clausthal University of Technology. The open-source software provides a login screen that is used to manage users. The software offers the possibility of combining different external cloud providers of AI models in one application and via one access point. Only one provider is currently connected. The content data entered by the user is transmitted to the external provider selected by the user. The selected provider does not receive any information about the respective user. Clausthal University of Technology has concluded contracts with the respective external cloud providers for order processing in accordance with Art. 28 GDPR. It has been contractually assured that, among other things, the content data entered may not be used for artificial intelligence training purposes.

Purpose of the data processing

LibreChat (https://chat-ai.tu-clausthal.de) is available to members of TU Clausthal after registration in the web instance. Personal data is used for the purpose of administrative user management.

In addition, content data entered by the user is processed. LibreChat can be used to automate frequent or time-consuming text creation tasks, such as writing press articles, reports or presentations. In addition, texts in different languages can be translated quickly, facilitating communication in multilingual environments. For international students or in language courses, LibreChat can be used to carry out language exercises or clarify linguistic doubts. Other use cases include searching research literature and creating summaries. In teaching, LibreChat can support the creation of individualized learning materials such as explanations of complex concepts or additional exercises.

The data sent by LibreChat to external providers of AI services is provided by the user via input or file upload. It is not permitted to provide sensitive or confidential data to the AI services, such as statements by specific persons in logs. This also applies to personal data in any form. Furthermore, these models may not be used, for example, to evaluate student performance or to analyze application candidates.

Type and scope of data processed:

The website (https://chat-ai.tu-clausthal.de/) is an internal, access-restricted area to which TU members (students and employees) are granted access following a registration process.

The system only includes those users who have logged into the system at least once independently. The login is done with the RZ account. The RZ abbreviation and the corresponding RZ password are processed for this purpose.

Connection data is generated when the service is used. The temporary storage of log file data by the system is necessary for the login process in order to enable the delivery of requested documents to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.

There is no interaction between different users in LibreChat. It is possible to upload a profile picture, but this is only visible to the user themselves.

There is currently a data processing agreement with the company OpenAI (OpenAI Ireland Limited with registered office at "The Liffey Trust Centre", 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland). OpenAI does not receive any data from the registration process. Only the affiliation to TU Clausthal and a unique session ID, which is used to assign the API calls, are transmitted.

In addition, the content that is communicated by the users themselves is processed.

Duration of data storage

The use of LibreChat is possible for TU members for an unlimited period of time, but the computer center reserves the right to discontinue the LibreChat service. In the event that the service is discontinued, the Computing Center will inform TU members 3 months before the expiry date. A trigger for discontinuation of the service would be, for example, that the monthly financial framework provided has been exhausted. In this case, your own data can continue to be accessed and backed up until the service is discontinued. However, new API calls of the affected paid model can no longer be executed.

The chat histories and uploaded images are stored in the TU Clausthal infrastructure. OpenAI only processes the data to respond to the current request, but in this case it falls back on previous requests.

Users have the option of deleting their own chats and uploaded files at any time.

The user account can be deleted upon request via support@rz.tu-clausthal.de.

Data recipient

The OpenAI API is integrated into LibreChat. OpenAI guarantees that the transmitted data will not be used for training purposes of the AI models and will not be passed on to other third parties.

LibreChat itself is operated and administered on TU Clausthal servers. User data is not passed on to third parties.

The connection to LibreChat is made using SSL encryption (https). Data encrypted via SSL cannot be read by third parties.

Transmission to third countries

The currently connected cloud provider is OpenAI. OpenAI transfers the content data entered to recipients outside the European Union. The respective third country may not offer the same level of data protection as Germany. However, OpenAI contractually assures Clausthal University of Technology that it will transfer data in accordance with the applicable data protection laws. OpenAI relies on the adequacy decisions of the European Commission for certain countries and for other jurisdictions, the standard contractual clauses approved by the European Commission and any applicable country-specific regulations. For more information or to obtain a copy of the appropriate safeguards implemented by OpenAI, please contact privacy@openai.com

Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights in particular vis-à-vis the controller

Right to information pursuant to Art. 15 GDPR

You can request confirmation from the controller as to whether personal data concerning you is being processed by Clausthal University of Technology.

Right to rectification pursuant to Art. 16 GDPR

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete.

Right to restriction of processing pursuant to Art. 18 GDPR

Under certain conditions, you may request the restriction of the processing of personal data concerning you, e.g. if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data or if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.

Right to data portability pursuant to Art. 20 GDPR

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

TU Clausthal does not have access to chat histories. Users can only view and save chat histories independently.

Automated decision in individual cases including profiling in accordance with Art. 22 GDPR

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. LibreChat is not used for profiling in accordance with Art. 22 GDPR.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.