Privacy Policy ("Chatbot")

Information pursuant to Articles 12 and 13 of EU Regulation 2016/679

3 Zinnen Dolomites Consortium
Schattenweg 2/F
39038 - San Candido (BZ)
IT01150180212

This privacy notice explains how personal data are processed in connection with the use of the chatbot on our website www.dreizinnen.com (“Website”) and the operation of the “Emma” chatbot (“Chatbot”) – in accordance with Regulation (EU) 2016/679 (“GDPR”).

It supplements the general privacy policy provided to visitors of the website. We recommend reading that general privacy notice as well to gain a full understanding of the data processing activities.

The “Emma” chatbot is designed solely to provide users with quick, accessible, and interactive access to various website information. Use of the chatbot for any other purposes not aligned with this objective is excluded.

Use of our chatbot implies acceptance of this privacy policy.

1a) Interaction Content

All messages you send or receive through the chatbot are processed solely to enable the dialogue. You will never be asked to provide personal data that could identify you or another person. This includes contact details, addresses, tax numbers, or similar information. Providing personal data is neither contractually nor legally required and is not necessary for the chatbot’s functionality. You will not suffer any disadvantages if you choose not to provide such information. As recommended, please refrain from disclosing any identifiable information.

1b) Special Categories of Personal Data

As already stated under “Interaction Content,” you are also never asked to provide sensitive data, such as health-related information.

1c) System and Access Information

To provide and operate the “Emma” chatbot securely, various technical details are automatically collected. These include a randomly generated pseudonymous client ID, browser information (e.g., version and language), date and time of access, configured time zone, and information about the device’s operating system.
The so-called referrer URL (i.e., the page from which the chatbot was accessed) and technical system log or protocol data are also recorded.

1d) Voluntary Feedback on Responses and Chatbot Evaluation

If you choose to rate chatbot responses (e.g., thumbs up/down) to help improve the service, such feedback will be collected and used to enhance chatbot performance.

1e) Processing Methods and Cookies

This chatbot uses the following cookies:

• • Chat-Key: A number identifying the chat session to preserve the chat history (e.g., when switching windows). Storage duration: 3 days

  • Chat-ClientID: Each user receives a randomly generated ClientID to make chat sessions traceable. This cannot be linked to any person without additional information and is therefore considered pseudonymous data. Storage duration: 1 year

  • Chat-Privacy: This cookie is created when you accept the privacy policy within the chat. It allows us to verify that the privacy notice has been acknowledged. Storage duration: 7 days

The legal basis for setting these cookies is Article 6(1)(f) GDPR — the legitimate interest of the data controller to ensure a useful and efficient user experience.

2a) Data Recipients, Processors, and Transfers

This chatbot uses the language model provided by OpenAI (“ChatGPT”). Headquarters: 3180 18th St, San Francisco, California 94110, USA. Processing generally takes place via the data center located in Ireland: The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Nevertheless, this provider does not receive any information or personal data of users or chat content. The provider is used solely for technical reasons and based on a legitimate interest in providing a high-performance and helpful chatbot.

2b) Operational Security, Stability, and Maintenance

During operation, technical and network-related data that might, in rare cases, allow indirect identification are automatically collected. These data are used to fix errors, provide technical support, conduct system tests, prevent security issues, and monitor system performance. In general, data are analyzed only in aggregated or anonymized form to assess metrics such as feature usage frequency or average response times. Legal basis: Art. 6(1)(f) GDPR – legitimate interest of the data controller.

2c) Quality Assurance, Content Updates, and Reporting

To ensure the chatbot’s content quality, selected conversation excerpts may be reviewed. To avoid processing personal data, chats are used for quality assurance, content updates, and reporting only after all identifying information has been removed. Legal basis: Art. 6(1)(f) GDPR – legitimate interest of the controller. If you voluntarily provide personal data, such provision is considered consent under Art. 6(1)(a) and/or Art. 9(2)(a) GDPR.

2d) Compliance with Legal Obligations

To protect its own rights or comply with legal requirements, personal data may be disclosed to authorities. Legal basis: Art. 6(1)(c) GDPR.

External service providers, such as IT support companies, may have access to personal data within the scope of their duties. Such processors are contractually bound pursuant to Art. 28 GDPR.

As a user of the “Emma” chatbot, you have the rights set out in Articles 15–21 of the GDPR, insofar as personal data have been provided and chat content could be attributable to an individual. These include in particular:

• • Right to withdraw consent – You may withdraw your consent at any time.

  • Right of access – You have the right to obtain confirmation as to whether personal data concerning you are being processed and, if so, to access the relevant information (Art. 15 GDPR).

  • Right to rectification – You may request the update or correction of inaccurate data (Art. 16 GDPR).

  • Right to erasure (“right to be forgotten”) – You may request deletion of your data at any time (Art. 17 GDPR), unless legal obligations prevent such deletion.

  • Right to restriction of processing – You may request that the processing of your data be restricted, e.g., to specific purposes (Art. 18 GDPR).

  • Right to data portability – You may request to receive your data in a machine-readable format or have them transmitted to another controller (Art. 20 GDPR).

  • Right to object – You may object at any time to processing based on legitimate interests (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection authority, for example in your country of residence or where the alleged infringement occurred. In Italy, this authority is the “Garante per la protezione dei dati personali”.

The use of this chatbot is not intended for minors. We therefore do not collect or store any data from underage visitors (except unintentionally). Individuals under the age of 18 are not permitted to use the chatbot.

This privacy notice may be updated at any time.

If you have any questions regarding this privacy policy or concerns about how we process data, please contact us at the addresses provided above.