This website hosts “EzBot”, an experimental chatbot that is used in the context of a research project in the field of digital governance. The chatbot relies on external service providers, in particular OpenAI and Amazon Web Services (AWS), in order to enable the technical provision of the service and the generation of responses. The protection of your personal data is a top priority for us.
The following information explains how your data are processed when you use the chatbot, in accordance with Article 13 of the General Data Protection Regulation (GDPR).
The controller within the meaning of the GDPR is
Freie Universität Berlin
represented by the President
Kaiserswerther Straße 16–18
14195 Berlin
Germany
Person responsible for the research project “EzBot”
Prof. Dr. Genia Kostka
Institute of Chinese Studies
Freie Universität Berlin
Fabeckstr. 23/25
14195 Berlin
Germany
Email: vw.privacy@chinastudien.fu-berlin.de
The official Data Protection Officer of Freie Universität Berlin can be contacted at
Freie Universität Berlin
Official Data Protection Officer
Kaiserswerther Straße 16–18
14195 Berlin
Germany
Email: datenschutz@fu-berlin.de
You may also send confidential data protection related inquiries to this email address. The university does not have access to this communication.
When you use EzBot, the following categories of personal data in particular may be processed
We design the system in such a way that no additional personal data are collected which are not required for the research purpose. In particular
Please note that we cannot control which content you voluntarily enter in the chat. It is therefore possible that you disclose personal data or particularly sensitive information in your text entries, for example concerning health, political opinions or other protected areas. We ask you to enter such information only if it is necessary for participation in the research project and if you are aware of the associated risks.
Your data are processed for the following purposes
Your data are not processed for advertising purposes or for profiling for commercial purposes.
The processing of your personal data is based on the following legal grounds
Because we cannot fully control the content of your text entries, it cannot be ruled out that special categories of personal data within the meaning of Article 9 paragraph 1 GDPR are processed, for example data concerning health or political opinions. Insofar as such data are processed, we rely on
The provision of your personal data is voluntary. If you choose not to provide data, you will not be able to participate in the study, but you will not suffer any other disadvantages.
You may withdraw your consent at any time with effect for the future. Processing carried out before the withdrawal remains lawful.
To maintain consistent model configurations and experimental conditions throughout the research period, EzBot uses GPT-5.6 Sol to generate chat responses and GPT-5.6 Luna to generate context summaries for participants who consent to data sharing. Chat responses use OpenAI’s Fast mode. According to OpenAI’s technical documentation on data residency, as of October 15, 2026, Fast mode with GPT-5.6 Sol and GPT-5.6 Luna is not among the configurations that support EU data residency; OpenAI explicitly lists only GPT-6.1 Sol, GPT-6 Sol, and GPT-6 Luna as supporting EU data residency in Fast mode. EzBot currently calls these models through OpenAI’s standard global API endpoint and does not use an EU-specific data-residency endpoint. Accordingly, content sent to OpenAI to generate responses or summaries may be processed outside the EU, including in the United States. The EzBot application and the research database maintained by the research team are hosted in the Amazon Web Services Frankfurt Region (eu-central-1). This statement about storage in Frankfurt applies only to data that the research team stores through EzBot; it does not apply to OpenAI’s independent processing in the course of providing its API service.
We store
Pseudonymised raw data are deleted as soon as they are no longer required for the research purpose. This also includes backups, insofar as they contain personal content. Specific retention periods follow from the research plan and the relevant retention rules of Freie Universität Berlin.
Within Freie Universität Berlin, only those persons have access to your data who necessarily require it in order to conduct the research project, in particular members of the research group of Prof. Dr. Kostka.
We use the following processors within the meaning of Article 28 GDPR
For the organisation and conduct of the participant recruitment and the survey, we use the service provider Skopos Market Insight & Consultancy Ltd, Coppergate House, White’s Row, London, E1 7NF (“Skopos”). Skopos may receive and process personal data to the extent necessary to administer the survey process, in particular participation and survey-related metadata and, where applicable, contact or panel-related information that is required for incentive handling and communication.
Data processing agreements have been concluded with all processors that comply with the requirements of Article 28 GDPR. They process the data exclusively on our instructions and not for their own purposes.
Your personal data are not passed on for commercial purposes or for advertising.
The EzBot application and the research database maintained by the research team are hosted in the Amazon Web Services Frankfurt Region (eu-central-1). However, when you use EzBot, chat content and, where you have consented to data sharing, information used to create or update a context summary are transmitted to OpenAI to generate responses or summaries. Because EzBot uses OpenAI’s standard global API endpoint rather than an EU-specific data-residency endpoint, personal data may be processed outside the EU, including in the United States. The Frankfurt storage location applies only to data stored by the research team through EzBot and not to OpenAI’s independent processing in providing its API service.
In addition, both AWS and OpenAI are corporate groups with their head offices in the United States. This means that access from a third country cannot be completely ruled out, for example due to administrative activities or legal disclosure obligations in the United States.
For any transfers to the United States and any third-country access possibilities, we rely on the following safeguards:
Despite these safeguards, a residual risk cannot be completely ruled out that authorities in the United States may access data. This structural risk cannot currently be completely eliminated when using US based providers. We take this into account in our risk assessment and limit the scope and sensitivity of the data processed as far as possible.
The chatbot uses an AI language model to generate its responses. However, there is no automated decision making within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
There is no profiling aimed at evaluating or classifying you for decisions outside this research project.
Subject to the statutory conditions, you have the following rights vis à vis Freie Universität Berlin
To exercise these rights, you can contact us using the contact details set out in section 1 or contact the Data Protection Officer of Freie Universität Berlin directly.
You also have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. The competent supervisory authority is usually
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt Moabit 59–61
10555 Berlin
Germany
This privacy policy may be amended from time to time, for example if the research design, the service providers used or the legal requirements change. The current version is available at the URL indicated on this website.
Effective date: October 15, 2026