Information notice on the processing of personal data
Bruno (the "Platform") makes course-specific artificial-intelligence study companions ("chatbots") available to students and staff. This notice is given under Article 13 of Regulation (EU) 2016/679 (the "GDPR") by the controller of the processing, Università Commerciale "Luigi Bocconi", with registered offices at Via Sarfatti 25, Milan (MI), acting through the ION Management Science Lab (IMSL) at SDA Bocconi School of Management (the "Controller"), which may be contacted at ionlab@sdabocconi.it. Acceptance is required before a chatbot can be opened. It records that this notice was given to you and is not consent within the meaning of Article 6(1)(a) GDPR.
1. The chatbots
Chatbots are artificial-intelligence systems configured by teaching staff from course material. Their output can be inaccurate and should be checked against that material. Where a chatbot scores a practice answer, the score is a study aid: it is not a mark, it forms no part of any examination or official assessment, and it is not shown to teaching staff. No decision producing legal or similarly significant effects concerning you is taken by solely automated means (Article 22(1) GDPR), and no profiling within the meaning of Article 4(4) GDPR is carried out. What you write is not screened. You should not enter personal data concerning yourself or another person, and in particular none of the special categories referred to in Article 9(1) GDPR.
2. Data processed, purposes and lawful bases
| Data | Purpose | Lawful basis |
|---|---|---|
| Account and enrolment: email address, password as a cryptographic hash, name, role, the version and date of the notice accepted, and the chatbots your account may open | account creation, authentication, record of acceptance, access to your chatbots | Article 6(1)(b) |
| Conversation: your messages and the replies, a title generated automatically from your first message, and your attachments, documents being kept as extracted text together with the file name, images as supplied | provision of the chatbot and of your conversation history | Article 6(1)(b) |
| Security: your IP address and browser identification string, recorded only at sign-up, invitation, password reset and access-code redemption, and a record of actions taken on the Platform | security, and the prevention and investigation of misuse | Article 6(1)(f) |
The processing under Article 6(1)(b) is necessary to perform the contract under which the Platform is made available to you: without an email address and a password no account can exist. A name is optional. Where an account is created for you, your address is obtained from the member of staff who enrolled you (Article 14(2)(f) GDPR). Your IP address is additionally read on each request in order to limit request rates; it is held in memory for that purpose alone and is not stored.
3. Recipients
Your message, the earlier messages of the same conversation and any attachment are transmitted to the provider of the model serving that chatbot, for the sole purpose of generating its reply.
Chatbots served by OpenAI transmit the conversation to that provider. The provider retains no copy of it, save content its abuse checks flag, which it may retain for up to thirty days. Chatbots served by Amazon Bedrock are confined to European Union regions by an enforced allowlist, and the conversation does not leave the Union. The provider retains no copy of it.
No name, email address or account identifier accompanies the request, although what you write or attach travels with it. Under the terms on which the Controller uses them, no provider uses your messages to train any model.
The Platform is served from Frankfurt, Germany by Vercel, and the records described in section 2 are stored in a PostgreSQL database operated by Amazon Web Services, also in Frankfurt. Invitations, password-reset links and access notifications are despatched through an electronic mail relay operated for Bocconi, which receives the address and the message; no conversation content is ever sent by electronic mail.
4. Cookies
Only strictly necessary cookies are set: the authentication cookie that keeps you signed in, which expires after twenty-four hours, together with the cookies that protect against cross-site request forgery and return you to the page you requested. No advertising, analytics, profiling or tracking cookie is set. Being strictly necessary, these require no consent under Article 5(3) of Directive 2002/58/EC, implemented in Italy by Article 122 of Legislative Decree 196/2003.
5. Confidentiality within the Platform
Administrative pages identify each account by a pseudonymous code, in the form STU-4F2A1C3B9E for a student and STF-4F2A1C3B9E for a member of staff. No student's name or email address appears anywhere in the administrative area; the only identities present there are a member of staff's own, those a member of staff enters in order to enrol a class, and that of whoever uploaded a course file. No administrative function reads conversation content: no instructor or administrator, at any level, can open, list or search another account's conversations. The technical personnel who operate the Platform hold the database access required to maintain it, which extends to stored conversations, and are bound by an obligation of confidentiality.
6. Storage and deletion
Nothing is deleted on a time basis, save an attachment which you upload but never send, which expires after twenty-four hours. A conversation is kept for as long as you keep it. You may delete it at any time; deletion takes effect immediately and permanently, the conversation, its messages and its attachments being removed rather than hidden. Account and enrolment data are kept while the account exists, and the Controller will delete an account on request to ionlab@sdabocconi.it. Security data and the record of actions are kept for as long as is necessary to investigate misuse and survive the account, the link to it having been removed. Deletion does not extend to the backups of the hosting and database providers, nor to any record held by a model provider.
7. Research
Course companions are not used for research: your conversations with them are not analysed, extracted or published for research purposes. Should the Controller wish to use them for research, your consent under Article 6(1)(a) GDPR will be sought in advance. You are free to give or to refuse it, refusal carries no consequence for your use of the Platform, and consent once given may be withdrawn at any time (Article 7(3) GDPR). In the absence of consent, no research use takes place.
8. Your rights
You have the rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and portability (Article 20), the last in respect of data processed under Article 6(1)(b).
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (Article 21(1) GDPR).
The Platform offers no self-service export and no self-service deletion of an account; individual conversations you may delete yourself. Any other request should be sent to ionlab@sdabocconi.it from the address registered to your account, and is answered within one month, extendable by two further months where the request is complex (Article 12(3) GDPR). You may also lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (Article 77 GDPR).
9. Minimum age and amendment of this notice
The Platform is available only to persons aged 18 or over. No date of birth is collected and no verification of age is carried out: by accepting this notice you confirm that you are 18 years of age or over, and it is your responsibility to do so truthfully. This notice is issued in dated versions, and where it is materially amended you will be asked to accept the new version.