Privacy notice DB Info AI Assistance

DB InfraGO AG 
Adam-Riese-Straße 11-13 
60327 Frankfurt am Main 

DB InfraGO AG collects and processes your data as the responsible party.
Contact for data protection matters: 
E-Mail: Datenschutz.DBInfraGO@deutschebahn.com 

The appointed data protection officer is Dr. Marein Müller. You can contact the data protection organisation by e-mail at konzerndatenschutz@deutschebahn.com. 

For technical reasons and to meet high IT security standards, certain data must be collected and stored when you visit our website. This includes, for example, your IP address, the date and duration of the visit, the amount of data received and sent, the webpages accessed, the identification details of the browser and operating system type used, and the website from which you accessed our website.
  
The legal basis for this data processing is Article 6(1)(f) GDPR, i.e. processing for the purposes of our legitimate interests. These interests consist in ensuring and logging the technically secure operation of the website and establishing the connection. 

If you participate in the AI assistance test, we process certain data relating to you. The following section explains this processing in more detail. 

Please note: As part of this test, we use artificial intelligence technologies, in particular generative artificial intelligence, to provide the requested information during the test, such as a train connection information. 

The AI assistance responds automatically to your inputs by providing answers and information. For example, it provides travel information, station information and information about connections. 

Generative AI uses your data input and a probability-based approach to identify and provide suitable information. The application then generates the results considered most likely to be relevant. For this purpose, the AI assistance uses purely technical models without deliberately establishing a link to you as an individual or, for example, to a user account. 

We process your text inputs to understand your request and identify suitable information for you.  

In addition, as part of the test, we also process your text inputs on an aggregated basis in order to understand how participants use the test service, identify potential product errors and improve the product’s functionality during the ongoing test. For this purpose, we process the following information on a pseudonymised basis:  

• Conversation data: messages within one session, so that the conversation history can be used as context for further messages in the same conversation.

• Session ID: pseudonymous technical identifier used to assign the current conversation; the web application uses a cookie for this purpose. 

• Feedback data: for example ratings or reports of incorrect or unwanted responses, assigned to the respective session ID and not to a user account. 

In this context, we also process optimisation, operational and analytics data, for example: 

• timestamps for the start and end of the conversation 

• total duration and number of interactions per session 

• language used 

• topics/topic categories or type of user request 

• anonymised dialogue structure 

• selected responses/actions of the chatbot 

• frequency of use/repetitions 

• technical status codes 

• anonymised feedback results 

• conversion data 

• system and channel information 

• technical logs, events, traces and metrics for system monitoring 

For the test of the AI assistance, personal data is neither required nor desired in any free-text entries you make. If you nevertheless enter personal data, the system will filter such data as far as possible and then delete it. 

The legal bases for processing data in connection with the use of the AI assistance and your text inputs are Article 6(1)(b) GDPR, i.e. processing for fulfilling the contract relating to the test operation, and Article 6(1)(f) GDPR, i.e. processing for the purposes of our legitimate interests. 

Processing under Article 6(1)(b) GDPR is carried out for fulfilling the contract concluded with you regarding the test of the AI assistance service and for taking steps prior to entering into a contract. 

Processing under Article 6(1)(f) GDPR is necessary for the purposes of our legitimate interests, which consist in ensuring the technical operation of the website, developing, offering and improving innovative products for our customers, and identifying and resolving errors. 

Your data is processed in accordance with the principles set out in Article 5 GDPR, in particular necessity and data minimisation. 

Data processing is carried out in accordance with Article 32 GDPR. For example, encryption, pseudonymisation and/or anonymisation procedures are used to ensure the highest possible level of data protection. 

We process your data exclusively for the purposes of the test and delete it as soon as it is no longer required for those purposes. 

In order to provide you with our products and services, we also use processors, for example for the provision of data centre capacities or system support. 

We select these service providers with great care and contractually require them to comply with strict obligations. The service providers act on our instructions. This is safeguarded by strict contractual regulations, technical and organisational measures and additional checks. 

 Otherwise, your data is forwarded only on the basis of a legal provision. 

As a rule, no transfer takes place to third countries outside the European Union (EU) / the European Economic Area (EEA) or to an international organisation. If such transfers should exceptionally take place in connection with the involvement of service providers, appropriate legally required safeguards will be in place. These include, for example, the EU standard contractual clauses and an adequacy decision by the European Commission.  

No. 

If the respective legal requirements are met, you have the following rights:  You have the right to request information about the personal data stored about you. You also have the right to request the correction of inaccurate personal data, including the completion of incomplete data. In addition, under certain circumstances, you have the right to request the deletion of personal data stored about you. If legal provisions, such as retention obligations, do not permit deletion, your data will instead be blocked so that it can only be accessed for the purpose of complying with mandatory legal provisions. 

In certain cases, you have the right to request restriction of the processing of your personal data. You may request that the data you have provided to us and that we process on the basis of consent or a contract be transferred to you or, where applicable, to a third party designated by you. 

You may object to data processing on grounds relating to your particular situation if the processing is based on our legitimate interests or is necessary for the performance of a task carried out in the public interest. You also have the right to lodge a complaint with a supervisory authority. You may contact the following data protection supervisory authority: 

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7
65185 Wiesbaden 

To exercise your rights, simply send a letter by post to: 

DB InfraGO AG 
Adam-Riese-Straße 11-13 
60327 Frankfurt am Main 

Or send an e-mail to: Datenschutz.DBInfraGO@deutschebahn.com 

You may also exercise all rights via the Group Data Protection Officer. To do so, please send an e-mail with your request to: konzerndatenschutz@deutschebahn.com  

Please note that, in order to process your enquiries and for identification purposes, we process your personal data pursuant to Article 6(1), sentence 1, point (c) GDPR. 

Cookies are small text files in which personal data and device-related data may be stored. When a webpage is accessed, cookies may be transferred to it and may enable users to be assigned. Cookies help enable users to use webpages and provide the contractual service described above. 

You are not legally required to provide personal data. You should also not enter any personal data in free-text fields. However, if you do not provide us with the data required for technical functionality, in particular session IDs and your text inputs, we may not be able to perform the contract concluded with you or provide the services to you. 

If you click a link to an external website, you leave the websites of DB InfraGO AG. This means that DB InfraGO AG is not responsible for the content, services or products offered on the linked website, nor is it responsible for data protection or technical security on the linked website. 

We update this privacy notice in line with changes to functions or legal regulations. We therefore recommend that you review this privacy notice at regular intervals.