A. General information
This privacy statement (the “Privacy Statement”) applies to your usage of the SAP Conversational AI Website (“SAP Conversational AI”). It consists of three parts: this part A (General Information) contains the general principles how SAP is processing your Personal Data (each as defined below). Section B (Usage of Personal Data based on statutory permissions) explains based on which statutory permissions in the EU General Data Protection Regulation (“GDPR”) SAP will be processing your Personal Data while Section C (Usage of Personal Data based on consent) explains how SAP intends to process your Personal Data based on your consent.
1. Data controller
Data controller in case of SAP Conversational AI is SAP France [35 rue d'Alsace, 92300 Levallois-Perret] (“SAP”), with its data protection officer Mathias Cellarius (firstname.lastname@example.org).
2. Data categories
In connection with your usage of SAP Conversational AI, SAP would like to use the following categories of personal data consisting of your:
i - first and last name
ii - email address
iii - username
iv - profile avatar image (optional)
v - cookie-generated session ids (optional; if you consent to SAP placing cookies on your device) (together your “Personal Data”)
3. Purposes and duration of data processing
We require your Personal Data in order to provide you with access to SAP Conversational AI, to send newsletters to you and in order to comply with statutory obligations, including in particular checks under applicable export laws.
SAP will use your Personal Data only for as long as it is required for the above purposes plus, where applicable, statutory data retention periods.
Any provision of Personal Data is entirely voluntary for you. However, without the data categories above not marked as optional, it will not be possible for SAP to provide you with access to SAP Conversational AI. If you do not provide SAP with the data categories above marked as optional, you cannot use the full functionality of SAP Conversational AI.
4. Recipients of your Personal Data; third country processing
As part of a global group of companies, SAP has affiliates and third-party service providers within as well as outside of the European Economic Area (the “EEA”). As a consequence, whenever SAP is using or otherwise processing your Personal Data for the purposes set out in this Privacy Statement, SAP may transfer your Personal Data to countries outside of the EEA including to such countries in which a statutory level of data protection applies that is not comparable to the level of data protection within the EEA. Whenever such transfer occurs, it is based on the Standard Contractual Clauses (according to EU Commission Decision 87/2010/EC or any future replacement) in order to contractually provide that your Personal Data is subject to a level of data protection that applies within the EEA. You may obtain a redacted copy (from which commercial information and information that is not relevant has been removed) of such Standard Contractual Clauses by sending a request to email@example.com.
5. Your rights as a user of SAP Conversational AI
You can request from SAP at any time information about which Personal Data SAP processes about you and the correction or deletion of such Personal Data. Please note, however, SAP can or will delete your Personal Data only if there is no statutory obligation or prevailing right of SAP to retain it. Kindly note further if you request SAP to delete your Personal Data and the deletion request does not relate to optional data categories (please see Section 2 Data Categories above), you will not be able to continue to use any SAP service that requires SAP’s use of your Personal Data.
You may further request from SAP a copy of the Personal Data that you have provided to SAP. In this case, please contact the email address below and specify the information or processing activities to which your request relates, the format in which you would like this information, and whether the Personal Data is to be sent to you or another recipient. SAP will carefully consider your request and discuss with you how it can best fulfill it.
Furthermore, you can request SAP to restrict your Personal Data from any further processing in any of the following events: (i) you state that the Personal Data SAP has about you is incorrect, however, only for as long as SAP requires to check the accuracy of the relevant Personal Data, (ii) there is no legal basis for SAP processing your Personal Data and you demand that SAP blocks your Personal Data from further processing or (iii) SAP does no longer require your Personal Data but you claim that you require such data in order to claim or exercise legal rights or to defend against third party claims or (iv) in case you object to the processing of your Personal Data by SAP (based on SAP’s legitimate interest as further set out in Section B. below) for as long as it is required to review as to whether SAP has a prevailing interest or legal obligation in processing your Personal Data.
Please direct any such request to firstname.lastname@example.org.
If you take the view that SAP is not processing your Personal Data in accordance with the requirements set out herein or applicable EEA data protection laws, you can at any time lodge a complaint with the data protection authority of the EEA country where you live or with the data protection authority of the country or state where SAP has its registered seat.
6. Usage of SAP Conversational AI by minors
SAP Conversational AI is not directed to users of age below 16 years. If you are younger than 16, you may not register with and use this website and cloud service.
B. Usage of Personal Data based on a statutory permission
1. Providing you with access to SAP Conversational AI
SAP requires your first and last name, email address, and username in order to provide you with access to SAP Conversational AI including support (i.e. to perform the underlying contractual relationship between you and SAP). SAP’s use of your Personal Data is based on the permission in the General Data Protection Regulation to process Personal Data for the purpose of performing contractual obligations with data subjects (Article 6 para. 1 lit. b GDPR).
2. Ensuring compliance
SAP and its products, technologies, and services are subject to the export laws of various countries including, without limitation, those of the European Union and its member states, and of the United States of America. You acknowledge that, pursuant to the applicable export laws, trade sanctions, and embargoes issued by these countries, SAP is required to take measures to prevent entities, organizations, and parties listed on government-issued sanctioned-party lists from accessing certain products, technologies, and services through SAP’s websites or other delivery channels controlled by SAP. This may include (i) automated checks of any user registration data as set out herein and other information a user provides about his or her identity against applicable sanctioned-party lists; (ii) regular repetition of such checks whenever a sanctioned-party list is updated or when a user updates his or her information; (iii) blocking of access to SAP’s services and systems in case of a potential match; and (iv) contacting a user to confirm his or her identity in case of a potential match. Any such use of your Personal Data is based on the permission in the General Data Protection Regulation to process Personal Data in order to comply with statutory obligations (Article 6 para. 1 lit. c GDPR).
3. Legitimate interest
a. Creating anonymous data sets
SAP intends to anonymize Personal Data provided under this Privacy Statement to create anonymized data sets, which will then be used to improve its and its affiliates’ products and services. Any usage of your Personal Data for this purpose is based on SAP’s legitimate interest to create state of the art products and services (Article 6 para. 1 lit. f GDPR).
b. Sending SAP Conversational AI-related newsletters
SAP will use your name and your email address in order to send you informational emails to keep you up-to date regarding SAP Conversational AI -related topics.
You can at any time object against SAP’s use of your Personal Data for this purpose by sending an email to email@example.com. In this case, SAP will carefully review any such objection and cease further use of the relevant information, unless SAP can claim compelling legitimate grounds for the use of the information, which override your interest in objecting or if SAP requires the information for the establishment, exercise or defense of legal claims.”
C. Usage of Personal Data based on a consent
1. Public profile
Based on your consent, SAP would like to use your user first and last name and your proﬁle avatar image to create a profile of you which is accessible to other users of SAP Conversational AI.
SAP Conversational AI uses session cookies which are intended to identify your device by way of a session ID while you are using SAP Conversational AI. This session ID will be used by SAP to avoid that you have to repeatedly enter your username.
3. Withdrawal of consents
You may withdraw each of your consents for SAP to process your Personal Data as stated herein at any time. Once you assert this right, SAP will not process your Personal Data any longer unless legally required to do so. However, any withdrawal has no effect on past processing by SAP up to the point in time of your withdrawal. Please direct any such request to firstname.lastname@example.org.