Privacy Policy for WhatsApp Conversations with an AI Assistant

Last updated: May 23, 2024

This Privacy Policy describes how RENT A ROOM COPENHAGEN processes your personal data when you contact us via the WhatsApp messenger to interact with our artificial intelligence (AI) based Assistant.

1. Data Controller

The controller of your personal data is:
RENT A ROOM COPENHAGEN
Nørrebrogade 51, 2200 København N, Denmark
CVR (SE) NO: 12058497
(hereinafter referred to as the "Controller" or "we").

For matters related to the processing of your personal data, you can contact us via email at: info@rooms-dk.dk

2. What data do we process?

As part of your WhatsApp conversation with our AI Assistant, we process the following categories of data:

• WhatsApp identification data: Your phone number, profile name, and profile picture (if public).
• Conversation content: All information you voluntarily provide in your messages, including but not limited to your name, email address, rental preferences (location, budget, dates), and any other personal data contained in the conversation.
• Metadata: Dates and times of the messages sent.
• Data generated by the AI system: Analyses and summaries of the conversation created by our Assistant to understand your query.

3. Purpose and Legal Basis for Data Processing

We process your personal data for the following purposes:

a) Handling your query and providing services (conversation with the AI Assistant).

• Purpose: To answer your questions regarding our rental offers, room availability, and rental conditions.
• Legal basis: Art. 6(1)(b) of the GDPR – processing is necessary to take steps at the request of the data subject prior to entering into a contract (e.g., a rental agreement).

b) Analyzing and improving our services.

• Purpose: We store the content of the conversations in our database for analysis. This helps us improve the performance of our AI Assistant, understand customer needs, analyze market trends, and enhance the overall quality of our service.
• Legal basis: Art. 6(1)(f) of the GDPR – our legitimate interest in optimizing our services and business processes. We ensure that our interest does not override your rights and freedoms.

c) Fulfilling legal obligations.

• Purpose: To comply with obligations arising from legal regulations, e.g., at the request of authorized authorities.
• Legal basis: Art. 6(1)(c) of the GDPR – processing is necessary for compliance with a legal obligation to which the Controller is subject.

4. Data Recipients

Your personal data may be transferred to the following entities (data processors), with whom we have signed appropriate data processing agreements:

• Meta Platforms, Inc. (owner of WhatsApp): By using WhatsApp, you agree to its privacy policy. Your data is processed by Meta to provide the communication service. This may involve the transfer of data outside the European Economic Area (EEA). For more information, please see the WhatsApp Privacy Policy.
• AI Assistant Service Provider: Google (as part of services such as Google Cloud AI). The content of your conversation is transferred to Google to process natural language and generate a response. This processing may involve the transfer of data outside the European Economic Area (EEA) based on Standard Contractual Clauses (SCCs) that ensure an adequate level of data protection.
• Technical Partner: Euforia s.c. (Sienkiewicza 25, 44-240 Żory, Poland, NIP: 6511693591), the company responsible for the technical support and maintenance of the system, which has access to the data to ensure its proper functioning.
• Hosting Service Provider: HitMe.pl - Marek Bajerski (Wiczlińska 34, 81-578 Gdynia, Poland, NIP: 8792487067), which provides the server infrastructure for storing the conversation database.
• Authorized employees and associates of the Controller who require access to the data to perform their duties.
• Public authorities, if required by law.

5. Data Retention Period

We store your personal data for the period necessary to achieve the purposes for which it was collected:

• Data processed to handle your query (purpose 3a) – for the duration of the conversation and for the period necessary to potentially conclude a contract, as well as for the statute of limitations for any potential claims.
• Data processed based on our legitimate interest (purpose 3b) – for the time necessary to conduct analysis and improve our services, or until you effectively object. Where possible, data used for analytical purposes will be anonymized.

6. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to erasure ('right to be forgotten') (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your data based on our legitimate interest (i.e., for analytical purposes).

To exercise these rights, please contact us at the email address provided in section 1.

You also have the right to lodge a complaint with a supervisory authority, which in Denmark is the Datatilsynet (www.datatilsynet.dk).

7. Automated Decision-Making

Our AI Assistant processes your queries in an automated manner to provide a response. However, this does not lead to automated decision-making that would produce legal effects concerning you or similarly significantly affect you. Final decisions, such as entering into a rental agreement, are always made by a human.

8. Changes to the Privacy Policy

We reserve the right to make changes to this Privacy Policy. Any changes will be published on our website, and the date of the last update will be visible at the top of the document.