LISA Website Widget
This privacy policy explains how your dealership processes your personal data (hereinafter "data") when you chat with LISA, the dealership's AI assistant, on its website, book an appointment or send a request. For all other data protection questions concerning your dealership, the dealership's own privacy policy applies, which you can find on its website.
Controller
The controller is the dealership on whose website you use LISA (hereinafter "dealership"). You can find the dealership's name, address and contact details in the legal notice and privacy policy on its website.
For what purposes do we use your data?
Your data is used in the course of your conversation with the AI assistant LISA in the dealership's website chat. This covers several use cases:
Providing information
You can ask LISA about models, prices or services available at the dealership. LISA answers based on the information the dealership has released for its website. The chat works without signing in.
Appointments and requests
You can ask for available appointments and book them, or send the dealership a general request. To do so, you enter your name and your mobile number, which you confirm with a code sent by text message. After booking, you receive a confirmation by text message.
Sign-in by text message
Optionally, you can sign in with your mobile number and a code sent by text message, so you don't have to confirm your number again for every booking. If your number is on file with the dealership as a customer, LISA receives only your first and last name in the chat. You can sign out at any time.
Data analysis and quality assurance
We analyse the inputs and responses of LISA to improve our AI assistant. In addition, the dealership's staff have access to the chat histories with LISA. The data is used for customer follow-ups and for quality assurance.
Protection against misuse
After you have agreed, the service Cloudflare Turnstile by Cloudflare, Inc. checks whether the request comes from a human. In the process, technical data from your browser and your IP address are transmitted to Cloudflare. To limit misuse (e.g. mass sending of text messages), we process your IP address only in pseudonymised (hashed) form.
What data do we process and where is it stored?
We process the following data:
- Information you exchange with the AI assistant (e.g. questions about cars, appointment requests, your request)
- Name and mobile number, if you book an appointment, send a request or sign in
- Booked appointments and sent requests
- Technical data for protection against misuse (pseudonymised IP address, browser information)
Chat histories, appointments and requests are stored in the dealership's LISA system; appointments and customer data may also be stored in the dealership's customer database (CRM). Details can be found in the dealership's general privacy policy.
What is stored in your browser?
So that you don't have to agree again on every visit, your consent is stored in your browser's local storage for the dealership's website. If you sign in by text message, a technically necessary cookie is set that keeps you signed in for up to 30 days. It becomes invalid when you sign out or when it expires.
On what legal basis do we process your data?
LISA processes your data on the basis of your consent (Art. 6(1)(a) GDPR). You give your consent by clicking "Agree and start" in the widget before the chat begins. You can withdraw your consent at any time with effect for the future, for example by e-mail to: privacy@aicompany.at
We also process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR) when we use it for internal quality assurance and protection against misuse. This helps us operate the service securely and improve it for all customers.
Who receives your data?
Recipient:
VAIC FlexKapG („VAIC“)
Argentinierstraße 23/15
1040 Vienna, Austria
Description:
VAIC provides the AI assistant LISA to the dealership.
VAIC is the dealership's processor and itself uses sub-processors, including Twilio Inc. for sending text messages and Cloudflare, Inc. for protection against misuse. The dealership has concluded a data processing agreement with VAIC, and VAIC has in turn concluded sub-processing agreements with its sub-processors.
Is your data transferred to third countries?
Some sub-processors are based outside the European Union. Personal data may therefore be transferred to recipients in third countries (outside the EU/EEA). Where there is no adequacy decision of the EU Commission for the respective third country (including the Data Privacy Framework), our processor ensures an adequate level of data protection by concluding EU Standard Contractual Clauses. If you have questions about this or need a copy of the documents, please contact us.
How long is the data stored?
Chat histories, appointments and requests are stored for as long as necessary for the purposes stated and no statutory retention obligations prevent deletion. Text message verification codes are deleted automatically after a short time. Data in the dealership's CRM system is stored in accordance with the dealership's general privacy policy.
What happens if you do not give your consent?
Without your consent, neither the chat nor appointment booking nor the protection against misuse starts. It is an additional service for customers; you can always contact the dealership in other ways. This has no effect on your status as a customer, on your terms or on any other dealings with the dealership.
Does LISA involve automated decision-making or profiling?
No. LISA does not involve automated decision-making or profiling.
What are your rights?
To show you all your options regarding the collection and use of your information and personal data, we would like to point out the rights you have in this context.
Right of access
You can request information about how, by whom, for what purposes and under what conditions your data is collected and used.
Right to rectification
We naturally do not want to pass on incorrect or outdated information, for example to prevent misunderstandings or damage. You can therefore update or correct the information we have collected about you at any time.
Right to restriction of processing
You can also ask us to restrict the use of your data. This means that your data is still stored but may only be used under limited conditions (e.g. to assert legal claims).
Right to object
Where we collect and use your information on the basis of legitimate interests, you have the right to object to its use.
Right to erasure
We delete your data as soon as it is no longer required for the purposes stated here and no retention obligations apply. If you believe there is no legal basis for further storage, you can exercise your right to have your data erased.
Right to data portability
You have the right to data portability for all data you have provided to us. This means we will provide this data to you in a structured, commonly used and machine-readable format.
Consent and withdrawal of consent
If you have given us consent to process your personal data, you can withdraw it at any time. The withdrawal applies to the future; the lawfulness of processing up to the time of withdrawal remains unaffected.
Complaint to the data protection authority
If you believe that we have not respected your rights to the extent required by law, you have the right to lodge a complaint with the competent data protection authority. In Austria, this is the Datenschutzbehörde (Austrian Data Protection Authority).