UU AI Chat Privacy Statement

In this privacy statement, we explain what happens to your personal data when it is processed during your use of the UU AI chat.

Who is responsible for data processing?

Utrecht University is responsible for the processing activities described in this privacy statement.

For what purposes is my personal data processed?

Your personal data is processed to provide you with the UU AI Chat service.

Your personal data is not used to train AI models.

What personal data is processed?

The following data is processed when you use the UU AI Chat:

• Your name,
• Your email address,
• Your SolisID,
• Technical data, such as your IP address and general logging of your use of the service,
• How much you use the service, expressed in tokens,
  • The number of tokens you use reflects how much effort the AI had to expend to answer your questions.
• Everything you enter in the chat, as well as the chat output.
  • What you enter in the chat, as well as the AI’s output, is stored separately and with additional protective measures from the other personal data.

How long is this personal data retained?

All your personal data is retained for as long as you work or study at UU. You can choose to delete your own data at any time.

Is my data shared with third parties?

As part of this service, your data is processed by Microsoft. Depending on the model you choose, your data may also be processed by SURF.

Is my data transferred to third countries?

No, no data is transferred to third countries outside the European Economic Area.

What is the legal basis for this data processing?

Utrecht University’s legitimate interest is to make this service available to its employees and students, educational, research and business purposes. For Utrecht University, it is of importance that the AI Chat complies with relevant norms concerning data protection, security and autonomy. The AI Chat is to provide generative AI services for broad demand within the university while providing an alternative to non regulated AI usage withing the university, which generally come with data protection and security risks.

These interests have been weighed against the privacy impact associated with the use of the service. Here we take into account that the processed personal data are limited to what is strictly necessary for the operation of the AI Chat, as well as the the most sensitive personal data has been protected with additional measures. The processed personal data fit with regular use of an AI Chat and are solely processed within the European Economic Area.

Considering the information above, Utrecht University has legitimate interests in offering the AI Chat and the privacy impact for its users remains minimal. The data processed is necessary and proportionate for achieving the interests for Utrecht University. Therefore it can be concluded that the legitimate interest of Utrecht University stands.

What rights do I have under the GDPR, and how can I exercise them?

The GDPR grants you a number of rights regarding your personal data. You have the right to access your data and to have it corrected or deleted. In connection with this processing, you also have the right to temporarily suspend (“restrict”) the processing of your data and the right to object to the processing.

How can I exercise these rights?

If you wish to exercise one or more of the above rights, you can submit a request using the privacy request form. We then have one month to respond to your request. For very complex requests (or if we receive a large number of requests at the same time), we may need more time (up to two additional months). We will notify you of this within that first month.

Is automated decision-making or profiling used?

We do not use automated decision-making. This means that decisions are never made without human intervention. We also do not engage in profiling.

Questions? Complaints?

Do you have any specific questions regarding the information above, or do you have any comments or feedback about this privacy statement? Please feel free to contact us. You can send a message to privacy@uu.nl.

The UU has appointed a Data Protection Officer (DPO). This is an internal advisor and supervisor who may also be of interest to you, specifically if you would like information about our processing of personal data or if you wish to file a complaint regarding this matter. You can contact our DPO at fg@uu.nl.

Please note that you also have the right to file a complaint with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.

Contact Information for Utrecht University

Heidelberglaan 8
3584 CS Utrecht
Tel. (030) 253 35 50

Privacy Statement: Version and Policy Document

This privacy statement was last updated on August 19th, 2026. We may make changes to this privacy statement from time to time.