DeutschEnglish
Privacy information for the VITA AI assistant
This notice covers the VITA chat assistant on www.amz-gmbh.at only. The rest of the website is covered by the AMZ privacy policy.
1. Controller
The controller is Arbeitsmedizinisches Zentrum für Industrie, Handel und Gewerbe GmbH, registered seat Börseplatz 3/1B, 1010 Wien, Austria (Handelsgericht Wien, FN 217582 z, VAT ID ATU53732402); operational site Zeppelinstraße 7, 2401 Fischamend. Phone +43 2232 78 333, email office@amz-gmbh.at. The assistant is operated on AMZ’s behalf by MYG Media SRL as processor under an Art. 28 GDPR agreement.
2. You are talking to an AI system
VITA is an AI assistant, not a person. It says so at the start of every conversation and a permanent notice sits in the header of the chat window, as required by Art. 50 of Regulation (EU) 2024/1689 (the AI Act).
VITA makes no decisions about you. It answers questions about our services and takes enquiries; quotes, appointments and engagements are decided by AMZ staff. There is no automated decision-making within the meaning of Art. 22 GDPR.
AI systems can be wrong. Binding information comes from our team. You can ask to speak to a person at any time and the assistant will give you our direct contact details.
If you ask to speak to someone, a member of AMZ staff can take over the conversation in the chat window. They can see the conversation so far. When someone takes over you are told so in the chat, and their message is labelled as coming from the AMZ team, so you always know whether a human or the AI is replying.
3. What is processed
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Your chat messages and the assistant’s replies | Answering your enquiry, quality assurance | Art. 6(1)(f) GDPR (legitimate interest in a working first line of contact) | 30 days, then deleted automatically |
| Details of your enquiry that you provide (name, company, phone, email, company size, requested service, location) | Handling your enquiry and getting back to you | Art. 6(1)(f), and Art. 6(1)(b) where a contract may follow | name, company, phone, email and company size as for an email enquiry; the free-text note, the requested service and the location are removed after 30 days |
| Technical usage data (time, coarse device category, language, page, response times) | Operation, abuse prevention, usage statistics for the AMZ team | Art. 6(1)(f) GDPR | kept indefinitely as statistics, without conversation text. If you submitted an enquiry, the record stays linked to it and is kept together with it |
| IP address | rate limiting only | Art. 6(1)(f) GDPR | the assistant does not store your IP address. Only a keyed hash of it is used, from which the address cannot be recovered, and it is deleted within 24 hours at the latest. The hosting provider keeps, as any web server does, technical access logs containing IP addresses; these are deleted after 30 days at the latest |
For resilience, a daily backup of the database is kept and deleted automatically after seven days at the latest. Deleted content can therefore persist in a backup for at most seven further days.
Health data
VITA does notask for health data and is not intended for it. It makes no diagnoses and assesses no-one’s fitness for work. Please do not share symptoms, diagnoses, medication or sick-leave details in the chat. If you do, that information is not carried into the enquiry sent to the AMZ team and is deleted with the transcript after 30 days. For medical matters, please contact our doctors directly.
4. No cookies
The assistant sets no cookiesand uses no tracking. Your conversation and your language choice are held in your browser’s sessionStorage so they survive moving between pages, and nothing is written until you open the chat and start a conversation; that storage is cleared when you close the tab and never leaves your device.
5. Recipients and international transfers
| Provider | Role | Location | Transfer basis |
|---|---|---|---|
| MYG Media SRL, Romania | Operation and maintenance | EU | Art. 28 GDPR processing agreement |
| Anthropic | Language model generating the replies | USA | Standard Contractual Clauses, Art. 46(2)(c) GDPR |
| Railway (Railway Corporation, USA) | Hosting of the assistant and its database | EU (europe-west4, Netherlands) | Art. 28 GDPR processing agreement; for any access from the USA: EU-US Data Privacy Framework certification (Art. 45 GDPR) and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Delivering enquiry emails to the AMZ team | USA (data storage), sending via EU infrastructure (Ireland) | EU-US Data Privacy Framework certification (Art. 45 GDPR); additionally Standard Contractual Clauses, Art. 46(2)(c) GDPR |
Your messages are sent to the language model to generate a reply. They are not used to trainmodels and are deleted there within 30 days at the latest; they are kept longer only where the law requires it or Anthropic’s safety systems flag abuse. Resend stores the enquiry emails it delivers, including delivery logs, for 30 days. No other disclosure takes place unless we are legally required to make it.
6. Your rights
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection to processing based on legitimate interests (Art. 21).
For anything concerning a specific chat, email office@amz-gmbh.at. Telling us roughly when the conversation took place, and the phone number or email you gave in the chat, lets us find it. We then delete it without undue delay.
You may also complain to a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna.