Privacy Policy

Last updated: 20 June 2025

This privacy policy explains how the UNINOVIS TOMMI platform and its AI agents (including Research Explorers, administrative assistants, and other tools — collectively "the Service"), operated within the UNINOVIS DATA FOR L.I.F.E. project, process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR).

1. Data Controller

Universidad de Málaga (UMA)
UNINOVIS-UMA ICT Team
Avda. de Cervantes, 2 — 29071 Málaga, Spain

For data protection inquiries, contact: dpo@uma.es

2. What Data We Process

Data category	Examples	Legal basis (GDPR)
User queries	Text entered in the chat interface	Art. 6(1)(f) — Legitimate interest (providing the research service)
Audit log	Timestamp, pseudonymised user ID, query text, query classification, model used	Art. 6(1)(c) — Legal obligation (EU AI Act transparency requirements)
Session data	Temporary session identifier for conversation continuity	Art. 6(1)(f) — Legitimate interest (service functionality)
Analytics	Page views, link clicks (via Matomo, cookieless configuration)	Art. 6(1)(f) — Legitimate interest (service improvement)

We do not collect: names, email addresses, passwords, IP addresses (Matomo is configured to anonymise IPs), or any special category data.

3. Third-Party Data Displayed by the Service

Some agents display information about researchers from UNINOVIS partner universities (names, institutional affiliations, publication metadata). This data is sourced from publicly available academic databases (OpenAlex) and manually curated records. Other agents display university agreements, EU funding calls, or other institutional data from curated databases. All such data is processed under Art. 6(1)(f) — legitimate interest in facilitating academic collaboration and research management.

Individuals whose data is displayed by the Service may contact the Data Controller to review, correct, or request removal of their data.

4. External Data Processors

Processor	Purpose	Data shared	Location
Mistral AI (Paris, France)	LLM processing: query classification and AI-generated responses	User query text	EU (France)
Matomo Cloud	Web analytics	Anonymised page view data	EU

Both processors operate within the European Union. No personal data is transferred outside the EU/EEA.

5. Data Retention

Session data: Deleted at the end of the browser session
Audit log: Retained for the duration of the UNINOVIS project (until 31 December 2028), then deleted or anonymised
Analytics data: Retained according to Matomo Cloud's retention policy (default: 24 months)
User queries are not stored beyond the audit log and the active session

6. Your Rights

Under the GDPR, you have the right to:

Access your personal data (Art. 15)
Rectify inaccurate data (Art. 16)
Erase your data ("right to be forgotten") (Art. 17)
Restrict processing (Art. 18)
Object to processing based on legitimate interest (Art. 21)
Data portability (Art. 20)
Lodge a complaint with a supervisory authority — in Spain: Agencia Española de Protección de Datos (AEPD)

To exercise any of these rights, contact the Data Controller at the address above.

7. AI Transparency

In accordance with the EU AI Act (Regulation 2024/1689, Article 50), we inform you that:

This Service uses AI systems (large language models) to classify queries, translate natural language to database queries, and generate responses
Not all responses are AI-generated — many are produced directly from structured databases without AI involvement
Each response displays a reliability cue indicating its source:
- Green — Data sourced directly from the knowledge base (no AI)
- Yellow — AI commentary based on knowledge base data
- Red — Fully AI-generated content
When enabled, a decision trace shows how each query was classified and routed

8. Cookies

This Service uses Matomo Analytics in cookieless mode. No tracking cookies are placed on your device. A temporary session identifier is used for conversation continuity and is not stored persistently.

9. Changes to This Policy

We may update this policy to reflect changes in the Service or legal requirements. The "last updated" date at the top will be revised accordingly.

10. Funding

This Service is part of the UNINOVIS DATA FOR L.I.F.E. project (Grant Agreement 101177239, Call ERASMUS-EDU-2024-EUR-UNIV) managed by the European Education and Culture Executive Agency (EACEA).