Privacy Policy – AI

for ROAMSYS ChatGPT Plugin

1. Introduction

This Privacy Policy describes how ROAMSYS S.A. processes personal data when you use the ROAMSYS ChatGPT Plugin with compatible AI applications.
This Privacy Policy applies exclusively to the ChatGPT Plugin and supplements the general ROAMSYS Privacy Policy available at:
https://roamsys.com/data-protection/
The protection of personal data is important to us. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and all applicable data protection laws.

1.1. Definitions

For the purposes of this Privacy Policy:
• Customer means the legal entity subscribing to the ChatGPT Plugin.
• User means an individual authorised by the customer to use the ChatGPT Plugin.

2. Data Controller and Data Protection Officer

For personal data processed through the ChatGPT Plugin in connection with the Customer’s use of ROAMSYS products and connected AI applications, the Customer acts as the data controller. ROAMSYS S.A. acts as a processor on behalf of the Customer when providing and operating the ROAMSYS ChatGPT Plugin in accordance with the applicable data processing agreement.
For any questions regarding the processing of personal data through the ChatGPT Plugin, users may contact:

ROAMSYS S.A.
13, Fausermillen
6689 Mertert
Luxembourg
Email: info@roamsys.com
Website: https://roamsys.com

Data Protection Officer
DURY Consult GmbH
Obertorstraße 1
66111 Saarbrücken
Germany
Email: dsb@dury-consult.com

3. Purpose of the ChatGPT Plugin

The ROAMSYS ChatGPT Plugin enables authenticated users to access information from their ROAMSYS environment through compatible AI applications using natural language.
The ChatGPT Plugin allows users to retrieve information and create outputs such as reports, summaries, dashboards, exports or other user-requested content.
The ChatGPT Plugin enables authenticated users to securely interact with supported ROAMSYS products through compatible AI applications. Depending on the functionality available within the ROAMSYS ChatGPT Plugin and the permissions assigned to the authenticated user, interactions may include retrieving information, generating outputs or performing other authorised operations.
Where enabled by the Customer, the ChatGPT Plugin may facilitate the transfer of information from supported ROAMSYS products to compatible third-party AI applications selected by the Customer in order to generate user-requested outputs.

4. Categories of Personal Data Processed

Depending on the configuration of the ChatGPT Plugin, one or more of the following categories of personal data may be processed:

User identifier
Authentication identifier
Name
Email address
Session identifier
IP address
Date and time of requests
Tool requests
Personal data contained in authorised ROAMSYS records requested by the authenticated user
Diagnostic information
Error logs
Audit logs

5. ROAMSYS Data Access

The ChatGPT Plugin retrieves information only from ROAMSYS products that are licensed by the customer and available to the authenticated user.
Depending on the customer’s subscription and user permissions, information may be retrieved from:

IREG Toolbox
Networks
SIM Cards

The ChatGPT Plugin provides access only to supported ROAMSYS products licensed by the customer. Supported ROAMSYS products are determined by the customer’s subscription and the capabilities of the ChatGPT Plugin. Where supported by future versions of the ChatGPT Plugin and enabled by the customer, authorised users may also create, update or delete information within supported ROAMSYS products, subject to their existing ROAMSYS permissions.
The ChatGPT Plugin never grants access to information beyond the permissions already assigned within the ROAMSYS platform.

6. User Permissions

The ChatGPT Plugin fully respects the existing ROAMSYS permission model.
Users may access information and perform only those actions for which they have been granted permission within the ROAMSYS platform. The ChatGPT Plugin does not elevate privileges, bypass access controls or expose information outside the authenticated user’s existing authorisation.

7. Authentication

Authentication is performed using OAuth 2.1 (based on OAuth 2.0) with Proof Key for Code Exchange (PKCE). The required authentication values are configured within the compatible AI application. The user is then redirected to the ROAMSYS login page and authenticates using their existing ROAMSYS credentials. Following successful authentication, the ChatGPT Plugin may access ROAMSYS data on behalf of the authenticated user in accordance with the user’s assigned permissions. Users may be required to authenticate again following major ROAMSYS software updates or when user permissions have changed.
OpenID Connect (OIDC) is not used.

8. Legal Basis for Processing

Personal data is processed on one or more of the following legal bases:

Article 6(1)(b) GDPR (performance of a contract)
Article 6(1)(f) GDPR (legitimate interests)

The legitimate interests include:

providing the ChatGPT Plugin service
authenticating users
protecting the security of the ROAMSYS platform
preventing misuse
maintaining system integrity
troubleshooting technical issues

9. Logging and Retention

The ChatGPT Plugin may generate technical logs necessary for operating and securing the service.
Examples include:

authentication logs
audit logs
access logs
error logs
diagnostic logs

Audit logs may record authorised user activities performed through the ChatGPT Plugin.
Retention periods:

Authentication/access logs are retained 21 days.
Audit logs and other records required to demonstrate authorised user activities, maintain system integrity, investigate security incidents, resolve disputes, fulfil legal obligations or establish, exercise or defend legal claims may be retained for a longer period, including permanently where required for these purposes.

10. Data Sharing

ROAMSYS does not sell personal data. Personal data is processed solely for providing the ChatGPT Plugin functionality requested by the user.
Personal data may be exchanged where necessary to execute authorised operations requested by the authenticated user.
Where the Customer connects compatible third-party AI applications to the ChatGPT Plugin, personal data contained in user requests or retrieved ROAMSYS records may be transmitted to such AI applications for processing. The Customer is responsible for the selection and use of such AI applications and for ensuring compliance with applicable data protection, regulatory and compliance requirements.
ROAMSYS does not share customer data with unrelated third parties.

11. International Data Transfers

The geographical location where personal data is processed depends on the compatible AI application selected by the customer.
If an AI platform processes data outside the European Union or the European Economic Area, personal data may be transferred internationally.

12. Infrastructure

Hosting Provider: Conostix
Hosting Location: Luxemburg

13. Security Measures

ROAMSYS implements appropriate technical and organisational measures to protect personal data.
ROAMSYS implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures may include:

TLS encrypted communications
Secure authentication
Role-based access control
Audit logging
Encryption of stored data
Access control mechanisms
Network monitoring
Regular software updates
Vulnerability management

14. Automated Decision-Making

The ChatGPT Plugin does not perform automated decision-making or profiling within the meaning of Article 22 GDPR.
The ChatGPT Plugin performs only those operations explicitly requested by the authenticated user. Reports, dashboards, exports, emails and other generated content are created solely at the request of the authenticated user.

15. Your Rights

Under the GDPR, you have the following rights:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object
Right to withdraw consent where applicable
Right to lodge a complaint with a supervisory authority

For personal data processed through the ChatGPT Plugin on behalf of a Customer, requests relating to data subject rights under the GDPR should be directed to the relevant Customer acting as data controller.
ROAMSYS will assist the Customer in responding to such requests where required by applicable law or the applicable data processing agreement.

16. Contact

If you have any questions regarding this Privacy Policy or the processing of personal data, please contact:
ROAMSYS S.A.
Email: info@roamsys.com

Data Protection Officer
Email: dsb@dury-consult.com

17. Changes to this Privacy Policy

ROAMSYS may update this Privacy Policy from time to time to reflect legal, technical or operational changes.
The current version of this Privacy Policy will be made available through the ROAMSYS website or together with the ChatGPT Plugin documentation.