Scope
This section applies specifically to the P3 AI Assistant, a chat-based artificial-intelligence tool available on our website.
The Assistant answers questions about P3, its services, products and insights.
This section supplements the other provisions of this Privacy Policy. Where this section does not contain specific information, the general provisions of this Privacy Policy apply.

Controller and Data Protection Officer
The controller and data protection officer responsible for processing personal data in connection with the P3 AI Assistant are identified in section 3 of this Privacy Policy.

Interaction with an artificial-intelligence system
When using the P3 AI Assistant, you are interacting with an artificial-intelligence system.
Responses are generated automatically by an AI language model and not by a human representative of P3.
The Assistant generates responses based on statistical and probabilistic patterns. Responses may therefore be inaccurate, incomplete, outdated or misleading.
The Assistant does not provide legal, financial, technical or other professional advice.
Business-critical information should always be independently verified through official P3 channels.

Data processed when using the Assistant
When you use the P3 AI Assistant, we may process the following categories of data.

Chat content
We process:

• messages and questions entered into the Assistant;
• responses generated by the Assistant; and
• information voluntarily included in messages.

Please do not enter personal data unless it is necessary for your request.
In particular, you must not enter:

• special categories of personal data within the meaning of Art. 9 GDPR;
• health, biometric or genetic data;
• information concerning racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• information concerning a person’s sex life or sexual orientation;
• personal data relating to criminal convictions or offences;
• personal data of third parties without an appropriate legal basis;
• passwords, credentials or authentication information;
• confidential, proprietary or commercially sensitive information; or
• information protected by professional, contractual or statutory confidentiality obligations.

Users are responsible for the information they submit through the Assistant and must ensure that they are authorised and have an appropriate legal basis to disclose any personal data or other information provided.
A corresponding notice is displayed in the Assistant’s interface.

Session data
To maintain a coherent conversation during the session, we may process:

• a randomly generated session identifier;
• message timestamps;
• conversation history for the duration of the session; and
• information concerning the current state of the Assistant interface.

Technical connection and security data
Technical data automatically transmitted by your browser may include:

• IP address;
• date and time of the request;
• browser type and version;
• operating system;
• requested resource;
• referrer information, where transmitted;
• error messages;
• security events; and
• similar server-log information.

This information is processed to deliver the Assistant, maintain stability, identify errors, protect the service against cyberattacks and prevent misuse.

Purposes of processing
We process personal data in connection with the Assistant to:

• provide and operate the Assistant;
• generate responses to users’ questions;
• maintain conversation context;
• process requests concerning P3, its services, products and insights;
• ensure functionality, availability and security;
• identify and resolve technical problems;
• prevent, detect and investigate misuse, unlawful use and cyberattacks;
• comply with statutory obligations; and
• establish, exercise or defend legal claims.

We do not use the Assistant’s chat content for advertising purposes or to create advertising or marketing profiles.

Cookies and session storage
The P3 AI Assistant does not set advertising or analytics cookies and does not use browser local storage for tracking purposes.
The Assistant uses a session-storage entry to store information required for the current session, including:

• interface settings;
• a session identifier;
• the current conversation; and
• the open or closed status of interface elements.

The information remains on your device and is deleted when you close the relevant browser tab or window.

Fonts
All fonts used within the P3 AI Assistant are hosted locally on P3-controlled infrastructure or infrastructure operated on behalf of P3.
No connection to Google Fonts or another external font provider is established for font delivery.
No personal data, including an IP address, is transmitted to an external font provider for this purpose.

AI processing
Messages entered into the Assistant are transmitted to P3’s backend infrastructure and processed by an AI language model to generate a response.
The AI service used is Microsoft Azure OpenAI Service.
The service is provided within Microsoft’s Azure environment and does not interact with consumer services operated by OpenAI, such as ChatGPT or the OpenAI API.
The relevant contractual provider within the European Union is Microsoft Ireland Operations Limited.
Microsoft processes the relevant data on our behalf and in accordance with our instructions, the applicable contractual documentation and the Microsoft Products and Services Data Protection Addendum pursuant to Art. 28 GDPR.

Processing location
The P3 AI Assistant’s hosting infrastructure is operated in the Microsoft Azure West Europe region.
The Azure OpenAI model used by the Assistant is deployed in the Sweden Central region as a regional, non-global deployment within the European data zone.
Based on the currently implemented technical configuration, the principal hosting and AI-processing activities take place within the European Union or European Economic Area.

Use of data for model training
Prompts, messages, generated responses and embeddings processed through Azure OpenAI are not made available to other Microsoft customers.
They are not made available to OpenAI and are not used to operate or improve consumer services such as ChatGPT.
Prompts, generated responses, embeddings and other customer data are not used by Microsoft or OpenAI to train or improve generative-AI foundation models without P3’s explicit permission or instruction.

Security and abuse monitoring
Microsoft uses technical and organisational mechanisms to detect and prevent misuse of Azure OpenAI.
Prompts and generated responses may be subject to automated content-classification and abuse-monitoring procedures.
Content identified as potentially harmful or as part of a potentially abusive pattern may be subject to additional automated review.
In certain cases, where automated review does not provide sufficient confidence or automated systems are unavailable, authorised Microsoft personnel may conduct a human review to assess potential misuse.
Any processing by Microsoft for abuse-monitoring purposes is governed by the applicable Microsoft contractual terms, data-protection documentation and technical configuration of the Azure service.

Access by P3 personnel
P3 does not routinely review individual conversations submitted through the Assistant.
Access to server-side conversation records is restricted to authorised personnel and may take place only where necessary for:

• technical support or troubleshooting;
• system maintenance;
• information-security purposes;
• investigation of suspected misuse;
• compliance with statutory obligations; or
• the establishment, exercise or defence of legal claims.

Appropriate access restrictions and confidentiality obligations apply.

Legal bases
Provision of the Assistant
The legal basis for the processing of your personal data in connection with your use of the chatbot is your explicit consent, in accordance with Article 6(1)(a) of the GDPR. You may revoke this consent at any time, effective for the future, without providing a reason.
Where a request is directly related to the initiation or performance of a contract with P3, processing may additionally be based on Art. 6(1)(b) GDPR.

Security, stability and prevention of misuse
Processing required to maintain the Assistant’s security, technical stability and availability and to prevent, detect and investigate misuse is based on Art. 6(1)(f) GDPR.
Our legitimate interests include:

• protecting our website and IT infrastructure;
• preventing cyberattacks and unlawful use;
• maintaining service availability;
• identifying and resolving technical errors; and
• protecting P3, its employees, customers, suppliers and website visitors.

Compliance with legal obligations
Where processing is necessary to comply with a statutory obligation, the legal basis is Art. 6(1)(c) GDPR.

Legal claims
Where processing is necessary to establish, exercise or defend legal claims, it is based on Art. 6(1)(f) GDPR.
Our legitimate interest is the effective assertion and defence of legal rights.

No profiling or automated decision-making
The P3 AI Assistant is not used to evaluate, score, rank or classify individual users.
It is not used to create behavioural, advertising or personality profiles.
Information entered into the Assistant is not used to assess a person’s professional performance, creditworthiness, health, reliability or eligibility for services.
The Assistant does not make decisions that produce legal effects concerning users or similarly significantly affect them within the meaning of Art. 22 GDPR.

Retention periods
Personal data processed in connection with the Assistant is retained as follows:

• Browser session storage: Deleted when the relevant browser tab or window is closed.
• P3 conversation and session records: Stored for seven days and then deleted, unless continued storage is required because of a security incident, legal obligation or legal claim.
• Server log data: Stored for seven days and then deleted or anonymised, unless continued storage is required for security, statutory or evidentiary purposes.
• Security and incident records: May be retained until the investigation has been completed and applicable statutory retention or limitation periods have expired.
• Azure OpenAI processing: Any temporary processing or retention by Microsoft for abuse-monitoring purposes is governed by the applicable Microsoft contractual terms, service documentation and technical configuration.

Where continued retention is required by law or for legal claims, the relevant data will be restricted from ordinary use and deleted when the applicable requirement or purpose no longer applies.

Recipients and processors
Personal data processed through the Assistant may be disclosed to:

• authorised P3 personnel responsible for operating, securing or maintaining the Assistant;
• Microsoft Ireland Operations Limited;
• other Microsoft group entities involved in providing Microsoft Azure under the applicable contractual arrangements;
• IT service providers supporting operation, maintenance or security;
• professional advisers and auditors; and
• courts or public authorities where disclosure is legally required.

The principal providers are:

• Hosting: Microsoft Azure, West Europe region.
• AI processing: Microsoft Azure OpenAI Service, Sweden Central region within the European data zone.

Service providers process personal data on our behalf and are contractually bound in accordance with Art. 28 GDPR, where applicable.
P3 does not sell data collected through the Assistant or disclose chat content to third parties for their own advertising or marketing purposes.

International data transfers
The Assistant’s hosting infrastructure is currently located in the European Union, and the Azure OpenAI model is deployed in Sweden Central within the European data zone.
Based on the currently implemented configuration, the principal hosting and AI-processing activities take place within the European Union or European Economic Area.
If personal data is transferred outside the European Union or European Economic Area, the transfer will take place only where the requirements of Arts. 44 et seq. GDPR are met.
Appropriate safeguards may include:

• an adequacy decision issued by the European Commission;
• the European Commission’s Standard Contractual Clauses;
• binding corporate rules; or
• another legally recognised transfer mechanism.

Where required, supplementary technical, organisational or contractual safeguards will be implemented.

Data-subject rights
Users have the rights described in section 3 of this Privacy Policy, including, where the statutory requirements are met, the rights to:

• access;
• rectification;
• deletion;
• restriction of processing;
• data portability;
• objection; and
• lodge a complaint with a competent supervisory authority.

Because the Assistant uses randomly generated session identifiers and users are instructed not to enter identifying personal data, P3 may not always be able to associate a chat session with an individual.
Where P3 cannot identify the requesting individual from the available information, additional information may be required to locate the relevant data.
Requests may be directed to the controller or data protection officer using the contact details in section 3.

Right to object
Where processing is based on Art. 6(1)(f) GDPR, users may object at any time on grounds relating to their particular situation pursuant to Art. 21 GDPR.
Following an objection, P3 will no longer process the relevant personal data unless P3 demonstrates compelling legitimate grounds that override the user’s interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

AI transparency and responsible use
The P3 AI Assistant is an artificial-intelligence system.
Users are informed before or at the beginning of the interaction that they are communicating with an AI system.
All responses are generated automatically and may be inaccurate, incomplete or outdated.
Users should not rely exclusively on the Assistant for legal, financial, safety-related or other decisions with significant consequences.
Business-critical information should be independently verified through the official P3 website or by contacting the relevant P3 representative.