BLUNPRIVACY

Here we explain which personal data we process when you use blun.eu and the services of BLUN, why we do so, on what legal basis and which rights you have. For cookies and comparable access to your device, the section applies in addition Cookie consent.

1. Controller and contact

The controller for the processing activities described here is BLUN GmbH, DC Tower 1, Donau-City-Straße 7, 1220 Wien. For data protection enquiries you can reach us via the Contact form or by email to dpo@blun.ai.

Data protection officer: not mandatory under Art. 37 GDPR, enquiries to dpo@blun.ai.

If we process business content on behalf of a business customer, that customer may be the controller and BLUN the processor. In this case, the customer's privacy notice and the data processing agreement concluded with the customer additionally apply. BLUN is not automatically the processor for all operations.

2. Data, purposes and legal bases

Our legitimate interests are secure operation, protection against abuse and fraud as well as the handling of non-contractual enquiries. We limit processing to what is necessary for this and take your rights into account, especially those of minors.

3. Origin of the data

We generally process data from your details and your use. If you choose to sign in with Google, we receive the details you have released there. From the payment service provider we receive the payment status and the details required for invoicing.

4. Sensitive data and data of other persons

Chats may contain health data, political opinions or other specially protected information. Only enter such data and data of other persons if this is necessary and lawful. The general contractual basis under Art. 6 GDPR does not replace an additionally required exception under Art. 9 GDPR. Further requirements under Art. 10 GDPR apply to data on criminal convictions and offences.

For business customers, the customer as controller determines the legal basis for such data.

5. Recipients

Only authorized persons and service providers receive access, to the extent required for their tasks. The following recipients are involved in the processing:

Authorities, courts or legal and tax advisers may receive data to the extent required by law or necessary on an appropriate basis for legal defense. There is no blanket transfer of all chats. We do not hide recipients behind a general label such as “AI technology”.

6. Transfers to third countries

Hosting in the EU does not automatically mean that all processing takes place exclusively in the EU. With individual service providers, processing or access may take place outside the European Economic Area.

Data may be transferred to the USA during Google sign-in, payment processing and web search. If the recipient is not certified under the EU-US Data Privacy Framework (DPF), the transfer is based on standard contractual clauses pursuant to Art. 46 GDPR.

You can obtain information about the respective safeguards and a copy or an accessible reference from our data protection contact.

7. Storage duration and deletion

We store personal data only as long as it is necessary for the respective purpose or required by law. The periods depend on the data category and system:

We limit retention for the enforcement or defense of specific claims to the data necessary for that purpose. The statutory retention of invoices does not justify blanket retention of chats and files.

8. AI processing, security and training

We process your content to perform the AI function you requested. Inputs may be checked for technical processing and for the necessary prevention of misuse.

Without your separate express consent, your content is not used to train or fine-tune models. Memory is separate from this: consent to memory is not consent to training. Optional feedback explains whether content is transmitted in the process and what purpose it serves.

We do not make any decisions based solely on automated processing that produce legal effects concerning you or significantly affect you.

9. Your rights

Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you can object on grounds relating to your particular situation; you can object to direct marketing at any time. You can revoke consents at any time with effect for the future; the lawfulness of processing until the revocation remains unaffected.

Export and deletion functions are available in your account where they are offered there; independently of this, you can contact our data protection contact at any time. We generally process requests within one month. If we extend the period for complex or numerous requests within the legally permitted framework, we inform you within that period, stating the reasons. We only verify your identity to the extent that this is necessary and proportionate.

You can lodge a complaint with the Austrian data protection authority (www.dsb.gv.at) or with another competent supervisory authority, in particular at the place of your habitual residence, your place of work or of the alleged infringement.

10. Mandatory details, voluntary details and changes

The information marked as required in the respective form is necessary for the account and for contract performance. Without it we may not be able to provide the service in question. Optional information and memory are voluntary; if you decline them, the basic service does not end as a result.

We inform you in a comprehensible manner about material changes to this information. A changed privacy notice is not a new consent. If we need your consent for a new purpose, we obtain it separately before processing.

11. Connecting Google services

You can voluntarily connect your account to Google services, currently Google Drive; other services such as Gmail or Google Calendar only if you explicitly connect them. We only request the access that the selected feature needs: for Google Drive, access to the files you open or create in BLUN; for Gmail, reading your messages. We use this data exclusively to perform the feature you requested in the chat, such as reading a file or summarizing an email. We store it only as long as necessary for that purpose, do not use it for advertising, and do not use it to train models without your separate explicit consent; we do not pass it on to third parties unless this is necessary to provide the feature or required by law. We store access keys encrypted on our servers. You can disconnect the connection at any time in your account or in the security settings of your Google account; we will then revoke the access at Google and delete the access keys.

Our use of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.