Our website features an automated artificial intelligence (AI) digital assistant that answers your questions based solely on the content of the Kiriweb website. You are chatting with an automated system, not a human; this is also indicated in the chat window itself.

Who processes the data. The controller is Kiriweb (contact via the contact form). The assistant was developed and is operated by Kiriweb.

What data we process. Only the text of the messages you type in the chat and technical data necessary for its operation (e.g. your IP address at the time of the request, which is not stored in the conversation history). The assistant does not use cookies or any other persistent storage on your device; the conversation is not linked to your identity and is lost when you close the page. Please do not enter sensitive personal data in the chat.

Purpose and legal basis. The purpose is to serve you promptly with answers about the website and our services. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in providing effective service; using the assistant is optional and is activated only when you send a message.

Where and for how long. All data is hosted on servers within the European Union (Hetzner Online GmbH, Germany). To generate answers, the message text is processed within the EU by an AI language model provider (Mistral AI, France) under a data processing agreement (Article 28 GDPR); it is not used to train models and is retained by the provider only for a short period (up to ~30 days) solely to prevent abuse, and is then deleted. Conversations are stored on our server for up to 7 days and are then deleted automatically. Any limited transfers outside the EEA are covered by the EU Standard Contractual Clauses (SCCs) (Article 46 GDPR).

Automated processing. The assistant generates answers automatically, but does not make decisions with legal or similarly significant effects on you within the meaning of Article 22 GDPR.

Your rights. You have the rights set out in Articles 15–22 GDPR (access, rectification, erasure, restriction, objection). Because conversations are not linked to identity data, we may need additional information from you to locate a specific conversation (Article 11 GDPR). Contact: via the contact form. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, 1-3 Kifisias Ave., 115 23 Athens).