Privacy statement | GPT@EC | European Commission

1. Introduction

The European Commission (hereafter "the Commission") is committed to protecting your personal data and respecting your privacy. The Commission collects and further processes personal data pursuant to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

This privacy statement explains the reason for the processing of your personal data within the GPT@EC mobile application, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data.

2. Why and how do we process your personal data?

GPT@EC processes personal data for the following purposes:

Assistant: to answer your questions, the text of your conversation, the model you chose and the sensitivity level you selected are sent to GPT@EC, the Commission's generative AI service, through the Commission's API gateway. Every question carries the whole conversation, because the service keeps nothing between questions. Your questions are sent with the personal GPT@EC token you enter in Settings, so GPT@EC can link them to you; without one, GPT@EC is not used.
Assistant through the Commission's AI gateway (CPNS-AI): with CPNS-AI as the assistant service (chosen by default; you can choose another in Settings), your conversation is sent, with your EU Login session, to CPNS-AI, the Commission's AI gateway. The gateway passes it to the model of the configuration it applies to this application: GPT@EC, inside the Commission, or, for content classified as Publicly Available, a model provided outside the Commission — today Anthropic's, directly or through the Kiro service, or OpenAI's. During the test phase the gateway keeps each conversation, so that the people who run the assistant can review it to measure its performance and quality. It is kept under your EU Login identity, so that you can read and delete your own; those who review it see a pseudonym instead, but the text of a conversation can still identify you. If you continue with CPNS-AI a conversation begun earlier, its earlier messages are sent and kept too.
Other assistant services (optional): only if you choose OpenAI or Anthropic in Settings and enter your own API key, your conversation is sent to that company instead, under your own account and its terms. These services are provided outside the European Union. The application then only allows content classified as Publicly Available.
Assistant tools (optional): the assistant can ask the application for information about your device, which is added to the conversation. In Settings you choose, for each tool, whether it is allowed, asked each time or off. By default the device model, battery level, network status, application version, and language and time zone are allowed; your location, the camera, your photos, files and screenshots are asked each time; the device identifier is off.
Location (optional): your position is read only when you attach it to a question or allow the location tool, and only if you grant the location permission. It is sent to the assistant service as part of the conversation.
Photos and files (optional): you can add a photo, an image, a document or a screenshot to a question, from the + button of the message box or by allowing the camera, gallery, file or screenshot tool. It is kept on your device with the conversation. With CPNS-AI as the assistant service, what you add is sent to the gateway only when the model in use can read it (GPT@EC's models read text files only); otherwise the application says so and sends nothing. Location and camera details (EXIF, GPS) are removed from photos.
Signing in with EU Login (optional): needed only for CPNS-AI and for the Commission tools below; the chat works without it with the other assistant services. You sign in on EU Login's own page in your device's browser, through the sign-in page of OnTheGo that other Commission mobile applications also use. The application receives your name, e-mail address and department, and keeps the session in the device's secure storage. Signing out forgets the session on this device; it does not end your EU Login session.
Commission tools (optional, only when you are signed in): when your question needs it, the assistant can read your own data in Commission systems you already use and, with your confirmation, act on it: your profile and delegations; Be Well activities and your registrations, and the buildings, restaurants and menus (EC Where2Go); your pending items and DG tasks; your flexitime, absences and telework, the requests you approve, your team's calendar and the search for a colleague (SYSPER2); documents to sign or handle (HRS/ARES); your Commission notifications; whether a new payslip is available; your favourite services in OnTheGo; and, if your profile gives you access to them, your BASIS requests and documents and your MyWorkplace tasks. What a tool reads is added to the conversation and sent to the assistant service to answer you, so an answer can contain data about colleagues that you can already see in those systems. These tools work only while GPT@EC or CPNS-AI is the assistant service: they are never offered when you choose OpenAI or Anthropic with your own key. With CPNS-AI, what they read goes to the model the gateway applies, which can be outside the Commission (see above). In Settings you choose, for each tool, whether it is allowed, asked each time or off; by default the tools that can change your data ask each time, and show you what they will do before they do it.
Copies of your Commission data on your device: to answer faster, the application keeps short-lived copies of some of the data the Commission tools read: your SYSPER2 data (presences and flexitime, absences, telework, profile and delegations), your pending-item counts, and your Be Well registrations with the activities they belong to. They are deleted when you sign out or when another person signs in on the application. Your BASIS, MyWorkplace and HRS/ARES data, your notifications, your DG tasks and your payslip are never stored on the device.
Your conversations: kept on your device, so that you can read them again and continue them. Conversations with CPNS-AI are also kept by the gateway (see point 5). You can delete a conversation at any time: deleting it in the application deletes it on the gateway too. Signing out deletes none of them.
Contacting support: the application prepares an e-mail in your own mail application, with your message and your device model, operating system and application version. You review it and send it yourself; the application sends nothing.
Application quality: crash reports through Firebase Crashlytics, and pseudonymous usage statistics through Firebase Analytics — which screens are opened and which features are used (for example, a question sent, on which assistant service and at which sensitivity level, or a Commission tool used, by its group) — to find and fix errors and improve the application. They are counted per installation of the application, by a random identifier: they carry no name, e-mail address or other identifier of yours, and never the text of your conversations, your tokens or keys, or what a tool read.
Application updates: checking for and downloading updates of the application through the Capawesome Cloud live-update service.
Your settings: keeping your language, theme, assistant service and tool choices on your device.

3. On what legal ground(s) do we process your personal data?

We process your personal data on the following legal grounds:

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Union institution or body (Article 5(1)(a) of Regulation (EU) 2018/1725).
Where specific features require it — your location, the assistant's device tools, signing in with EU Login for CPNS-AI and the Commission tools, and the use of OpenAI or Anthropic — processing is based on your explicit consent (Article 5(1)(d) of Regulation (EU) 2018/1725). You may withdraw your consent at any time, in the device settings or in the application's Settings, without affecting the lawfulness of processing based on consent before its withdrawal.

4. What personal data do we collect and further process?

Assistant data: the text of your questions and of the answers, the model and the sensitivity level, and the information the tools you allowed looked up.
Identification data: your name, e-mail address and department, and your EU Login session, only if you sign in.
Commission data: what the Commission tools you allowed read or change in the systems listed in point 2, which can include data about colleagues: names, absences in your team's calendar, requests you approve, documents addressed to you.
Credentials: your personal GPT@EC token and your OpenAI or Anthropic API key, only if you enter them.
Location data: your position, only when you attach it or allow the location tool.
Photos and files: the photos, images, documents and screenshots you add, only when you add them.
Technical data: device model, operating system and application versions, a pseudonymous installation identifier, the screens opened and the features used, crash details, and the IP address seen by the services the application contacts.

5. How long do we keep your personal data?

Conversations on your device: until you delete them or uninstall the application; the application keeps your 200 most recent conversations.
Tokens and keys on your device: until you remove them in Settings or uninstall the application.
Your EU Login session on your device: until you sign out or uninstall the application.
Copies of your Commission data on your device: until you sign out, another person signs in on the application, or you uninstall it. The application reads them again from the systems after a few minutes to 24 hours, depending on the data.
Data in the Commission systems: the application changes data in them only for an action you asked the assistant for, and that you confirmed or allowed in Settings; each system keeps its data under its own record of processing and retention rules.
Your settings and a technical diagnostic log on your device: until you uninstall the application.
Questions sent to GPT@EC: the application stores nothing on the service; GPT@EC processes them under its own record of processing and retention rules.
Conversations with CPNS-AI on the gateway: kept for as long as the gateway's retention rules set, at most one year after their last message, then deleted. A conversation you delete in the application is deleted on the gateway at once or, when that is not possible (offline, signed out, or another assistant service chosen), the next time you use CPNS-AI; it then disappears from the gateway's backups when they expire.
Photos and files sent to CPNS-AI: kept by the gateway with the conversation and deleted with it, or 30 days after they were sent at the latest. On your device, they are kept with the conversation and deleted with it, when you sign out or when another user signs in.
Questions sent to OpenAI or Anthropic: under the terms and privacy policy of your own account with that company.
Crash reports and usage statistics: for the retention periods set in the application's Firebase project.

6. How do we protect and safeguard your personal data?

All processing operations are carried out pursuant to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the security of communication and information systems in the European Commission.

In order to protect your personal data, the Commission has put in place a number of technical and organisational measures, including:

Encrypted communication channels (HTTPS/TLS) for all data transmission.
Tokens, API keys and your EU Login session kept in the device's secure storage.
The Commission tools never offered when you use OpenAI or Anthropic with your own key.
Conversations kept by CPNS-AI encrypted with a key of your own, and every reading of them by the gateway's administrators recorded.
Tokens, keys and other credentials removed from diagnostic logs and crash reports before they are written.
Access restricted to authorised staff on a need-to-know basis.

7. Who has access to your personal data and to whom is it disclosed?

Access to your personal data is provided to authorised Commission staff and contractors responsible for carrying out the processing operations on a need-to-know basis. Such staff abide by statutory, and when required, additional confidentiality agreements.

The following services may process your data:

GPT@EC (European Commission) — for the assistant's answers.
CPNS-AI, the Commission's AI gateway (European Commission) — for the assistant's answers and to keep your conversations with it, only if it is the assistant service; and the model of the configuration it applies: GPT@EC or, outside the Commission, Anthropic (directly or through Kiro, Amazon Web Services) or OpenAI.
The administrators of the Commission's AI gateway and of this application in it — to review conversations with CPNS-AI during the test phase, and the photos and files sent to it, which they can download; each reading and each download is recorded.
OpenAI or Anthropic — for the assistant's answers, only if you choose that service and enter your own key.
EU Login (European Commission), through OnTheGo's sign-in page — for signing in, only if you do.
The Commission systems behind the Commission tools, only when you are signed in and use them — SYSPER2, HRS/ARES, BASIS, the payslip service, the DG tasks and the pending-item counts through OnTheGo's services; Be Well and the buildings through EC Where2Go's; the Commission's notification service (CNS) and MyWorkplace through the Commission's API gateway.
Firebase Crashlytics and Firebase Analytics (Google) — for crash reports and usage statistics.
Capawesome Cloud — for application updates.

8. What are your rights and how can you exercise them?

You have specific rights as a "data subject" under Chapter III (Articles 14-25) of Regulation (EU) 2018/1725, in particular:

The right to access your personal data (Article 17).
The right to rectify your personal data if it is inaccurate or incomplete (Article 18).
The right to erase your personal data (Article 19).
Where applicable, the right to restrict the processing of your personal data (Article 20).
The right to data portability (Article 22).
The right to object to the processing of your personal data (Article 23).

You can exercise your rights by contacting the Data Controller or, in case of conflict, the Data Protection Officer. If necessary, you can also address the European Data Protection Supervisor.

9. Contact information

Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have comments, questions or concerns regarding the processing of your personal data, please contact:

Directorate-General for Digital Services (DIGIT), Unit A.4
European Commission
Email: DIGIT-MOBILE-APPS@ec.europa.eu

Data Protection Officer (DPO)

You may contact the Data Protection Officer with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725:

Email: DATA-PROTECTION-OFFICER@ec.europa.eu

European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data Protection Supervisor if you consider that your rights under Regulation (EU) 2018/1725 have been infringed as a result of the processing of your personal data:

European Data Protection Supervisor
Email: edps@edps.europa.eu
Website: https://edps.europa.eu

This privacy statement was last updated on 20 October 2026.