Privacy notice
How this application handles personal data
1. Who is responsible
The Volvo Forming Quality App ("the application") is operated as part of the CiSMA research project by the Department of Mechanical Engineering at Blekinge Institute of Technology (BTH), Karlskrona, Sweden.
BTH is a Swedish public authority and acts as the data controller for the personal data described here. [REVIEW: confirm the controller determination — BTH sole controller, or joint controllership with Volvo Cars for shop-floor user accounts and their decision records; add BTH's registered address and organisation number]
Contact: Md Shafiqul Islam, Senior Lecturer, Department of Mechanical Engineering, BTH. [REVIEW: add the BTH data protection officer (DPO) contact address — GDPR Art. 13(1)(b) requires it where a DPO is appointed, and BTH has one]
2. What personal data the application processes
| Category | Data | Where it comes from |
|---|---|---|
| Account data | Name, e-mail address, employee ID, job position, assigned role, account activity/expiry status, password (stored only as a salted PBKDF2-HMAC-SHA256 hash — never in readable form) | Created by an engineer-role administrator |
| Session data | A session token in a cookie (see section 6) | Generated at sign-in |
| Activity / audit data | Actions performed in the application with a timestamp, the acting employee ID, the action outcome, and the IP address the request came from — including failed and blocked sign-in attempts | Recorded automatically |
| Work records attributable to a person | Material test submissions, operator forming logs (issue, root cause, cushion-force update), technician Go/No-Go decisions with their written rationale, and quality-control verdicts — each stored together with the employee ID of the person who entered it | Entered by users as part of their work |
| Assistant conversations | Questions typed into the in-app assistant, together with the current material/process context (see section 5) | Entered by users (technician / engineer roles) |
The application does not process special-category data, does not profile individuals, and does not make automated decisions about people. Its predictions concern steel coils and formed parts, not employees.
3. Why, and on what legal basis
The data is processed to operate the demonstrator: to authenticate users, to show each role the information it is responsible for, to keep quality records traceable to the person who created them (a requirement in an industrial quality process), to secure the service, and to support the underlying research on data-driven forming quality.
[REVIEW: BTH to determine and state the legal basis per purpose — for a public-university research demonstrator this is normally the performance of a task in the public interest, GDPR Art. 6(1)(e), with Art. 89 safeguards for the research use; the security/audit logging may instead rest on legitimate interest or a legal obligation. Do not publish this notice without that determination.]
4. Who can see it, and who processes it for us
Inside the application, access follows the user's role: engineer-role users can see user accounts and the activity log; other roles see only their own working views. Records remain attributable to the employee who created them.
The application relies on the following service providers (processors / sub-processors):
- Hostinger — server hosting for data-driven-models.cloud. [REVIEW: confirm the datacenter region and state it; if it is outside the EU/EEA, add the transfer mechanism. Also confirm a data processing agreement (GDPR Art. 28) is in place.]
- Anthropic — the in-app assistant sends conversation content to the Claude API (see section 5). Anthropic is established in the United States. [REVIEW: state the third-country transfer mechanism for Anthropic (e.g. Standard Contractual Clauses or an adequacy/DPF basis) and confirm the API terms cover this use]
- E-mail delivery — outgoing alert e-mails to the responsible engineer. [REVIEW: name the SMTP provider once configured; alerting is currently not active in production]
- Content delivery networks (jsdelivr.net, unpkg.com, Google Fonts) — these serve scripts and fonts to the browser and therefore receive the visitor's IP address. [REVIEW: decide whether to self-host these assets to avoid the IP transfer, or disclose and justify it; self-hosting is technically straightforward and is the cleaner option]
Research results derived from the data (aggregated material and process data, model performance) are shared within the CiSMA consortium and may be published. [REVIEW: confirm what leaves BTH under the consortium agreement / FAIR data policy, and confirm that anything shared is aggregated or otherwise not attributable to an individual]
5. The in-app assistant (AI)
The technician and engineer views include a conversational assistant. When a user sends a message, that message and the current material/process context are transmitted to Anthropic's Claude API and processed outside the application to generate a reply. Users should not enter personal data or information they do not wish to send to that service. The assistant is an auxiliary tool: it is excluded from safety-relevant decisions, and its answers are not used as a quality verdict.
[REVIEW: confirm the Anthropic data-retention/training terms applicable to this API account and reflect them here; also confirm whether a local model deployment is planned, which would remove this transfer entirely]
6. Cookies
The application sets one cookie, named token. It holds the
signed session token that keeps a user signed in. It is HttpOnly (not readable by
scripts), SameSite=Lax, sent only over HTTPS in production, and expires after
8 hours or on sign-out.
This cookie is strictly necessary to provide a service the user has requested, so no consent banner is required for it. The application sets no analytics, advertising or tracking cookies.
7. How long data is kept
Account data is kept while the account exists; accounts can be deactivated or given an expiry date by an engineer-role administrator. Quality records and the activity log are retained as project records for the duration of the CiSMA project.
[REVIEW: set concrete retention periods per category (account data, audit log incl. IP addresses, quality records, assistant conversations) and a deletion routine — the current application has no automatic deletion, so an operational routine or a follow-up feature is needed]
8. Your rights
Under the GDPR, users may request access to their personal data, rectification of inaccurate data, erasure, restriction of processing, and may object to processing. Because BTH is a public authority, requests are handled under Swedish public-access and data-protection rules, and some records may have to be retained despite an erasure request.
To exercise a right, contact the responsible researcher named in section 1. A complaint can be lodged with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). [REVIEW: confirm the internal route for requests — researcher, BTH registrator, or DPO — and state one address]
9. Security
Passwords are stored as salted PBKDF2-HMAC-SHA256 hashes (600,000 iterations). Access is role-based; sessions use signed HttpOnly cookies; the service is served over HTTPS with HSTS and a strict content-security policy; sign-in and prediction requests are rate-limited; and every action is recorded in an audit log. The application is periodically reviewed against the OWASP guidance and scanned with automated tooling.
This is a research demonstrator, not a certified production system — see the Terms of use.
10. Changes
This notice will be updated as the demonstrator develops. Last updated: 2026-07-29.
CiSMA UC1 research demonstrator — Blekinge Institute of Technology (BTH), Department of Mechanical Engineering, in collaboration with Volvo Cars Olofström. "Volvo" and "Volvo Cars" are trademarks of their respective owners; this application is operated by BTH, not by Volvo Cars.
Funded by the European Union under Horizon Europe grant agreement No. 101177798 (CiSMA). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union. Neither the European Union nor the granting authority can be held responsible for them.