Pickware AI connects your Pickware products with AI models from leading providers to give you productive assistance functions, automated analyses, and intelligent workflow support. Data protection, transparency, and trust are at the center of this. This article answers the most common questions about data protection and data processing in Pickware AI.

What is Pickware AI?

Pickware AI is an AI-powered additional feature within Pickware products that provides selected functions using generative AI models — such as analysis and reporting aids, proposals for stock optimization, or support with recurring tasks in the backend. Pickware AI follows the same data protection and security standards as the other Pickware products. You can find more information about the functions in the article What is Pickware AI?

Who is responsible under data protection law?

Pickware remains the processor within the meaning of Art. 28 GDPR. You, as the merchant, remain the controller within the meaning of Art. 4 No. 7 GDPR. The AI providers used within Pickware AI act as sub-processors on behalf of Pickware. This arrangement is documented transparently in the data processing agreement (DPA) and in the sub-processor list.

Which AI providers are used?

The following providers are currently used within Pickware AI:

You can find a complete and up-to-date list at pickware.com/de/sub-prozessoren.

Which data is transmitted to the AI providers?

The Pickware AI chat can access data from your Pickware client through technical tools. Which data is actually transmitted depends on the request you make to the AI. The principle of data minimization applies — the AI's tools are limited to the data sources required for the respective function.

If you give the AI a request that contains or requires end customer data (e.g. "summarize all orders from customer Mustermann"), the AI can use its tools to access the corresponding records and transmit them to OpenAI. Your customers' end customers never see the AI outputs directly — the AI functions can only be used in the merchant backend.

Is my data used to train AI models?

No. It is contractually excluded with all AI providers used that the data transmitted within Pickware AI is used to train the models. A Data Processing Addendum (DPA) has been concluded with OpenAI Ireland Ltd. that categorically excludes training use.

Is my data stored at OpenAI?

No. Zero Data Retention (ZDR) is enabled for the Pickware account at OpenAI. This means that OpenAI does not store the data transmitted as part of API requests. In combination with the contractual training exclusion, this ensures that your data neither remains permanently at OpenAI nor is used to improve AI models.

Where is the data processed?

The contractual partner for Pickware AI is OpenAI Ireland Ltd., based in Ireland. As things currently stand, the actual data processing may also take place on servers in the USA, as OpenAI, as a global provider, operates servers in several regions. For all third country transfers, Pickware relies on the EU–US Data Privacy Framework (DPF) and the EU Standard Contractual Clauses (SCC 2021/914).

In addition, a set of technical and contractual measures secures the level of protection: Zero Data Retention (no storage at OpenAI), a contractual training exclusion in the Data Processing Addendum, data minimization through restricted AI tool access, and exclusive back-office use — end customers never interact directly with the AI.

Is end customer plain data transmitted?

Yes, this can happen depending on the request. Since the AI chat accesses the Pickware database through tools and you, as the merchant, can make any requests, end customer plain data can be transmitted to the AI. Complete pseudonymization of arbitrary free text requests is not reliably possible technically. Pickware therefore relies on a combination of clear restriction of the AI tools, client separation, a contractual training exclusion at OpenAI, and Zero Data Retention.

Do I need to conclude a new DPA?

No. The existing DPA remains valid and has merely been supplemented with the new sub-processors. You can find the updated DPA at pickware.com/de/avv.

Do I have a right to object?

Yes. You can object to the engagement of a new sub-processor if it does not provide sufficient protection for your data. The procedure for this — including our advance notification and the applicable deadlines — is set out in the data processing agreement (DPA). Send your objection to [email protected].

What obligations do I have toward my end customers?

As the controller toward your end customers, we recommend the following measures:

You can request a template for supplementing your privacy policy from [email protected].

Is there a data protection impact assessment (DPIA)?

Yes. Pickware has carried out a full data protection impact assessment for Pickware AI in accordance with Art. 35 GDPR. Excerpts can be disclosed to you or your data protection officer upon justified request.

Can I deactivate Pickware AI?

Yes. Pickware AI is designed as an optional module. If you do not want to actively use Pickware AI, you can deactivate the functions for your client. To do so, contact Pickware Support or send an email to [email protected].

Can I trace what the AI does with my data?

Yes. Pickware uses a logging and tracing tool that enables quality assurance and error analysis. Upon justified request, excerpts from these logs will be made available to you — within the retention period — for example if an end customer exercises their right of access under Art. 15 GDPR.

What happens if the AI makes an error?

Generative AI models can produce incorrect or fabricated content. Pickware AI is therefore designed so that all AI outputs are to be understood as proposals and human review is intended. Check results before you act on them — especially numbers and calculations. If you notice an incorrect output, please report it via the feedback icon in the Pickware backend or to [email protected].

We will inform you about the addition or replacement of sub-processors in accordance with the data processing agreement (DPA). You can find the current overview of sub-processors in the sub-processor list.