MyaGuide Reception — Public DPIA Summary v1.0

Version 1.0 — 6 September 2026 — Van Riemsdijk & Karman S.L., acting as MyaGuide

Information for your own privacy assessment

MyaGuide Reception helps residents find published information from their reception location, in available languages. Responsible organisations manage and review that information. Mya is not a care provider, not an emergency reporting point, and not a system that makes decisions about access to reception or facilities.

This is supporting supplier information, not a DPIA carried out by MyaGuide for your organisation and not a statement that a DPIA is not necessary. Your organisation assesses its own use, with advice from its data protection officer. A DPIA is required when the intended processing is likely to result in a high risk; even without stored conversations, a reasoned assessment is needed.

How the service handles data

• Mya helps with the information your organisation has published for this location. You can type or speak. OpenAI processes your question and the location information needed to make an answer; for Talk, OpenAI also processes audio. There is no video avatar. For general public information outside the location, Mya can search the internet using a short search query instead of your full conversation. Do not share names, identification numbers, medical details or other personal or confidential information; automatic checks do not recognise everything. Mya shows source links for external information. A listed opening time does not guarantee that a service is available now. Information can be incorrect or outdated. For personal or professional help, Mya refers you to staff; for urgent help, approach a staff member on site immediately.
• Conversations and unsent text exist only temporarily in the open page’s memory. They clear after 2 minutes without activity; a warning appears after 90 seconds, giving you 30 seconds to continue. End conversation, closing the chat or Escape, moving the page to the background or locking the device, leaving the page, and changing language or location clear the conversation and input. Refreshing, back/forward navigation and restored tabs start empty. Previous conversations are not recovered; only the language preference may persist. A late response cannot bring back a cleared conversation. End the conversation before handing over a shared device: immediate physical handover cannot be detected.
• Organisations cannot review individual resident questions or answers. Screenshots or questions that someone sends to support themselves are separate disclosures.
• Resident routes are excluded from analytics, tracking, and referral or attribution processing, including with existing marketing consent. Reception does not work with referral partners.
• Language Requests collect language, location, organisation, week, and count, without resident ID or question text. Organisations see only rough counts over four closed weeks: counts under five are hidden, others are rounded down to five. Five requests are not necessarily five people; in small groups, contextual recognition remains a point of attention.
• OpenAI automatically translates the source information managed by staff into the other supported languages. There is no translation approval workflow. OpenAI also processes resident questions, needed temporary context and published location information, Talk audio and short public web queries. MyaGuide does not keep a permanent resident conversation or resident profile. During an active conversation, the service temporarily processes questions, audio and the information needed to answer. Existing clearing rules still apply. MyaGuide disables OpenAI API response storage and does not instruct model training. This does not guarantee zero provider retention: security and abuse monitoring can retain data. Existing processor and international transfer arrangements remain applicable. Fly.io hosts the conversation service in Amsterdam; international support/infrastructure processing may occur.

Which data remain relevant

To answer a question, it temporarily passes through the hosting infrastructure; technical network data such as an IP address are relevant in that process and are kept briefly for security. In addition, there are staff accounts and permissions, published content and versions, language aggregates, business administration, and support mail. The retention periods, subprocessors, and international transfers are set out in the Data Processing Agreement, annexes C and D.

Your assessment. The organisation determines purpose, legal basis, local setup, and appropriate measures for vulnerable residents and minors. Do not share confidential personal files via the public Guide. A hard-to-guess, non-indexed link is not access security. On shared devices, the previous conversation must be closed and shoulder surfing must be prevented. Residents may unintentionally enter sensitive information; full automatic filtering is not guaranteed.

Before going live

The Service Agreement makes the first live pilot conditional on confirmed subprocessor arrangements and transfer safeguards, a confirmed production configuration, a tested return and deletion procedure, a mutual incident contact, and an accessibility review. The organisation records the DPIA or screening decision on its side.

The DPIA Customer Pack contains data flows, retention periods, measures, and concrete assessment questions and is provided on request. For privacy questions or to request evidence: reception@myaguide.com. The organisation remains the point of contact for the rights of its residents.