Privacy Policy MS Teams

1. Personal data

When a MS Teams meeting is recorded or transcribed, we will process the personal data of the individuals who are in attendance at that meeting.

This may include:

• employees;
• Clients
• Other external participants

The personal data that is processed in a MS Teams recording or transcription will relate to the individuals attending the meeting through their attendance.

2. Data categories

Various types of data are processed when using "Teams" or "Office365". The scope of the data depends on the information you provide at an "online meeting". It includes the following data:

• User: First name, surname, telephone (optional), email address, password (if "single sign-on" is not used), profile picture (optional), department (optional), language
• Online metadata: Subject, description (optional), participant IP addresses, device/hardware information. For recordings (optional): MP4 file of all video, audio and presentation recordings, M4A file of all audio recordings, text file of the online meeting chat. Dialling in with the telephone: details of the incoming and outgoing telephone number, country name, start and end time. If necessary, further connection data such as the IP address of the device can be saved.
• Text, audio and video data: When using the chat, question or survey functions as well as other functions for uploading and downloading files such as images, sound, video or office data, the data you provide is processed in order to display it in the "online meeting" and make it accessible to other participants during the meeting or afterwards, and to log it if necessary. During the meeting, the data is processed by the microphone or video camera of your end device. You can switch off or mute the camera or microphone yourself at any time via the "Teams" applications.
• Other Office 365 cloud services: The data stored by the user himself in these services is only stored for the purpose of further processing or dissemination determined by the user.
• Scope of processing: We use "Microsoft Teams" to conduct "online meetings" and "Office 365" to provide other Microsoft cloud services. We will communicate any recordings transparently in advance and - where necessary - ask for consent. The recording will be displayed in "Microsoft Teams". In these cases, we are interested in the effective organisation of online meetings and communication between meeting participants.

In accordance with the user guidance, the meeting organizer will advise participants verbally before the recording commences that they are able to turn off their camera or use the chat function if they do not want their face/ voice to be included on the recording.

3. Purpose of processing

All services at UnternehmerTUM may need to record or transcribe a MS Teams meeting so that a formal record is made of the meeting, for minute taking purposes or for future use and circulation.

In accordance with the user guidance, where a MS Teams meeting will be recorded or transcribed you will be informed in the invitation to attend and the meeting organiser/ chair will inform the participants that the MS Teams meeting will be recorded or transcribed, and why, before the recording or transcription commences.

4. Recipients of personal data

MS Teams recordings may be shared internally within UnternehmerTUM or, in some instances, externally, for example if the recording relates to an external training event. In accordance with the user guidance, the meeting organiser will inform the participants who the recording is likely to be shared with. MS Teams transcriptions will be available to those who attended the meeting.

5. Data processing outside the European Union

"MS Teams" and "Office 365" are services provided by providers from the USA. Personal data is therefore also processed in a third country. An adequate level of data protection is guaranteed by the conclusion of the EU standard contractual clauses.Further information on the purpose and scope of data collection and its processing by the provider can be found in the privacy policy at

https://privacy.microsoft.com

6. Legal basis

The legal basis for each MS Teams recording and transcription will depend on which type of meeting being recorded and the reason for the recording being made.

In the context of most MS Teams meetings, briefings and training the lawful basis will either be:

• If we conduct online meetings with our business partners via Microsoft Teams as part of the fulfilment of the contract, the legal basis for data processing is Art. 6 para. 1 lit. b) GDPR.
• If personal data of employees of UnternehmerTUM is processed, § 26 BDSG is the legal basis for data processing, provided that the processing is necessary for the fulfilment of the employment relationship.
• If personal data is not required for the fulfilment of the contract with business partners or the fulfilment of the employment relationship, Art. 6 para. 1 lit. f) GDPR (our legitimate interests) may justify the data processing. We have a legitimate interest in the use of modern means of communication that include the transmission of audiovisual content. We have implemented and realised Microsoft Teams in a data protection-friendly manner in the interests of our employees and business partners and refrain from collecting and storing unnecessary data.
• Insofar as the processing of the data is based on your consent (especially in connection with the recording of online meetings described above), Art. 6 para. 1 lit. a) GDPR is the relevant legal basis.

As set out above, in accordance with the user guidance, the meeting organiser/ chair will advise participants before the recording commences that they are able to turn off their camera or use of the

7. Rights

• You have the right to information about the personal data concerning you. You can contact us at any time for information. In the case of a request for information that is not made in writing, we ask for your understanding that we may require proof from you that you are the person you claim to be.
• Furthermore, you have the right to rectification, erasure or restriction of processing, insofar as you are legally entitled to do so. You also have the right to object to processing within the scope of the statutory provisions.
• Deletion of data: We generally delete personal data if there is no need for further storage. A necessity exists if the data is required for the fulfilment of contractual services, examination of warranty or guarantee claims. In the case of statutory retention obligations, deletion will only be considered after the respective retention obligation has expired.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint about the processing of personal data by us with the competent data protection supervisory authority.
  

12.09.2024