When you communicate with us by means of a video conference, we and the provider of the respective video conference platform (hereinafter referred to as "platform(s)") process your personal data. With the following specific data protection declaration, we inform you about the processing of your personal data within the scope of use.
8.1. Purposes and legal basis
We use platforms, for example, to offer certain services (e.g., conducting webinars or training courses, etc.) or simply to enable communication (internal and external). The use of the platforms, along with other related purposes, is therefore necessary for the provision of our services and, in principle, for the performance of contracts (cf. Art. 6 (1) b GDPR, § 26 (1) BDSG).
In addition, the use of the platforms is regularly in our legitimate interest (cf. Art. 6 (1) f GDPR), as it simplifies the implementation or provision of our services and accelerates communication (internally and externally) or makes it possible in the first place, especially if face-to-face events are not possible. In the context of the provision of use, it may also be in our legitimate interest to carry out troubleshooting and generate evaluations.
Furthermore, the platforms may also be used based on a consent (cf. Art. 6 (1) a GDPR), in particular in connection with any recording within the scope of use. We will inform you about this separately in advance, in particular about the personal data processed in connection with the recording (e.g., recording of image and spoken contributions or transcription of these).
8.2. The processed (personal) data
When using platforms, we process (personal) data. Which (personal) data is processed and to what extent depends in particular on the service offered, the platform used, the technical functions used and the information you provide before, during or after participating in a meeting, e.g., a webinar. During a meeting, content may therefore also be exchanged, uploaded, or otherwise made available. Typically, we process the following (personal) data in particular:
Meeting participant details: To participate in a meeting or to enter the meeting room, at least the first and last name must usually be entered (depending on the platform used). Under certain circumstances, it is also possible to provide only a pseudonym. In addition to the first and last name, we process the email address and the access password to the meeting, optionally the profile picture and the telephone number.
If necessary, the data will be processed after the meeting for further purposes (e.g., issuing attendance confirmations). As a rule (depending on the platform and configuration used), the information is deleted 30 days after the end of the meeting. More information on the duration of the storage of personal data and on deletion can be found below under No. 5.
Metadata: The following metadata may be generated during a meeting: Time and date of meeting, duration of meeting, interruptions of meeting, log-in and log-out time(s), measurement of behaviour in the meeting, e.g., share of speech (optional), participant IP addresses, information on hardware and software used.
If necessary, metadata is used after the meeting for troubleshooting or evaluation purposes, among other things. Metadata is usually deleted 30 days after the end of the meeting (depending on the platform and configuration used). More information on the duration of the storage of personal data and on deletion can be found below under No. 5.
Text, audio, and video data: It is possible (if the function is enabled) to use the chat, question or poll function in a meeting. Text entries are processed to display them in the meeting and, if necessary, to record them. In addition, to enable the display of video and the playback of audio, (personal) data from the video camera and microphone of the terminal device are processed during the meeting. The video camera and/or microphone can be switched off or muted at any time.
After the meeting, text, audio and video data are only processed for a specific purpose (e.g., subsequent provision of a link to view the webinar). After the purpose has ceased to exist (e.g., expiry of the validity of the link), the data is generally deleted unless another purpose justifies the processing. More information on the duration of the storage of personal data and on deletion can be found below under no. 5.
Recording, storage: Optionally, video, audio and presentation recordings or, if necessary, a transcription of the spoken word are made. Recordings require that the camera and microphone are switched on, that the screen is shared if necessary and that the resulting functions are also used. The transcription can also be used anonymously (depending on the platform and configuration used).
If the chat function is also used, the information you provide will be saved in the text file of the meeting chat. This also applies to sent files.
Recordings or other stored data are only processed after the meeting if this is necessary to achieve the purpose (e.g., subsequent provision of a link to view the webinar). If the purpose ceases to apply (e.g., expiry of the validity of the link), the recordings or other stored data will generally be deleted unless a further purpose justifies the processing. More information on the duration of the storage of personal data and on deletion can be found below under No. 5.
Dial-up with the telephone: As a rule, the telephone number and country are processed, optionally - location and connection data.
If necessary, dial-in data is used after the meeting, e.g., for troubleshooting or evaluation. They are usually deleted 30 days after the end of the meeting (depending on the platform and configuration used). More information about the duration of storage of personal data and deletion can be found below under No. 5.
8.3. Platforms used, recipients of the (personal) data
To fulfil the aforementioned purposes, we currently use the following platforms in particular: Teams and Skype from Microsoft, GoToMeeting from LogMeIn, WebEx from Cisco and Zoom from Zoom Video Communications.
The data protection declarations of the platform providers (hereinafter "providers"), with each of which we have concluded a commissioned processing agreement in accordance with Art. 28 GDPR, can be found here:
Teams and Skype from Microsoft:
https://docs.microsoft.com/de-de/microsoftteams/teams-privacy
GoToMeeting from LogMeIn:
LogMeIn (USA) Privacy Policy
WebEx from Cisco:
Cisco Online Privacy Statement - Cisco
Zoom by Zoom Video Communications:
Data protection | Zoom
Within our company, (only) those internal offices or employees receive personal data insofar as they need it to fulfil the aforementioned purposes in particular (enabling communication via a platform by creating a meeting). However, the data recipients are obliged in each case to use personal data only to the extent necessary.
If we transmit personal data to other (external) persons, companies or other third parties (e.g., downstream transmission of the recording of the meeting to participants) or grant them other access to personal data, this is only done on the basis of a legal permission or a corresponding consent. If we commission third parties with the processing of personal data based on a so-called "order processing agreement" and thereby secure for ourselves, among other things, the necessary powers of influence or control with regard to the processing and use of personal data, this is done on the basis of Art. 28 GDPR. However, we remain responsible to you for the lawfulness of the data processing. In this context, we also ensure that the providers maintain appropriate technical and organisational measures to protect the personal data.
In addition, providers may also process personal data for their own purposes. Please note that in this case, the providers themselves are responsible and must fulfil the obligations arising from the GDPR (e.g., obligation to inform, obligation to delete after the purpose has been achieved, etc.). Further information can be found in the data protection declarations of the providers (see above).
8.4. Processing of personal data in a third country
As far as possible, we will carry out the processing of personal data on the territory of the Federal Republic of Germany, in another member state of the European Union or in another state party to the Agreement on the European Economic Area (e.g., store (have stored) the data arising during use in an "EU cluster").
However, if processing of personal data in third countries (e.g., USA) is necessary, in particular in connection with the commissioning of providers, we will ensure that the specific legal requirements for such processing operations are met and thus that an adequate level of data protection exists in the respective third country. This includes, in particular, checking whether the European Commission has decided that an adequate level of protection exists in a third country (cf. Art. 45 GDPR) or whether suitable or adequate safeguards (e.g., standard contractual clauses) are in place and the enforcement of your rights is guaranteed as well as whether sufficient technical and organisational measures are in place to protect the personal data.
For further information on the appropriate or adequate safeguarding measures and how and where to obtain a copy of them, please contact datenschutz@hartmann.info.
8.5. Duration of the storage of personal data, deletion
In principle, we process and store personal data for the duration of a meeting or webinar and any subsequent services/processes (e.g., issuing certificates of attendance, providing the link to a webinar or the transcription, etc.). In addition, we may also process or store personal data for other purposes, e.g., for troubleshooting and evaluation purposes.
If the processing or storage is no longer necessary, we delete the personal data. This does not apply if, among other things, legally prescribed retention periods prevent the deletion (cf. Art. 17 (3) GDPR) and/or another case of Art. 17 (3) GDPR exists and/or a new purpose justifies further processing.
Incorrect and/or incomplete data will be deleted or - as far as possible - corrected without delay in accordance with Art. 5 (1) d GDPR.
8.6. Technical and organisational measures
To ensure that personal data is protected, the following technical and organisational measures are taken in particular:
- User authentication;
- Possibility for two-factor authentication (e.g., inZoom and MS Teams);
- Transport / end-to-end encryption;
- Possibility to pixelate backgrounds after activating the camera;
- Possibility of participation with video/sound off by default;
- Participation without creation of an account (guest account);
- Participation without installation of an application (web client);
- Recording and storage turned off by default, recording only started after consent.
8.7. Further data protection information
Further information on the processing of your personal data, in particular your rights, can be found in the applicable / valid data protection declaration for you as an employee, customer, supplier, etc., available on the intranet or on our website, among other places.
