Video lectures, online meetings, and other conferences via the application “Zoom”
As the responsible authority in accordance with Article 4 (1.7), we would like to inform you below about the processing of personal data in connection with the use of “Zoom”.
Purpose of processing
We use the tool “Zoom” to conduct video lectures, telephone conferences, online meetings, video conferences, and/or webinars (hereinafter: “online meetings”). “Zoom” is a service of Zoom Video Communications, Inc. with headquarters in the USA (California).
Responsible party
Getriebebau NORD GmbH & Co. KG, Getriebebau-Nord-Str. 1, 22941 Bargteheide, is responsible for data processing which is directly related to the conduction of online meetings.
What data is processed?
The scope of the data required for use of the application depends on which data you provide before or during participation in an “online meeting”.
The following personal data is typically processed: User information: First name, surname, telephone (optional), e-mail address, password (if “single sign-on” is not used), profile picture (optional), department (optional)
Meeting meta data: Topic, description (optional), participants’ IP addresses, device/hardware information
For recordings (optional): MP4 file of all video, audio, and presentation recordings, M4A file of all audio recordings, text file of the online meeting chat.
When dialing in by telephone: Information on the incoming and outgoing telephone number, country name, start and end time. If necessary, further connection data such as the IP address of the device may be stored. Text, audio, and video data: You may have the option to use the chat, question, or survey features in an “online meeting”. In this respect, the text entries you make are processed in order to display them in the “online meeting” and, if necessary, to log them. To enable the video display and audio playback, the data of the microphone of your terminal device and any video camera of your terminal device will be processed accordingly for the duration of the meeting.
You can switch off or mute the camera or the microphone yourself at any time via the “Zoom” applications.
To participate in an “online meeting”, you must at least provide information of your name in order to enter the “meeting room”.
Scope of processing
We use “Zoom” to conduct online meetings. If we plan to record online meetings, we will inform you transparently in advance and – where necessary– ask for consent. In case of a recording, this is also displayed to you in the “Zoom” app.
If it is necessary for the purpose of recording results of an online meeting, we will log the chat content. However, this is typically not the case.
In the case of webinars, we may also process questions asked by webinar participants for the purpose of recording and following up webinars.
If you are registered as a user at “Zoom”, then reports on online meetings (meeting meta data, telephone dial-in data, questions and answers in webinars, survey feature in webinars) may be stored at “Zoom” for up to one month.
The option of a software-based “attention monitoring” (“attention tracking”) that exists in “online meeting” tools such as “Zoom” is deactivated.
Automated decision-making in the sense of Article 22 GDPR does not take place.
Legal basis of data processing
The legal basis of data processing for employees of Getriebebau NORD GmbH & Co. KG is Section 26 BDSG. If data is not required for data processing in connection with the use of “Zoom”, but is nevertheless an elementary component of the use of “Zoom”, then Article 6 (1f) GDPR is the legal basis for data processing. In these cases, our focus is on the effective performance of seminars and other online meetings in times when meetings are prohibited. For other participants of “online meetings” – insofar as the meetings are conducted within the frame of contractual relationships – Article 6 (1b) GDPR is the legal basis for data processing, otherwise Article 6 (1f). In the case of a recording, the legal basis is the consent in accordance with Article 6 (1a) GDPR.
Recipient/disclosure of data
Personal data processed in connection with participation in “online meetings” is not disclosed to third parties as a matter of principle, unless it is specifically intended for disclosure. Please note that, as with face-to-face meetings, content from “online meetings” is often intended precisely to communicate information with customers, prospects, or third parties and is therefore intended to be shared. Further recipients: “Zoom Video Communication Inc.” necessarily obtains knowledge of the above-mentioned data insofar as this is provided in the context of our order processing contract with “Zoom”. Knowledge on contents, i.e. picture and audio material, which is shared via the application, is not obtained by the provider.
Data processing outside of the European Union
“Zoom” is a service provided by a provider from the USA, i.e. a third country (outside of the GDPR’s scope of application). We concluded an order processing contract with the provider of “Zoom”, which complies with the requirements of Article 38 GDPR. We have configured Zoom’s operational environment to send as little data as possible to Zoom. However, it cannot be entirely ruled out that Zoom may also have access to personal data outside the EU/EEA. An adequate data protection level is established by concluding EU standard contractual clauses in accordance with Article 46 (2c) GDPR.