Data protection information for online meetings via Microsoft Teams
Controller
Sunny Cars GmbH, Paul-Gerhardt-Allee 42, D-81245 Munich
including the associated international operating sites.
Scope of processing
We use Microsoft Teams to conduct video conferences, telephone conferences, webinars and training courses (hereinafter: online meetings) and, if necessary, to record and/or transcribe them as video/audio for documentation purposes.
The recording contains a picture of the participant, the spoken word, the name and the time. For the transcription, the spoken word is recorded and summarized in text form in real time via an AI application (Microsoft Copilot).
If online meetings are to be recorded and/or transcribed, the camera is switched off and the participant's microphone muted at the start of the meeting to ensure an individual opt-in as consent.
Only certain persons are authorized to record online meetings and start the transcription function.
Microsoft Teams is a service of Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Purpose of the processing
Conducting online meetings to simplify and accelerate business processes and collaboration. Documenting and analyzing the content of online meetings regarding business requirements or for verification purposes, e.g. project meetings (recording project statuses, decisions and tasks), job interviews. Another purpose is to give participants who are not present the opportunity to view the online meeting afterwards.
What data is processed?
When using "Microsoft Teams", various personal data and data types are processed. The scope of the data also depends on the information provided by a participant before or during participation in an online meeting.
The following personal data is processed:
- Information about the user, e.g:
Display name ("Display Name"), e-mail address, profile picture (optional), preferred language - Meeting metadata, e.g:
Date, time, start and end time, meeting ID, IP address and device/hardware information Telephone numbers, location - Text data:
You may have the option of using the chat function in an online meeting. The text entries you make will be processed to display them in the online meeting. - Audio and video data:
If audio and video options are used, the data from the microphone and video camera on the end device is processed for the duration of the meeting. If the meeting is recorded, this recording is saved.
You can switch off or mute the microphone and/or camera yourself at any time via the "Microsoft Teams" applications. - Transcription:
The amount of personal data generated by the transcription of the audio signal into text depends on the information provided by the participants in an online meeting. - Consent to recording / transcription:
If consent is given, this is saved with IP, time and user in the meeting log.
Legal basis for data processing
Conducting online meetings
The processing of personal data is necessary to enable participation in online meetings.
If, in connection with the use of online meetings, personal data is an elementary component of the use of "Microsoft Teams", Art. 6 para. 1 lit. f GDPR is the legal basis for data processing.
In these cases, our legitimate interest lies in the effective conduct of online meetings through the use of modern means of communication that include the transmission of audiovisual content.
If the meetings are held in the context of contractual relationships (with the data subject), the legal basis for data processing is Art. 6 para. 1 lit. b GDPR.
In addition to Art. 6 para. 1 lit. b GDPR, Article 88 GDPR i. v. m. § Section 26 (1) to (8) BDSG (Germany) is the legal basis for the processing of employee data, provided that the processing is necessary for the fulfillment of the employment relationship.
Recording / Transcription
Recordings and transcriptions are always made based on informed consent in accordance with Art. 6 para. 1 lit. a GDPR.
Recipients / forwarding of data
Personal data that is processed in connection with participation in online meetings is not passed on to third parties unless it is explicitly intended to be passed on. Please note that content from online meetings, as well as face-to-face meetings, is often used to communicate information to customers, interested parties or third parties and is therefore intended to be passed on.
The provider of Microsoft Teams necessarily obtains knowledge of the above-mentioned data insofar as this is necessary for the provision of the service. We have concluded contracts with Microsoft for commissioned data processing. In these contracts, Microsoft undertakes to protect user data and to process it on our behalf in accordance with European data protection regulations and not to pass it on to third parties.
Data processing outside the European Union
Microsoft Teams is a service offered by the European subsidiary of Microsoft Corporation based in the USA. Data processing and storage take place in Microsoft data centers located within the European Union. However, it cannot be ruled out that data may also be transferred to third countries such as the USA.
This may be the case, for example, if service activities are carried out from outside the EU or if data is routed via internet servers located outside the EU. This is particularly the case if participants in the online meeting are in a third country.
The data is encrypted during transport over the Internet and thus protected against unauthorized access by third parties.
Note on data processing in the USA:
Microsoft is certified for the Data Privacy Framework for "non-HR" and "HR" data, which provides an adequate level of data protection for the processing of personal data in accordance with the European Commission's adequacy decision.
How long will the data be stored?
We generally delete personal data when there is no need for further storage. A requirement may exist in particular if the data is still needed to fulfill contractual services, to check and grant or defend against warranty and guarantee claims. In the case of statutory retention obligations, deletion will only be considered after the respective retention obligation has expired.
Conducting online meetings
Audio and video content that is processed in the stream is not saved. Chat messages are automatically deleted after 90 days at the latest.
Stored technical logs and technical diagnostic information are deleted after a maximum of 90 days or anonymized.
The data storage of Microsoft users (e.g. meeting IDs etc.) is published on this Microsoft website.
Recording / Transcription
Here too, recordings and/or transcripts may (and should) be kept for as long as is necessary to achieve the purpose of the storage. For project meetings, this may be until the successful completion of a project.
In the case of a job interview, 4 weeks (Netherlands) or 3months , (Germany) after the end of the application process, or for a longer period if employment is made or consent is given.
In other cases, e.g. transcribed agreements on pension commitments, the retention period can be over 30 years.
Storage location and access
Recordings are saved with restricted access in Microsoft 365 and stored on OneDrive (for private meetings) or SharePoint (for channel meetings).
People who have been invited to the meeting can view the recording if the meeting organizer explicitly releases it for them.
Possibility of objection
You can switch off or mute the camera or microphone yourself at any time in Microsoft Teams.
Revocation of consent
In accordance with Art. 7 para. 3 GDPR, you have the right to revoke your consent to Sunny Cars GmbH at any time without affecting the legality of the processing carried out up to that point.
If the data processing is not based on consent, no revocation is possible.
Microsoft allows participants to hide their own identity in the live captioning and live transcription functions. Information on this can be found on the Microsoft website under Hide your identity in meeting captions and transcripts in Microsoft Teams.
Your rights as a "data subject"
You have the right to information about the personal data we process about you.
Furthermore, you have a right to rectification or erasure or to restriction of processing, insofar as you are legally entitled to do so.
You have the right to object to certain processing within the framework of the legal requirements. The same applies to the right to data portability.
To exercise your rights pursuant to Art. 15 et seq. GDPR (information), please contact the person responsible for data processing or our data protection officer directly, who can advise and support you.
Questions about data protection
Data subjects can consult our data protection team on all questions relating to the processing of their personal data and the exercise of their rights under the GDPR.
If you have any questions about data protection, please contact our data protection team at
available.
Contact data protection officer
E-mail: dsb@sunnycars.de, Phone: +49 8133 9179319
The Data Protection Officer is bound to maintain confidentiality in the performance of his/her duties.
We reserve the right to adapt this data protection notice in the event of changes to this service so that it always complies with current legal requirements.
Status: August 2024
Further information on data protection on Security and data protection.