We would like to inform you below about the processing of personal data in connection with the use of "Zoom."
Purpose of Processing
We use the tool "Zoom" to conduct conference calls, online meetings, and/or online events (hereinafter referred to as "online meetings"). "Zoom" is a service provided by Zoom Video Communications, Inc., which is based in the USA.
Data Controller
The data controller responsible for data processing directly related to the conduct of "online meetings" is:
Social Impact gGmbH, Schiffbauergasse 7, 14467 Potsdam,
represented by the managing directors Norbert Kunz, Gabriela Spangenberg, and Thorsten Jahnke
kommunikation@socialimpact.eu
www.socialimpact.eu
(hereinafter "Social Impact")
Note: If you visit the "Zoom" website, the provider of "Zoom" is responsible for data processing. However, visiting the website is only necessary to download the software required to use "Zoom."
You can also use "Zoom" by entering the relevant meeting ID and possibly other access data directly into the "Zoom" app.
If you do not want or cannot use the "Zoom" app, the basic functions are also available through a browser version, which you can also find on the "Zoom" website.
Which Data is Processed?
When using "Zoom," various types of data are processed. The extent of the data depends on the information you provide before or during participation in an "online meeting."
The following personal data is subject to processing:
- User Information: First name, last name, telephone (optional), email address, password (if "Single-Sign-On" is not used), profile picture (optional), department (optional)
- Meeting Metadata: Topic, description (optional), participant IP addresses, device/hardware information
- Recordings (optional): MP4 file of all video, audio, and presentation recordings, M4A file of all audio recordings, text file of the online meeting chat.
- When dialing in by phone: Information about incoming and outgoing phone numbers, country name, start and end time. Additional connection data, such as the IP address of the device, may be stored.
- Text, Audio, and Video Data: You may have the option to use chat, question, or poll features in an "online meeting." In this case, the text entries you make will be processed to display them in the "online meeting" and possibly to log them. To display video and play audio, the data from your device's microphone and, if applicable, video camera will be processed during the meeting. You can disable or mute the camera or microphone at any time through the "Zoom" app.
To participate in an "online meeting" or enter the "meeting room," you must at least provide your name.
Scope of Processing
We use "Zoom" to conduct "online meetings." If we wish to record "online meetings," we will inform you transparently in advance and ask for your consent if necessary. The recording will also be indicated in the "Zoom" app.
If it is necessary to log the results of an "online meeting," we will log the chat content. However, this is generally not the case. In the case of webinars, we may process the questions posed by participants for the purposes of recording and follow-up.
If you are registered with "Zoom" as a user, reports of "online meetings" (meeting metadata, phone dial-in data, Q&A in webinars, poll features in webinars) may be stored by "Zoom" for up to 12 months. Automated decision-making in accordance with Art. 22 of the GDPR is not used.
Legal Basis for Data Processing
To the extent that personal data of employees of Social Impact gGmbH is processed, Section 26 of the BDSG (German Federal Data Protection Act) is the legal basis for data processing. If the processing of personal data is not necessary for the establishment, execution, or termination of the employment relationship but is an essential component of the use of "Zoom," Art. 6 (1) (f) of the GDPR is the legal basis for the data processing. In such cases, our interest lies in the effective conduct of "online meetings."
Additionally, the legal basis for data processing during the conduct of "online meetings" is Art. 6 (1) (b) of the GDPR if the meetings are held within the scope of contractual relationships. If there is no contractual relationship, the legal basis is Art. 6 (1) (f) of the GDPR. In such cases, our interest lies in the effective conduct of "online meetings."
Recipients / Data Sharing
Personal data processed in connection with participation in "online meetings" is generally not shared with third parties unless it is intended for such sharing. Please note that content from "online meetings," like in face-to-face meetings, often serves to communicate information with customers, prospects, or third parties and is thus intended to be shared. Additional recipients: The provider of "Zoom" will necessarily receive knowledge of the aforementioned data to the extent provided for under our data processing agreement with "Zoom."
Data Processing Outside the European Union
"Zoom" is a service provided by a company based in the USA. Therefore, the processing of personal data also takes place in a third country. We have entered into a data processing agreement with the provider of "Zoom," which complies with the requirements of Art. 28 of the GDPR.
An appropriate level of data protection is guaranteed, on the one hand, by the conclusion of the so-called EU standard contractual clauses. Additionally, we have configured "Zoom" so that only data centers in the EU, EEA, or secure third countries such as Canada or Japan are used for the conduct of "online meetings."
Data Protection Officer
We have appointed a data protection officer. You can reach them as follows:
Data Protection Officer of Social Impact gGmbH
datenschutz@socialimpact.eu
Your Rights as a Data Subject
You have the right to access the personal data concerning you. You can contact us at any time to request such information. For inquiries that are not made in writing, we ask for your understanding that we may request proof from you to verify that you are the person you claim to be. You also have the right to rectification or deletion, or restriction of processing, to the extent you are entitled to it by law. Finally, you have the right to object to the processing under the legal conditions. You also have the right to data portability under data protection regulations.
Deletion of Data
We generally delete personal data when there is no longer a need for storage. Such a need may exist, in particular, if the data is still required to fulfill contractual obligations, verify or grant warranty claims, or defend against them. In the case of legal retention obligations, deletion will only occur after the expiration of the respective retention period.
Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a supervisory authority for data protection regarding our processing of personal data.
Changes to Data Protection Information
We may update this data protection information in the event of changes to data processing or other reasons. The current version is always available on the Social Impact website.
Effective date: March 1, 2022