Who processes your personal data for what purposes?
If you are invited by a lawyer or other employee of Gleiss Lutz Hootz Hirsch PartmbB Rechtsanwälte, Steuerberater, Lautenschlagerstraße 21, 70173 Stuttgart, („Gleiss Lutz“, „we“) to participate in a meeting via Zoom, Gleiss Lutz will be the controller of your personal data processed for the purposes of conducting that meeting.
Zoom Video Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113 (“Zoom”) will process the personal data shared via its teleconferencing tool as a processor on our behalf, subject to strict confidentiality obligations and our instructions. If you are interested in the processing of your personal data by Zoom for its own purposes, you can find the pertinent information at https://zoom.us/privacy.
This note is designed to provide you with all appropriate information related to the processing of your personal data in accordance with Regulation (EU) no. 2016/679 (General Data Protection Regulation – “GDPR”). Should you have any further questions or related concerns, please feel free to contact us at datenschutz@gleisslutz.com.
You may also contact Zoom via its EU Representative Lionheart Squared Ltd., Attn: Data Privacy, 2 Pembroke House, Upper Pembroke Street 28-32, Dublin DO2 EK84, Republic or Ireland (zoom@LionheartSquared.eu) or directly at privacy@zoom.us. However, to the extent your query relates to the processing of personal data in connection with the Zoom meeting, we are your primary point of contact.
What personal data is processed on what legal basis?
For the purpose of conducting the Zoom meeting, we may process the following categories of personal data:
identifying information, in particular name, title, company affiliation, position,
Zoom account data, i.e. whether you have a Zoom account and information associated with such account, in particular username, profile picture/avatar, language preference;
contact data, in particular e-mail-address, phone number;
meeting meta data, in particular date/time of the meeting, meeting topic, date/time and duration of attendance;
communication data, in particular your audio and/or video feed and any chat messages or files you upload to the virtual meeting room;
usage data, in particular IP address.
The legal basis for this processing is Article 6(1)(f) GDPR, as it is in our legitimate interest to use Zoom as a tool to facilitate the communication with you. You may always request us to use different means of communication (e.g., telephone, e-mail, MicrosoftTeams, any video-conferencing service you may be able to use to host a meeting). In addition, you are free to take further measures to protect your privacy, e.g. use a synonym as screen name, use a virtual background and/or participate via audio only). Therefore, we do not expect that there are any confidentiality interests which outweigh our interest in using Zoom for this purpose. However, please feel free to object to our use of Zoom at any time and we will cease its use for communication with you.
We may process information exchanged during the Zoom meeting for further purposes, such as to initiate or conduct a contractual relationship with you or the legal entity to which you belong. For information on these processing activities, please visit our general privacy notice under https://www.gleisslutz.com/en/privacy-notice.
How long will your personal data be stored?
The audio- and video data processed in the course of the Zoom meeting is only processed in transit and not stored permanently. Zoom meetings will not be recorded.
If you upload personal data as part of files or pictures to the virtual meeting room, these will be deleted 31 days after the end of the meeting.
What are your rights in relation to the processing?
You have the right to be provided with access to and information about your personal data that are processed by Gleiss Lutz and, if certain legal requirements are satisfied, the right to rectification, erasure, and restricted processing, as well as the right to object to data processing. In addition and under certain statutory conditions, you have the right to receive personal data that you have made available to us in a structured, standard, and machine-legible format. This includes the right to transfer such data to another controller. If technically feasible, you may also demand that Gleiss Lutz transfer your personal data directly to another controller.
If the processing of your personal data is based on Article 6(1)(f) GDPR, you have the right to object to this processing under the conditions described in Article 21 GDPR.
You may also lodge a complaint with the competent regulatory authority.