Privacy Policy for the Use of "Zoom X"

The tool "Zoom X" is intended to serve as a tool for teaching, research and administration. In the following, we would like to provide you with information on the processing of personal data in connection with the use of "Zoom X".

1. Contact Details of the Responsible Controller
The responsible controller as defined in the EU General Data Protection Regulation (GDPR) and other national data protection laws of the EU member states as well as other data protection-related provisions is:

Westfälische Wilhelms-Universität Münster / University of Münster
represented by its Rector, Prof Dr Johannes Wessels,
Schlossplatz 2, D-48149 Münster
Tel.: + 49 251 83-0
E-mail: verwaltung@uni-muenster.de

2. Name and Address of the Data Protection Officer
The data protection officer appointed by the responsible controller is:

Nina Meyer-Pachur
Schlossplatz 2, D-48149 Münster
Tel.: + 49 251 83-22446
E-mail: Datenschutz@uni-muenster.de

3. Data Processing during the Use of "Zoom X"
Scope of Data Processing
If you use the "Zoom X" service provided by Münster University to conduct video conferences, online meetings and webinars, we process the following data from you:

1. User information: first name, last name, status group (student, staff), phone (optional), email address, profile picture (optional), department (optional)
2. Meeting metadaten: topic, description (optional), participant IP addresses, device/hardware information
3. Meeting content data: audio, video and, if applicable, text data of the statements you make during a meeting
4. For meeting recordings (optional): MP4 file of all video and audio recordings and presentations, M4A file of all audio recordings, text file of chat history, audio log file
5. Telephony usage data (optional): caller's phone number, country name, IP address, 911 address (registered service address), start and end time, host name, host e-mail address, MAC address of the device in use

Purpose of Data Processing
The purpose of processing your personal data mentioned above is to make "Zoom X" available to you as a tool for holding video conferences, online meetings and webinars for teaching, research and administration purposes and to be able to handle the aforementioned formats via "Zoom X".

Legal Basis for Processing Personal Data
Insofar as we obtain your consent for processing of personal data in the context of the use of "Zoom X", Art. 6 (1 a) GDPR serves as the legal basis for the processing of personal data.

Insofar as the processing of personal data in the context of "Zoom X" is necessary for the fulfilment of a contract to which you are a party or is necessary for the implementation of pre-contractual measures taken in response to your request, Art. 6 (1 b) GDPR serves as the legal basis for the processing of personal data.

Insofar as processing of personal data in the context of "Zoom X" is necessary to fulfil a legal obligation to which Münster University is subject, Art. 6 (1 c) GDPR serves as the legal basis.

If the processing of your personal data in the context of the use of "Zoom X" is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Münster University, Art. 6 (1 e, 3 b) GDPR in conjunction with § 3 (1) Hochschulgesetz NRW, §§ 3 (1), 17 (1), 18 Datenschutzgesetz NRW serves as the legal basis for the processing. The legal basis referred to in this paragraph will be the general rule in most cases of use of "Zoom X".

Other Recipients of Your Personal Data
Your personal data collected when using "Zoom X" will be passed on to the following recipients within or outside Münster University:

Recipients within Münster University:

• CIT

Recipients outside Münster University:

• Zoom Video Communications, Inc.
• Subcontractors of Zoom Video Communications, Inc.

Data Processing Outside the European Union
"Zoom Video Communications, Inc." is based in the USA. Part of the processing of personal data collected when using "Zoom X" therefore takes place in the USA. Münster University has concluded a contract for commissioned processing with "Zoom Video Communications, Inc." in accordance with Art. 28 GDPR.

In providing the service, "Zoom" uses subcontractors for its part. When they are involved, the same level of data protection applies as that contractually agreed with Zoom and required in accordance with the regulations of the GDPR.

The appropriate guarantees for the protection of the rights of the data subjects (Art. 46 (1) GDPR) are ensured by the conclusion of the so-called EU standard contractual clauses, copies of which can be provided on request by e-mail to Datenschutz@uni-muenster.de.

Duration of Storage of Personal Data
Your personal data, which we process within the scope of your use of "Zoom X", are generally deleted as soon as they are no longer required for the purposes for which they were collected.

In this respect, the user's details (see above under 3.) will be deleted if the account is deleted by or on behalf of the person concerned.

The meeting metadata (see above under 3.) will be deleted as soon as the storage is no longer necessary for the provision of the service.

Meeting content data (see above under 3.) is not stored beyond communication. As far as the data is recorded in the Zoom-Cloud, it will be deleted there after 7 days.

If and insofar as the processing is based on your consent, the data will only be stored until you revoke your consent, unless there is another legal basis for the processing.

4. Your Rights as a Data Subject
You have a right of access to your personal data processed by Münster University (Art. 15 GDPR) at any time, a right of rectification of your personal data (Art. 16 GDPR), a right of deletion (Art. 17 GDPR), a right to limit processing (Art. 18 GDPR), a right to object to processing (Art. 21 GDPR) and, if processing is based on your consent, a right to withdraw your consent (Art. 7 (3) GDPR).

You also have the right to make a complaint to a supervisory authority (Art. 77 GDPR). This can be done, for example, by contacting the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, D-40102 Düsseldorf, tel.: +49 211/38424-0, e-mail: poststelle@ldi.nrw.de.