Privacy Policy for the Use of "Zoom X" According to Art. 13 GDPR

In the following, we would like to provide you with information on the processing of personal data in connection with the use of the Zoom X video communication service. This information relates to accounts with @uni-muenster.de e-mail addresses and personal data processed in the context of participation in meetings created by accounts with an @uni-muenster.de e-mail address. The University of Münster uses Zoom X from Telekom Deutschland GmbH, which is operated on servers in Germany. Only pseudonymized or aggregated data is transmitted to Zoom Video Communications Inc.

1. Contact Details of the Responsible Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

The University of Münster,
represented by its Rector
Schlossplatz 2, D-48149 Münster
Tel.: + 49 251 83-0
E-mail: mailbox@uni-muenster.de

2. Name and Address of the Data Protection Officer
You can reach the data protection officer of the controller at

Stabsstelle Datenschutz
Schlossplatz 2, D-48149 Münster
Tel.: + 49 251 83-22446
E-mail: datenschutz@uni-muenster.de

3. Data Processing during the Use of Zoom X
a) Scope of Data Processing
If you use the Zoom X service provided by the University of Münster, the University of Münster processes the following data from you:

User profile: first name, last name, e-mail address, personal meeting ID, moderator ID, user name, department (optional), profile picture (optional), phone number (optional)
Conference information: meeting title, date, start and end time, duration, number of meetings, number and names of participants, dial-in method
Configuration and communication data: device name, geodata, IP address, operating system type and version, client version, endpoint MAC addresses, time zone, domain name, activity logs, hardware type
Communication content: audio, image and video transmission in the form of metadata (bit rate, latency, jitter, packet loss, resolution, frame rate), text transmission (presentation material/chat), recordings of communication content (optional)

b) Purpose of Data Processing
The processing of your above-mentioned personal data is necessary in order to provide you with Zoom X as a tool for conducting video conferences, online meetings and webinars and to be able to process the above-mentioned formats via Zoom X. At the University of Münster, Zoom X is used in particular for the following purposes:

The implementation of courses and examinations
Research and the implementation of research projects
The implementation of organizational and personnel measures
Communication with external persons

Telekom Deutschland GmbH processes the personal data mentioned under 3. a) as a processor of the University of Münster, in particular for the following purposes:

Commissioning and provision of the Zoom conference solution
Hosting the Zoom conference solution (e.g. saving audio/video recordings, chats or shared documents for later retrieval)
Management of conferences and participant data (e.g. saving participant data, agenda, comments; managing invitations)
Provision of operator services and support

c) Legal Basis for Processing Personal Data
If the processing of your personal data in the context of the use of Zoom X is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University of Münster, Art. 6 para. 1 sentence 1 lit. e, para. 3 GDPR in conjunction with § 3 para. 1 HSG NRW in conjunction with § 3 para. 1 DSG NRW serves as the legal basis for the processing. The legal basis mentioned in this paragraph will be the rule in most cases where Zoom X is used, for example when conducting courses and examinations.

If the University of Münster obtains your consent for the processing of personal data in the context of the use of Zoom X, Art. 6 para. 1 sentence 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR serves as the legal basis.

Insofar as the processing of personal data within the framework of Zoom X is necessary for the performance of a contract to which you are a party or for the implementation of pre-contractual measures taken at your request, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis for the processing of personal data.

Insofar as the processing of personal data within the scope of Zoom X is necessary to fulfill a legal obligation to which the University of Münster is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.

If the processing of personal data via Zoom X relates to the data of employees of the University of Münster and serves to enter into, implement, terminate or process the employment relationship or to carry out organizational, personnel or social measures, in particular for the purposes of personnel planning and personnel deployment, Art. 6 para. 1 sentence 1 lit. e, para. 3 GDPR in conjunction with § 18 para. 1 DSG NRW serves as the legal basis.

d) Other Recipients of Your Personal Data
Your personal data mentioned above will be passed on to the following recipients within or outside the University of Münster:

Recipients within Münster University:

Recipients outside Münster University:

Telekom Deutschland GmbH
Subcontractors of Telekom Deutschland GmbH

e) Data Processing Outside the European Union
The processing of personal data by Telekom Deutschland GmbH takes place within Germany. The subcontractor of Telekom Deutschland GmbH, "Zoom Video Communications Inc.", provides its services at various locations. A data protection agreement has been concluded between Telekom Deutschland GmbH and Zoom Video Communications Inc. in accordance with the EU standard contractual clauses. This means that the European data protection requirements are also met outside the European Union/European Economic Area. Only pseudonymized or aggregated data is transmitted to Zoom Video Communications Inc.

Zoom uses approved subcontractors to provide the service. When they are used, the same level of data protection applies as that contractually agreed between Telekom Deutschland GmbH and Zoom. The appropriate guarantees for the protection of the rights of the data subjects (Art. 46 para. 1 GDPR) are ensured by the conclusion of the so-called EU standard contractual clauses.

f) Duration of Storage of Personal Data
Personal data that we process as part of your use of Zoom X is anonymized after seven days. The data is generally deleted as soon as it is no longer required for the purposes for which it was collected.

Personal data processed for the provision of your Zoom X user profile will be deleted when you delete the corresponding account.

Recordings in the Zoom X Cloud will be deleted after seven days.

If the processing of your personal data is based on your consent, your data will be deleted if you withdraw your consent.

4. Your Rights as a Data Subject
You have a right of access to your personal data processed by the University of Münster (Art. 15 GDPR), a right to rectification of your personal data (Art. 16 GDPR), a right to erasure (Art. 17 GDPR), a right to restriction of processing (Art. 18 GDPR) and a right to withdraw your consent (Art. 7 (3) GDPR).

You also have the right to lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, P.O. Box 20 04 44, 40102 Düsseldorf, Tel.: 0211/38424-0, E-Mail: poststelle@ldi.nrw.de