Terms of use and privacy policy for the use of the Zoom conferencing service

Various tools for virtual meetings are available at the University of Kaiserslautern (RPTU) (see further information on >>Conference Services (link to https://www.rhrk.uni-kl.de/dienstleistungen/netz-telefonie/konferenzdienste/). If these tools are not suitable for fulfilling tasks at RPTU, Zoom can be used alternatively and restrictively.

The RPTU manages a comprehensive collaboration and communication solution via https://uni-kl-de.zoom.us/. The term is limited to one year for the time being. The solution from Zoom Video Communications Inc. as a regulated telecommunications provider is offered by Telekom Deutschland GmbH. The technical design and availability of the service of the Zoom portal at RPTU is largely dependent on the service provider Zoom. Information on Zoom's support services can be found at http://support.zoom.us.

Since 01.12.2021, Zoom's meeting and webinar solution with its communication offer is a so-called telecommunications service within the meaning of the Telecommunications Telemedia Data Protection Act (TTDSG) and is therefore subject to telecommunications secrecy in accordance with § 3 TTDSG. In this respect, the company Zoom Video Communications Inc. is solely responsible. In principle, it is possible for all Zoom users to communicate with you. Information on the processing of personal data can be found in Zoom's privacy policy.

Zoom is responsible for the Zoom websites in terms of data protection. The university is only responsible under data protection law for the entry page at RPTU, but not for the redirects for the provision of the telecommunications service and the links "Download Client" and "Zoom Support".

In order to comply with current legal requirements and technical changes and to implement our services and offers in compliance with data protection regulations, we reserve the right to update these Terms of Use and Privacy Policy (hereinafter: Terms of Use) on a regular basis. It is therefore your responsibility to inform yourself regularly about possible amendments. The current status is August 2022.

These Terms of Use refer to the use of the Zoom platform via the central authentication Shibboleth login page of RPTU as part of the service of the Zoom portal of RPTU.

By authenticating with the RPTU ID at Zoom, these terms of use are accepted without restriction. No central authentication is required for participation in open meetings.

Students and employees, i.e. active members of RPTU, can use the service of the Zoom portal of RPTU in accordance with these terms of use. The use of Zoom is voluntary. Members who are no longer active (after exmatriculation, end of contract) are obliged to delete all data created in connection with the use and may no longer use Zoom under the license of RPTU.

The service via the Zoom portal of the RPTU is provided against the background of the Corona pandemic and the digitalization of communication. However, the use of the service is not permitted in cases where sensitive personal data within the meaning of Art. 9 of the General Data Protection Regulation (GDPR), such as health data, or information subject to special professional or official secrecy is exchanged (e.g. no personnel or examination interviews). No content that requires a high level of protection or is strictly confidential may be exchanged via this service. Other tools (e.g. DFNconf) must be used for these topics. Existing secure channels, e.g. group drives, Seafile or SharePoint, must be used for the exchange of sensitive files between participants.

Information exchanged via the Zoom portal at RPTU must be treated confidentially. Unauthorized distribution or disclosure is prohibited.

Before using Zoom, the possible data protection settings must be made in such a way that personal data is only processed by Zoom for the stated purposes and within the framework of applicable law. The data protection principles of privacy by default, data minimization, data economy and purpose limitation must be observed.

In accordance with Article 13 GDPR, we inform you below about the processing of your personal data when participating in an online meeting or a webinar via Zoom, which was created via the Zoom portal of RPTU, as well as the registration and use of licensed Zoom accounts of RPTU.

Contact details of the person responsible

University of Kaiserslautern-Landau (RPTU)

represented by the President

Gottlieb-Daimler-Straße, Building 47

67663 Kaiserslautern

Telephone: +49 631 205 0

Contact details of the data protection officer

You can contact our data protection officer by telephone on +49 631 205-4434 or by e-mail at datenschutz(at)uni-kl.de

The postal address is:

University of Kaiserslautern-Landau
The Data Protection Officer
P.O. Box 3049
67653 Kaiserslautern

Purpose and legal basis of data processing

The purpose of data processing is the use of Zoom as a tool for collaboration in the context of official activities at RPTU to fulfill the statutory university tasks. Zoom is used to conduct video conferences, telephone conferences, online meetings and/or webinars, especially during the restricted university operations at RPTU due to the corona pandemic. The use of Zoom for private purposes within the scope of the licenses provided is not permitted.

The legal basis is Art. 6 para. 1 lit. a GDPR if the data processing at RPTU is based on your consent as the data subject.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfill a legal obligation to which RPTU is subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis.

If the processing is necessary for the performance of a task carried out at RPTU in the public interest or in the exercise of official authority, Art. 6 para. 1 lit. e GDPR serves as the legal basis for the processing.

Data processing when using "Zoom"

When using Zoom services, the following personal data is processed by you

- User profile: first name, surname, status group (student, employee), university email address, telephone (optional), other contact details (optional), profile picture (optional),
- Technical information on use or meeting metadata: Topic, description (optional), participant IP addresses, device and hardware information,
- Meeting content data: audio, video and, if applicable, text data generated or provided by you in a conference
- For recordings (optional): MP4 file of all video, audio and presentation recordings, text files of the chat, etc.
- Telephony usage data (optional): incoming and outgoing phone numbers, country name, start and end time and, if applicable, other connection data such as the IP address of the device.
- billing and procurement data (only visible to administrators)

Recipients of the personal data

Personal data that is processed in connection with the use of Zoom is not passed on to third parties unless it is intended for disclosure or communication.

The personal data collected is processed internally by the RHRZ.

Externally, the data is processed by Telekom Deutschland GmbH, Zoom Video Communications Inc. and their sub-processors. Further information on Zoom's sub-processors can be found at the following link:https://zoom.us/de-de/subprocessors.html .

RPTU has concluded an order processing contract with Telekom Deutschland GmbH in accordance with Art. 28 GDPR. Zoom Video Communications Inc. is based in the USA. In this respect, data processing was agreed in accordance with the EU standard contractual clauses. The sub-processors must be obliged by Zoom to comply with the same level of data protection.

With regard to the data center regions for meeting content data, a restriction to EU was made in the default settings for a Zoom account at RPTU.

Storage period

Your personal data that we process in connection with your use of Zoom will generally be deleted when the stated purpose has been achieved or the relevant procedure has been completed and there are no legal obligations to retain it.

Your user profile will be deleted if the account is deleted by you or on your behalf.

The meeting metadata will be deleted as soon as storage is no longer required for the provision of the service.

As a matter of principle, meeting content data is not stored beyond the communication. If data is recorded in exceptional cases, it will be stored beyond the session for as long as you were notified before the recording.

Your data will also only be stored until you withdraw your consent, unless there is another legal basis for the processing.

Rights of the data subject

Every person affected by data processing has the following rights in particular under the GDPR

• Right to information about the personal data stored about you and its processing (Art. 15 GDPR).
• Right to rectification if data concerning you is incorrect or incomplete (Art. 16 GDPR)
• Right to erasure of the personal data stored about you if one of the requirements of Art. 17 GDPR applies. However, the right to erasure pursuant to Art. 17 (1) and (2) GDPR does not apply if, among other things, the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 17 (3) (b) GDPR).
• Right to restriction of processing, in particular if the accuracy of the data is contested, for the duration of the verification of accuracy, if the data is processed unlawfully but the data subject requests the restriction of processing instead of erasure, if the data subject requires the data for the establishment, exercise or defense of legal claims and the data therefore cannot be erased, or if, in the event of an objection pursuant to Art. 21, it is not yet clear whether the legitimate interests of the controller override those of the data subject (Art. 18 GDPR).
• Right to object to the processing of personal data on personal grounds, unless there is an overriding public interest in the processing which overrides the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defense of legal claims (Art. 21 GDPR).

Right to withdraw consent

You have the right to withdraw your consent at any time. The revocation only takes effect for the future; this means that the revocation does not affect the legality of the processing carried out on the basis of the consent until the revocation.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate if you believe that your personal data is being processed unlawfully at RPTU.

Postal address:

The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate
P.O. Box 3040
55020 Mainz

Website: https://www.datenschutz.rlp.de

Registration

If you wish to use Zoom as a moderator, it is necessary to register at http://uni-kl-de.zoom.us with your RPTU user ID or login data.

However, no registration is required for mere participation in an event; the event can be accessed and attended via a link sent to you.

Declaration of consent

Zoom is operated by Zoom Video Communications Inc, Zoom.us.

In order to use Zoom, it is necessary to agree to Zoom's >>User Guidelines(https://zoom.us/terms), Zoom's >>Privacy Policy(https://zoom.us/privacy) and these Terms of Use for the use of the conference service. By registering and logging in, you accept these terms and conditions and data protection declarations. The decision to activate the user account is voluntary. It is not possible to use Zoom without your consent and, if applicable, registration.