Privacy Notice: Online Meetings

Mandatory Information Pursuant to Article 13 of the GDPR
Regarding the Processing of Data for the Conduct of Online Events via Microsoft Teams

We take the protection of the personal data of our customers, business partners, training participants, and employees (hereinafter “participants”) when they participate in online meetings and events very seriously. For this reason, VOTRONIC Elektronik-Systeme GmbH processes personal data in accordance with applicable laws and regulations governing the protection of personal data and data security.

I. Contact Information for the Data Controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is

VOTRONIC Elektronik-Systeme GmbH
Johann-Friedrich-Diehm-Str. 2
36341 Lauterbach/Hessen
Germany

Tel.: +49 6641 91173-0

E-Mail: info@votronic.de
Website: https://www.votronic.de/pflichtangaben/

II. Contact Information for the (External) Data Protection Officer

The data protection officer of the controller is

BerIsDa GmbH
Rangstraße 9
36037 Fulda
Germany

Tel.: +49 661 29698090

E-Mail: datenschutz@berisda.de
Website: https://www.berisda.de/

III. Description of the Processing

1. Description and Scope of Data Processing
We use Microsoft Teams to conduct online meetings and events. To do so, we process the following categories of personal data:

• User information: First name + Last name (only if used as a moderator or authorized participant), display name, phone number (optional), email address, password, profile picture (optional)
• Meeting metadata: Topic, description (optional), connection-specific participant IP addresses, device/hardware information
• When dialing in by phone: details of the incoming and outgoing phone numbers, the country where the call originated, and the start and end times. Additional connection data, such as the device’s IP address, may also be stored.
• For recordings (only with consent): video and audio data in an MP4 file containing all video, audio, and presentation recordings; an M4A file containing all audio recordings; and a text file of the general online meeting chat.
• Text, audio, and video data (if provided by the user): You may have the option to use the chat, question, or poll features during an “online meeting.” In this context, the text you enter will be processed in order to display it during the “online meeting” and, if necessary, to log it.

To enable video display and audio playback, data from your device’s microphone and, if applicable, its video camera will be processed for the duration of the meeting. You can turn off or mute the camera or microphone at any time using the Teams app.

We use Microsoft Teams to conduct online meetings and events. If we intend to record these, we will inform you transparently in advance and obtain your consent. If necessary for the purpose of documenting the outcomes of an online meeting or event, general chat content will be saved. However, this will generally not be the case.

We generally receive your personal data directly from you or your company for the purpose of contacting you and fulfilling our contractual obligations. In addition, other (technical) data is automatically collected by the platform when you participate in an online meeting using Microsoft Teams. If you sign in with an existing Microsoft account, you also have the option to provide additional information.

Providing personal data to participate in our online meetings and events is not required by law or contract. Providing your data is necessary for participation; however, there is no obligation to do so. Failure to provide your data may, however, prevent you from participating in our online meetings and events.

No fully automated decision-making (including profiling) as defined in Article 22 of the GDPR is used in the processing of the data you have provided.

2. Legal Basis for Processing
The legal basis for processing the data is the participant’s consent pursuant to Article 6(1)(a) of the GDPR. In the event of a transfer to the United States, processing is based on Article 45 of the GDPR.
If the contact is aimed at concluding a contract or is necessary for the performance of a contract, the additional legal basis is Article 6(1)(b) of the GDPR.

The processing of other data is based on Article 6(1)(f) of the GDPR. The controller has a legitimate interest in providing the conference service in a secure and efficient manner.

3. Purpose of Processing
The processing of your personal data is necessary for your participation in online meetings and events organized by the data controller.

4. Duration of Storage, Right to Object, and Right to Erasure
Your personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies or you withdraw your consent to our processing of your personal data. You have the right to withdraw your consent under data protection law at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal. You may submit your withdrawal by email or by mail to the data controller. Once the purpose no longer applies or you have withdrawn your consent, the data you have provided will be processed to comply with legal retention obligations or based on our legitimate interests.

We will process the other data you provide for as long as necessary to protect our legitimate interests. Once our legitimate interests no longer apply, your data will be deleted.

5. Recipients of the Data
Within our organization, access to your personal data is granted to those departments and units that require it to fulfill our contractual and legal obligations or the purposes mentioned above, and that are authorized to process this data.

Im Rahmen unserer Leistungserbringung beauftragen wir Auftragsverarbeiter, die zur Erfüllung der vertraglichen Pflichten beitragen. Der Verantwortliche arbeitet mit Dienstleistern, wie beispielsweise Dienstleistern für IT-Wartungsleistungen, Videokonferenztools oder Newsletter Versand, zusammen (sog. Auftragsverarbeiter). Diese Dienstleister werden nur nach Weisung des Verantwortlichen tätig und sind vertraglich auf die Einhaltung der geltenden datenschutzrechtlichen Anforderungen verpflichtet. Dazu schließen wir schriftlich entsprechende Auftragsverarbeitungsverträge mit diesen Dienstleistern ab. Hierbei handelt es sich um einen datenschutzrechtlich vorgeschriebenen Vertrag, der gewährleistet, dass unsere Dienstleister die personenbezogenen Daten unserer Meetingsteilnehmer nur nach unseren Weisungen und unter Einhaltung der datenschutzrechtlichen Bestimmungen (DSGVO, BDSG, usw.) verarbeiten.

Data processing for online meetings via Microsoft Teams is outsourced and takes place on the systems of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. In connection with volume licensing and in the program agreements, data protection arrangements are made with Microsoft to ensure data security. These arrangements (Online Services Terms (OSTs) and Data Protection Addendum for Online Services (DPA)) utilize, among other things, the EU Standard Contractual Clauses and additional provisions regarding the GDPR.

If you sign in with an existing Microsoft account, the agreements between you and Microsoft will apply.

The controller may disclose personal data to courts, supervisory authorities, or law firms to the extent that there is a legal obligation to do so under Article 6(1)(c) of the GDPR or to the extent that such disclosure is necessary under Article 6(1)(f) of the GDPR for the establishment, exercise, or defense of legal claims and there is no reason to believe that our members have an overriding legitimate interest in the non-disclosure of the data.

6. Data Transfer to Third Countries
Data processing is carried out using Microsoft Office, a system provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The agreed server location is within the EU. Since Microsoft is an international company headquartered in the United States, data may potentially be viewed during access for maintenance or support services.

The European Commission has certified that the “EU-U.S. Data Privacy Framework” provides an adequate level of protection (pursuant to Article 45 of the GDPR). This applies provided that the organization to which data is transferred is also certified under the EU-U.S. Data Privacy Framework. MICROSOFT CORPORATION holds such certification.

IV. Rights of the data subject

If we process your personal data, you as the data subject have the following rights vis-à-vis us as the controller:

1. right to information, Art. 15 GDPR
You have the right to (free) information about your collected and stored personal data at any time within the framework of the applicable legal provisions. This also includes information about the purposes of processing, its origin and recipients, the storage period and the existence of various rights.

2. right to rectification, Art. 16 GDPR
You have a right to rectification (also in the sense of completion) of your data vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete for the purpose of the processing. The controller must carry out the rectification without undue delay.

3. right to erasure, Art. 17 GDPR
You can request the erasure of your personal data at any time under the conditions of Art. 17 GDPR, unless there are still circumstances that authorise or oblige the controller to continue processing your personal data (e.g. statutory retention obligations).

4. right to restriction of processing, Art. 18 GDPR
If the legal requirements are met, you can request a restriction of the processing of your personal data within the scope of Art. 18 GDPR.

5. right to information, Art. 19 GDPR
If your personal data has been processed by recipients to whom the controller has disclosed the data, the controller is obliged to inform them of your requests for rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. You can request that the controller inform you about these recipients.

6. right to data portability, Art. 20 GDPR
If you have provided us with personal data and automated processing is carried out on the basis of your consent or on the basis of a contract, you have the right to transfer the data provided by you within the scope of Art. 20 GDPR, provided that this does not adversely affect the rights and freedoms of other persons. The data will be provided in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

7. Right to Object, Art. 21 GDPR
You have the right to object to the processing of your data at any time, provided that the processing is based on a balancing of interests. This is the case when the controller relies on the public interest or its legitimate interest as the basis for processing (see Art. 6(1)(e) and (f)). The prerequisite is that you assert reasons arising from your particular situation that override the controller’s interest. The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
Article 21(2) of the GDPR contains a special, deviating provision if the personal data concerning you is used for direct marketing. In this case, you have the right to object to the processing of the personal data concerning you at any time without any further conditions. The personal data concerning you will no longer be processed for the purpose of direct marketing. To the extent that profiling is associated with direct marketing, you may also object to it.
You have the option to exercise your right to object in connection with the use of information society services by means of automated procedures that use technical specifications.

8. automated decision-making in individual cases, Art. 22 GDPR
In accordance with Art. 22 GDPR, you have the right that decisions which produce legal effects concerning you or similarly affect you are not based solely on automated processing, including profiling. Exceptions may exist if appropriate measures for the protection of your person are guaranteed and there are necessary contractual regulations or a legal provision or you have expressly consented.
*** Translated with www.DeepL.com/Translator (free version) ***

9. right to withdraw your consent, Art. 7 para. 3 GDPR
You have the right to revoke your declaration of consent under data protection law at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation. You can send the cancellation by e-mail or by post to the person responsible.

10. right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority for data protection, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information. If you are in another federal state or not in Germany, you can also contact the data protection authority there.

V. E-mail contact

1. description and scope of data processing
On the social media pages we use and in our signatures, email addresses are provided that can be used to contact us. In this case, the user’s personal data transmitted with the email will be stored. The data will not be passed on to third parties in this context. The data is used exclusively for processing the conversation.

2. legal basis for data processing
The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 sentence 1 lit. f GDPR. If the e-mail contact is aimed at the conclusion of a contract, the legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

3. purpose of data processing
The processing of personal data serves us solely to process the contact. Hence the necessary legitimate interest in processing the data.

4. duration of storage
The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

5. objection and removal option
If a user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contacting us will be deleted in this case.

VI Contact via a social media platform (contact form, chat)

On some of the social media platforms, it is possible to make contact internally via the service (e.g. via a contact form or chat). If a user makes use of this option, the data entered in the input mask will be processed in the systems of the respective service, transmitted to us and stored on the systems of the provider of the respective platform. The use of a social media platform to contact us is voluntary on the part of the user. The data protection regulations of the respective service apply to the processing of personal data that takes place in the course of contacting us via the systems of a social media platform.
*** Translated with www.DeepL.com/Translator (free version) ***

1. description and scope of data processing
In order to process your enquiry, it may be necessary for your personal data to be processed internally at VOTRONIC Elektronik-Systeme GmbH. The following regulations apply to the internal processing of your message at VOTRONIC Elektronik-Systeme GmbH:

2. legal basis for data processing
The legal basis for the processing of data to process an enquiry from the user is Art. 6 para. 1 sentence 1 lit. f GDPR. If the contact is aimed at the conclusion of a contract, the legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

3. purpose of data processing
The internal processing of the personal data that we have received from the contact options of the social media platforms serves us solely to process the establishment of contact.

4. duration of storage
The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For the personal data from the input screen of the contact form, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

5. objection and removal option
If a user’s personal data is processed internally to process the enquiry, the user can object to the storage of their personal data by VOTRONIC Elektronik-Systeme GmbH at any time. In such a case, the conversation cannot be continued. In this case, all personal data stored internally by the company in the course of making contact will be deleted.

VII Facebook (a Meta product)

Name and address of the controller:
The joint controllers for the operation of this Facebook page within the meaning of the EU GDPR are

Meta Platforms Ireland Limited (hereinafter “Facebook” or “Meta”)
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

and

Our company (see II – 1.)

1. information about our Facebook page
We operate this page to draw attention to our services, jobs and products and to get in touch with you. Further information about us and our activities, companies, etc. can be found on our website.

As the operator of the Facebook page, we have no interest in the collection and further processing of your personal data for analysis or marketing purposes.
The operation of this Facebook page, including the processing of users’ personal data, is based on our legitimate interests in a contemporary and supportive information and interaction opportunity for and with our users and visitors in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.
*** Translated with www.DeepL.com/Translator (free version) ***

2. processing of personal data by Meta
Meta Platforms, Inc is the US parent company of Meta Platforms Ireland Limited. The headquarters of Meta’s parent company is located in a third country from a data protection perspective.
The European General Data Protection Regulation (GDPR) requires that the transfer of personal data that is already being processed or is to be processed after its transfer to a third country or an international organisation is only permitted if a level of data protection comparable to the requirements of the GDPR is guaranteed.
Meta Platforms, Inc is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an (individual) agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA (existence of an adequacy decision by the EU Commission within the meaning of Art. 45 para. 1, 3 GDPR). Every DPF-certified company undertakes to comply with these data protection standards. The list of certified companies can be found at: https://www.dataprivacyframework.gov/list. There you can search for the provider name and view the certification directly.
Meta processes user data for the following purposes, among others: Advertising (analysis, creation of personalised advertising), creation of user profiles and market research. Meta uses cookies, i.e. small text files that are stored on users’ end devices, to store and further process this information. If the user has a Facebook profile and is logged in to it, the information is also stored and analysed across devices.
If you have any questions about your rights vis-à-vis Facebook, please contact Facebook directly. Your general rights under the GDPR can be found in this privacy policy under point IV.

If requests for information are made to us as the site operator, we are obliged by the supplementary agreement with Meta to forward these requests – whether from private individuals or authorities – to Meta within 7 days. This also results from the above-mentioned Controller Addendum https://www.facebook.com/legal/terms/page_controller_addendum

If you no longer wish the data processing described here to take place in the future, please remove the link between your user profile and our site by using the “I no longer like this page” function.

Meta’s privacy policy contains further information on data processinghttps://www.facebook.com/about/privacy/ and here you will find opt-out options: https://www.facebook.com/settings?tab=ads

3. statistical data (Insights)
Facebook “Insights” are statistical data of different categories that are available to us. These statistics are generated and provided by Facebook. As the operator of the site, we have no influence on the generation and presentation of this data. This function cannot be deactivated to prevent the generation and processing of data. Facebook provides us with the following data about our Facebook page for a selectable period of time: Total number of page views, “Like” information, page activity, post interactions, reach, video views, post reach, comments, shared content, responses, proportion of men and women, origin based on country and city, language, views and clicks in the shop, clicks on route planners, clicks on telephone numbers, data on linked Facebook groups.

Wir nutzen diese verfügbaren Daten, um unsere Facebook-Seite für die Benutzer attraktiver zu machen (z.B. Verteilungen nach Alter und Geschlecht für eine angepasste Ansprache, zeitlich Planung unserer Beiträge, optische Optimierung an Endgeräte. Entsprechend der Facebook-Nutzungsbedingungen, denen jeder Benutzer im Rahmen der Erstellung eines Facebook-Profils zugestimmt hat, können wir die Abonnenten und Fans der Seite identifizieren und deren Profile sowie weitere geteilte Informationen von ihnen einsehen.

VIII. Instagram (a product of Meta)

Name and address of the controller:
The joint controllers for the operation of this Instagram page within the meaning of the EU General Data Protection Regulation and other data protection regulations are

Meta Platforms Ireland Limited (hereinafter “Instagram” or “Meta”)
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

and

Our company (see II – 1.)

1. information about our Instagram page
We operate this page to draw attention to our services, jobs and products and to get in touch with you. You can find more information about us and our activities, companies, etc. on our website.

As the operator of the Instagram page, we have no interest in the collection and further processing of your personal data for analysis or marketing purposes.
The operation of this Instagram page, including the processing of users’ personal data, is based on our legitimate interests in a contemporary and supportive information and interaction opportunity for and with our users and visitors in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

2. processing of personal data by Meta
Meta Platforms, Inc is the US parent company of Meta Platforms Ireland Li-mited. The headquarters of Meta’s parent company is located in a third country from a data protection perspective.
The European General Data Protection Regulation (GDPR) requires that the transfer of personal data that is already being processed or is to be processed after its transfer to a third country or an international organisation is only permitted if a level of data protection comparable to the requirements of the GDPR is guaranteed.
Meta Platforms, Inc is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an (individual) agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA (existence of an adequacy decision by the EU Commission within the meaning of Art. 45 para. 1, 3 GDPR). Every DPF-certified company undertakes to comply with these data protection standards. The list of certified companies can be found at: https://www.dataprivacyframework.gov/list. There you can search for the provider name and view the certification directly.
If you have any questions about your rights, please contact Meta directly. Your general rights under the GDPR can be found in this privacy policy under point IV.

Further information can be found in Meta’s privacy policy at: https://instagram.com/about/legal/privacy/

IX. YouTube

Name and address of the controller:
The joint controllers responsible for the operation of this YouTube page within the meaning of the EU General Data Protection Regulation and other data protection regulations are

Google Ireland Limited (nachfolgend “YouTube”)
Gordon House, Barrow Street
Dublin 4
Irland

and

Our company (see II – 1.)

1. information about our use of YouTube
We operate this site to draw attention to our services, jobs and products and to get in touch with you. Further information about us and our activities, companies, etc. can be found on our website.

As the operator of the YouTube page, we have no interest in the collection and further processing of your personal data for analysis or marketing purposes.
The operation of this YouTube page, including the processing of users’ personal data, is based on our legitimate interests in a contemporary and supportive information and interaction opportunity for and with our users and visitors in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

2. processing of personal data by YouTube
Google, LLC. is the US parent company of Google Ireland Limited. The headquarters of YouTube’s parent company is located in a third country from a data protection perspective.
The European General Data Protection Regulation (GDPR) requires that the transfer of personal data that is already being processed or is to be processed after its transfer to a third country or an international organisation is only permitted if a level of data protection comparable to the requirements of the GDPR is guaranteed.
Google LLC is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an (individual) agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA (existence of an adequacy decision by the EU Commission within the meaning of Art. 45 para. 1, 3 GDPR). Every DPF-certified company undertakes to comply with these data protection standards. The list of certified companies can be found at: https://www.dataprivacyframework.gov/list. There you can search for the provider name and view the certification directly.
If you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.
If you have any questions about your rights, please contact YouTube directly. Your general rights under the GDPR can be found in this data protection declaration under point IV.
Further information on the handling of user data can be found in YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy

X. LinkedIn

Name and address of the controller:
The joint controllers responsible for the operation of this LinkedIn page within the meaning of the EU General Data Protection Regulation and other data protection regulations are

LinkedIn Corporation, (hereinafter “LinkedIn”)
1000 West Maude Avenue Sunnyvale
CA 94085 USA

and

Our company (see II. – 1.)

1. information about our use of LinkedIn
We operate this site to draw attention to our services, jobs and products and to get in touch with you. Further information about us and our activities, companies, etc. can be found on our website.

As the operator of the LinkedIn page, we have no interest in the collection and further processing of your personal data for analysis or marketing purposes.
The operation of this LinkedIn page, including the processing of users’ personal data, is based on our legitimate interests in a contemporary and supportive information and interaction opportunity for and with our users and visitors in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

2. processing of personal data by LinkedIn
LinkedIn Corporation is a company based in the USA, so that a transfer of your personal data to a third country is not excluded.
The European General Data Protection Regulation (GDPR) requires that the transfer of personal data that is already being processed or is to be processed after its transfer to a third country or an international organisation is only permitted if a level of data protection comparable to the requirements of the GDPR is guaranteed.
LinkedIn is certified according to the “EU-US Data Privacy Framework” (DPF). The DPF is an (individual) agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards for data processing in the USA (existence of an adequacy decision by the EU Commission within the meaning of Art. 45 para. 1, 3 GDPR). Every DPF-certified company undertakes to comply with these data protection standards. The list of certified companies can be found at: https://www.dataprivacyframework.gov/list. There you can search for the provider name and view the certification directly.
If you are logged into your LinkedIn account, you enable LinkedIn to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your LinkedIn account.
If you have any questions about your rights vis-à-vis LinkedIn, please contact LinkedIn directly. Your general rights under the GDPR can be found in our privacy policy under point IV.
Further information on the handling of user data can be found in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy