Information on data processing when using Microsoft Teams and Microsoft Forms (‘data privacy statement ’)

The data controller for processing purposes is Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) GmbH.

Address:
Friedrich-Ebert-Allee 32 + 36, 53113 Bonn, Germany
Dag-Hammarskjöld-Weg 1 – 5, 65760 Eschborn, Germany
Contact by e-mail: @email

Data processor:
Microsoft Deutschland GmbH
Walter-Gropius-Straße 5, 80807 Munich

We process the following personal data in connection with the use of "Microsoft Teams". The scope of the data depends on the data you provide before or when you participate in an online meeting:

• Information about you as a user: username, display name, e-mail address (if applicable, profile picture and information (optional information)
• Log files, log data
• Meeting metadata: meeting ID, participant IP addresses, service data for the respective session and usage of the system (data from devices/hardware used, operating system, time zone), phone numbers (if dialed in by phone), name of the meeting and password from the organizer (if applicable), date, time and duration, activities recorded in the meeting (such as join and leave, time, person participating in the activity and other participants in the meeting with date, time, duration).
• Text, audio and video data/recordings (If you have the option to use the chat function in an online meeting, the text input you make will be processed in order to display them in the online meeting. In order to enable the display of video and the playback of audio, the data from the microphone of your device as well as from any video camera of the device will be processed accordingly during the duration of the online meeting. You can turn off or mute the camera or microphone yourself at any time via the "Microsoft Teams" application.)

When using "Microsoft Teams", different types of data are processed. To join or enter an online meeting, you must provide a username for the online meeting. When participating in a meeting, your username and email address will be displayed to the other users.

1. Purposes covered by your consent (Art. 6 para 1 (a) GDPR)

   If you have given us your consent to process personal data for certain purposes (e.g. recording an online meeting), this processing is based on your consent.

   Withdrawal of consent is generally only applicable to the future use and processing of data. It does not affect any processing carried out prior to the withdrawal of consent, which remains lawful.

2. Purposes for the performance of a contract or pre-contractual measures (Art. 6 para 1 (b) GDPR)

   We process personal data for the performance of a contract or to take steps prior to entering into a contract (e.g. employment contract, event contract, job applications, etc.)

3. Purposes in the public interest or in the performance of a task assigned to GIZ (Art. 6 para 1 (e) GDPR)

   We process personal data for the performance of a task carried out in the public interest (e.g. events, conferences, surveys, webinars, etc.).

Your data will not be retained any longer than this is necessary

• in order to fulfil the purpose for which they were collected,
• to fulfil another purpose that is compatible with the purpose for which the data are initially collected, as set out in Article 6 para 4 GDPR in conjunction with Section 23 of the German Federal Data Protection Act (BDSG), or
• to comply with statutory retention periods.

The following data is stored for an explicitly defined period of time:

• Login data and IP addresses will be deleted after 90 days.
• The chat messages in the context of an online meeting are logged when using "Microsoft Teams" and remain in the chat histories of all meeting participants for up to 90 days.
• Recordings of online meetings are automatically deleted after 60 days, unless they are downloaded by someone authorized to record them.

GIZ uses appropriate technical and organisational measures to protect data against unintended or deliberate falsification, destruction, loss or access by unauthorised persons. These measures are updated accordingly based on technical developments and adapted continuously in line with the given risks.

In accordance with the General Data Protection Regulation, you have the right obtain information about your data stored by us (Art. 15 GDPR),

• to obtain information about your data stored by us (Article 15 GDPR),
• to have your data stored by us rectified (Article 16 GDPR),
• to have your data stored by us erased (Article 17 GDPR),
• to obtain restriction of processing of your data stored by us (Article 18 GDPR),
• to object to the storage of your data if they are processed on the basis of Article 6(1)(1)(f) and (e), GDPR (Article 21 GDPR),
• to receive data that concern you in a commonly used and machine-readable format from the controller such that they can be potentially transmitted to another controller (right to data portability, Article 20 GDPR),
• to withdraw your consent to the extent that the data have been processed on the basis of consent (Article 6(1)(a) GDPR). The lawfulness of processing on the basis of consent given remains unaffected until receipt of the withdrawal.
• In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority. The competent authority for GIZ is the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

If you have any questions about the processing of your personal data, you can contact GIZ's data protection officer at @email. 

The data controller is the Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) GmbH.

Address:
Friedrich-Ebert-Allee 32 + 36, 53113 Bonn, Germany
Dag-Hammarskjöld-Weg 1 – 5, 65760 Eschborn, Germany
Email: datenschutzbeauftragte@giz.de 

Data processor: 
Microsoft Deutschland GmbH
Walter-Gropius-Straße 5, 80807 Munich, Germany

At GIZ, we process the personal data that we obtain through the use of Microsoft Forms. The amount of data always depends on what information you provide in a Microsoft Forms survey or request for information.

• Details on the user: name, email address (if provided)
• Answers and information that you enter when completing a form. This may include the following data (the list is not exhaustive): travel details, address details, contact and communication details, employee details, personal identification details, qualification details, social data and contract details.
• Technical data, including IP address, device data, operating system and time zone

1. Purposes covered by your consent (Article 6(1)(a) GDPR) 

   If you have given us your consent to process personal data for particular purposes, such processing is lawful on the basis of your consent.

   You have the right to withdraw your consent to processing of your personal data at any time with effect for the future. Please note that any data processing undertaken prior to the withdrawal of your consent continues to be lawful and does not become invalid with retrospective effect.

2. Purposes for the performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR)

   We process personal data required for the performance of a contract or in order to take steps prior to entering into a contract (e.g. employment contract, contract pertaining to an event, applications, etc.).

3. Purposes for compliance with a legal obligation (Article 6(1)(c) GDPR)

   We process personal data in order to comply with a legal obligation to which our company is subject. Both GIZ and its data processor are bound by statutory requirements that permit them to share your data.

4. Purposes in the public interest or to perform a task assigned to GIZ (Article 6(1)(e) GDPR)

   We process personal data in order to perform a task carried out in the public interest (e.g. events, conferences, surveys, webinars, etc.).

Your data will not be passed on to third parties unless GIZ is legally required or entitled to do so.

Your data will not be stored for any longer than is necessary:

• For the purpose for which they were collected
• For a purpose compatible with the original purpose pursuant to Article 6(1)(e) GDPR in conjunction with Section 23 of the German Federal Data Protection Act (BDSG) or
• To comply with statutory retention periods

GIZ guarantees the protection of your data by taking appropriate technical and organisational measures. These measures are designed to protect your data against unintentional or deliberate falsification, destruction, loss or unauthorised access. These measures are updated and adapted in accordance with technical developments.

In accordance with the General Data Protection Regulation, you have the right to

• Obtain information on the data we have stored about you (Article 15 GDPR)
• Obtain rectification of the data we have stored about you (Article 16 GDPR)
• Obtain erasure of the data we have stored about you (Article 17 GDPR)
• Obtain restriction of processing of the data we have stored about you (Article 18 GDPR)
• Object to the storage of your data if they are processed on the basis of Article 6(1)(e) GDPR (Article 21 GDPR)
• Receive data concerning you in a commonly used and machine-readable format from the controller such that they can potentially be transmitted to another controller (right of data portability, Article 20 GDPR)
• Withdraw your consent if the data have been processed on the basis of consent (Article 6(1)(a) GDPR). The lawfulness of such processing on the basis of this consent remains unaffected until receipt of withdrawal of this consent.
• Lodge a complaint with the competent data protection supervisory authority (Article 77 GDPR). The competent authority for GIZ is the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

If you have any questions about the protection of your personal data, you can contact GIZ’s Data Protection Officer at @email.