Information on data protection for photo and video recordings

a) Explanation of processing

Two processing steps take place. On the one hand, data from the event registration is processed on the basis of Article 6 (1) (b) of the GDPR. The point here is to send the registering person a link to the virtual session. The surname, first name and e-mail address are collected and processed.

On the other hand, it is about the recording, storage and publication of the virtual event via Microsoft Teams. Consent is obtained for this.

b) Contact

Contact details for responsible organization Zeppelin Universität gemeinnützige GmbH Am Seemooser Horn 20

88045 Friedrichshafen praesidium@zu.de

Registry court: District Court Ulm Register no.: HRB 63 2002

Tel. +49 7541 6009-0

Fax +49 7541 6009-1199

Internal contact for data protection issues

Dr. Michael Manger Director of HR & Services michael.manger@zu.de Tel. +49 7541 6009-2151

Contact details for data protection officers

Christoph Rank machCon GmbH

christoph.rank@machcon.de

c) Legal basis of Processing

Your data as part of the registration for the event (surname, first name and e-mail address) will be processed in order to enable you to participate in the event or to send you a link to the virtual event. This data processing is based on Article 6 Paragraph 1 Sentence 1 Letter b) of the GDPR.

With regard to the inclusion of the team event, the legal basis results from Article 6 Paragraph 1 Clause 1 Letter a) of the GDPR. Your personal data will be processed in the form of video or audio. You can decide for yourself whether the camera and microphone are on or off. If you participate in the chat function, your personal data contained in the chat texts will also be processed, recorded and published

d) Where do we obtain your personal data?

Your data is collected from yourself.

e) Transfer of personal data to a third country

The recording is first saved in Teams or in OneDrive. The file location is: Microsoft O365 European Union.

When using YouTube, the data will be processed on behalf of Zeppelin University with the application of standard contractual clauses to guarantee the level of data protection. With the publication of the recording on the YouTube platform, the video is finally made available worldwide; in this respect also in a third country.

f) Is automated decision-making and profiling used?

No fully-automated decision-making (including profiling) is used when processing the data provided by you, in accordance with Art. 22 GDPR.

g) Duration of processing (criteria for deletion)

The data you provide will be processed for as long as it is necessary to achieve the contractually agreed purpose. Since the data collected (surname, first name, e-mail address) is not only used to send the invitation, but also to document the declaration of consent, this data is stored until you revoke it or until the purpose no longer applies.

h) Information about your rights

• Right to information in accordance with Art. 15 GDPR: You have the right to receive information free of charge about whether any data has been stored about you, as well as its content and the purpose for which it is stored.

• Right to rectification in accordance with Art. 16 GDPR:
  

You have the right to request that the controller carry out the immediate rectification of your inaccurate personal data. Taking into account the processing objectives, you have the right to request that any incomplete personal data be completed – including by a supplementary statement.

• Right of deletion ("Right to be forgotten") in accordance with Art. 17 GDPR: 

You have the right to request that the controller carry out the immediate deletion of your data. The controller is obliged to delete personal data immediately if one of the following reasons applies:

a) The objectives for which the personal data was collected no longer apply.

b) You revoke your consent to processing. There are no other legal grounds for processing.

c) You object to the processing. There are no other legal grounds for processing.

d) The personal data have been unlawfully processed.

e) The deletion of personal data is required to fulfill a legal obligation existing under EU law or the law of the Member States to which the controller is subject.

f) The personal data was collected in relation to the provision of information society services in accordance with Article 8 Para. 1.

• Right to restriction of processing in accordance with Art. 18 GDPR and § 35 BDSG (German Federal Data Protection Act):
  

You have the right to request that processing is restricted if one of the following criteria has been fulfilled:

a) The accuracy of the personal data is questioned by you.

b) The processing is unlawful but you object to its deletion.

c) The personal data is no longer required for processing purposes; you nevertheless require the data for the enforcing, exercise or defense of legal claims.

d) You have raised an objection to processing in accordance with Art. 21 Para. 1 GDPR. As long as it has not been determined whether the legitimate reasons of the controller with regard to you predominate, processing will be restricted.

• Right to data portability in accordance with Art. 20 GDPR:

You have the right to receive the data provided by you in a structured, commonly-used and machine-readable format from the controller(s). We are not authorized to prevent the data from being forwarded to another controller.

• Right to object in accordance with Art. 21 GDPR:

Insofar as the processing is based on legitimate interest in accordance with Art. 6 Para. 1 Clause

1. f) GDPR, you have the right to object to processing if there are special circumstances applying to you. In this case, please contact the processing controller(s) (see above).

• Right to lodge a complaint with a supervisory authority in accordance with Art. 13 Para. 2 d, 77 GDPR in conjunction with § 19 BDSG:

If you believe that your data has been processed in contravention of GDPR, you have the right to lodge a complaint with the supervisory authority. In this case, please contact the responsible supervisory authority.