Terms of Use for Zoom at the University of Hamburg
Table of Contents
- Introduction
- Scope
- Access
- Usage
- Recording an Event
- Prohibited Content and Copyright
- Data Processing
- Use of Video and/or Audio Features
- Customizing the Display Name
- Authentication for Online Exams
- Screen Sharing
- Muting Other Participants
- Scope of Use
- Usage Period
- License Assignment
- Performance and Conduct Monitoring
- Exclusion from Use
- Obligation to Report
- Disclaimer
- Reservation of the Right to Make Changes
- Final Provisions
1. Introduction
The hosting of digital events and meetings has become essential as part of the digitization of university operations. The goal must be to conduct online exams, large-scale events such as lectures, as well as other meeting formats in the day-to-day operations of the University of Hamburg (UHH)—including admissions interviews—smoothly, without interruptions, and with data security. The Zoom video conferencing system offers these capabilities, provided that the requirements of these Terms of Use are observed and the necessary technical conditions are met. Use in compliance with data protection regulations requires adherence to certain rules of conduct when using Zoom. These Terms of Use therefore contain guidelines for the use of Zoom that must be strictly observed by all employees, affiliates, and members of the University of Hamburg (UHH), as well as students and external parties who use the Zoom service provided by the UHH to fulfill their duties at the UHH. Users can find further information on the Zoom website of the Computer Center (RRZ).
2. Scope
These Terms of Use apply to all persons (employees, affiliates, members, and students of the UHH, as well as external parties, collectively referred to below as “Users”) who use the Zoom service provided by the UHH.
3. Access
a. Permissibility
The use of Zoom is permitted only through the UHH’s Zoom service. Only this solution ensures that users who set up a meeting are authenticated via the UHH’s secure authentication infrastructure at the RRZ, based on their university user ID. Participation in video conferences initiated by other institutions—such as those to which you may be invited by colleagues outside UHH—is not generally prohibited. However, depending on the security requirements of the content and the video conferencing solution used, caution is advised, as the same high standards for data protection and the confidentiality of communications may not necessarily apply as they do at UHH.
b. Restriction of the Participant Group (Access Restrictions)
The participation of unauthorized third parties leads to the disclosure of personal data of the participants and, where applicable, of other individuals, which the UHH must prevent at all costs. To safeguard the confidentiality of audio and video content and to prevent disruptions or external attacks (so-called “Zoom bombing”), the number of participants must be limited so that only those who have actually been invited may participate. This means that the host must always set up the scheduled meeting with password protection. The password should be sent exclusively in connection with the invitation. Publishing the password on the website is not permitted. This paragraph does not apply to webinars or meetings open to the entire university community. Zoom access credentials must be treated as confidential and may not be disclosed to third parties.
4. Usage
The following guidelines must be observed when setting up a meeting:
a. Default settings for video and/or audio functions
If there is no need for participants to be present with video and/or audio at the start of the meeting, the host must set the default settings to “Off” when setting up the meeting.
b. Use of the Continuous Meeting Chat
The continuous meeting chat is enabled for all users. Messages from this chat are available in a Zoom Team Chat via the Zoom client software before, during, and after the meeting. When setting up the meeting, the host must decide whether to use the continuous meeting chat.
c. Note Text
When sending an invitation via the Zoom client, a note is automatically included in the meeting invitation (https://uhh.de/einladung-zoom-meeting), which must not be shortened or removed.
d. Ensuring Trouble-Free Operation
Various measures can be taken to ensure that a meeting runs smoothly. A distinction must be made between immediate measures taken during an ongoing meeting in the event of acute disruptions and measures to prevent disruptions. Users can find information on available options on the RRZ’s Zoom website. To the extent and for as long as necessary to ensure trouble-free operation, participation may, in exceptional cases, be made contingent upon registration (Zoom account). If possible, when registration is required, the event should be offered in a hybrid format.
5. Recording an Event
a. General Guidelines
Recordings of events may only be made in accordance with the provisions of Section 111(2) of the Hamburg Higher Education Act. In situations where only the presenter is to be recorded, the webinar solution should be used whenever possible. Recording events outside of a webinar solution is only permitted with the written consent of all participants. Recording outside of a webinar solution is discouraged both from a data protection perspective and for practical reasons, since, on the one hand, the voluntary nature of consent must be ensured and, on the other hand, depending on the size of the event, obtaining written consent from all participants may be impractical.
b. Webinar Recording
The following additional requirements must be observed when recording a webinar:
Setting up the webinar
Requests to use the webinar service are submitted via the RRZ Service Portal. The host then logs in to the Zoom Web Portal and selects the “Webinar” function in the “Personal” section. The basic parameters must then be entered.
Note
When sending an invitation via the Zoom client, a note is automatically included in the meeting invitation (https://uhh.de/einladung-zoom-meeting), which must not be shortened or removed.
Discussion Participants
The host may assign the “Discussion Participant” role to other presenters only if a declaration of consent has been obtained in advance. The presenters and hosts of the event are not authorized to assign the “Discussion Participant” role to other individuals who are not presenters.
6. Prohibited Content and Copyright
The respective users (e.g., academic departments and institutes, students, collectively referred to as “organizers”) are responsible for the content of Zoom events and meetings. It is prohibited to make available or distribute content (e.g., data, videos, images, links) that violates applicable legal provisions. This applies in particular to content that is racist, pornographic, Nazi-related, inhumane, offensive, glorifies violence, or otherwise violates applicable law. The use of Zoom to provide, exchange, or link to copyrighted works is prohibited. Copyrighted content published on Zoom by the copyright holder may not be shared, published elsewhere, or used in any other way without the express permission of the respective copyright holder. This applies in particular to teaching materials published on Zoom by the UHH.
7. Data Processing
Personal data is processed in connection with the provision of Zoom.
Users are informed about the processing of their personal data in separate privacy notices in accordance with Art. 13 of the GDPR.
Data requiring a high level of protection and data requiring special protection—including the special categories of personal data listed in Article 9 of the GDPR, such as health data—may not be processed via Zoom without prior consultation with the Information Security and Data Protection departments.
Users agree to comply with applicable data protection regulations when using Zoom.
8. Use of the Video and/or Audio Function
In general, participants may decide for themselves whether to enable or disable video and/or audio. This does not apply if the purpose of the meeting absolutely requires that video and/or audio be turned on (e.g., for online exams or job interviews).
9. Customizing the Display Name
Zoom offers the option to customize the display name. Unless absolutely necessary, participants must not be required to use their real name. Rather, if providing a real name is not necessary, a pseudonym—such as a student’s ID number or an employee’s employee ID—should be used.
10. Authentication for Online Exams
If participant authentication is required for online exams, this is generally done using an official photo ID (e.g., an identity card). If multiple people need to be authenticated, authentication must be performed individually in a separate meeting room (breakout room).
11. Screen Sharing
If participants are able to share individual windows on their screen with other participants—and thereby disclose content from their own computer—care must be taken to ensure that no personal data belonging to third parties is visible (e.g., through an open email inbox). It is recommended to share only the window of the application intended for joint viewing (e.g., PowerPoint).
12. Muting Other Participants
The host can mute participants’ microphones. This is useful for preventing background noise and also protects participants from accidentally revealing personal data. Therefore, the host should make regular use of this feature.
13. Scope of Use
Zoom is used in administration, teaching, and research to conduct video conferences and meetings, interactive online courses, and webinars, and to support teaching and research activities.
Use for private or commercial purposes is generally not permitted. Occasional use for private purposes is permitted for UHH employees provided that it does not interfere with official duties.
14. Usage Period
Upon termination of affiliation with the UHH, access rights to Zoom will be revoked. For all other individuals, access rights will be revoked as soon as the respective event is deleted. Personal data and content will be deleted as soon as they are no longer necessary for the respective processing purpose. To the extent that statutory, university-related, or other legal retention obligations apply, deletion will occur no later than the expiration of the respective retention period. Data that is no longer required after the retention obligations have expired will be deleted immediately.
In the event of termination or expiration of Zoom license agreements, UHH may terminate use at any time. In such cases, access will be blocked promptly, but no later than 30 days after the end of the agreement, and stored personal data will be deleted. Users will be informed of this in a timely manner.
15. License Assignment
UHH assigns users a personal license to use Zoom for academic, teaching, and administrative purposes. Users agree to the license terms, in particular those of the manufacturer. Upon license assignment, all users receive a Zoom account.
The use of Zoom for work purposes should only take place on work devices or on devices approved for Bring Your Own Device (BYOD) and may be technically enforced where necessary. However, when using public or private devices, full support cannot be provided—only limited assistance can be offered by the RRZ.
16. Performance and Behavior Monitoring
The use of Zoom for performance or behavior monitoring is prohibited.
17. Exclusion from Use
a. Reasons
Users may be temporarily or permanently restricted or excluded from using Zoom by the UHH if
- there is suspicion of an IT security incident involving the affected account, or
- they culpably violate these Terms of Use, or
- they misuse Zoom for criminal or immoral acts or acts contrary to the UHH’s mission statement, or
- the UHH suffers harm as a result of other unlawful conduct by the user, or
- the conditions for exclusion set forth in the applicable RRZ Terms of Use are met.
b. Review
Any permanent restriction on use or permanent exclusion from use is subject to a review by two independent individuals. Both individuals are required to document their review procedures and the results of the review in a transparent manner. The documentation must include at least the following items:
- Date of the review,
- names of the reviewers
- as well as any identified deviations from the provisions of these Terms of Use. If the user is an employee of the UHH, the relevant staff council must be involved in accordance with the applicable provisions of the Hamburg Staff Representation Act (HmbPersVG).
All information and personal data processed in connection with this audit must be treated as confidential and may be used exclusively for the purpose of the audit.
c. Further Conditions
Measures pursuant to Section 17.a. may generally be taken only after a prior warning to the user has proven ineffective. This does not apply in cases of imminent danger. The affected person must be informed of the warning immediately and in an appropriate manner. The affected person must generally be given the opportunity to comment. Provided that no legal or information security-related requirements preclude it, the affected person must be given the opportunity to back up their data.
Temporary restrictions on use must be lifted immediately as soon as proper use is possible again.
A permanent restriction on use or the complete exclusion of a user from further use may only be considered in the event of serious or repeated violations as defined in Section 17.a. of these Terms of Use, if proper conduct can no longer be expected in the future. The decision regarding permanent exclusion shall be made after hearing the affected person in accordance with the relevant UHH procedures. If teaching is affected by this, the decision must include a solution ensuring that teaching can continue.
Any claims that UHH may have against the affected individual remain unaffected.
18. Obligation to Report
If a user becomes aware of any violations of these Terms of Use or observes suspicious activity on their own or another account, this must be reported immediately to abuse@uni-hamburg.de. This report helps ensure the security and integrity of UHH’s Zoom services.
19. Disclaimer
UHH is not liable for damages incurred by users through the use of Zoom, unless such damages are attributable to intentional or grossly negligent conduct. This limitation of liability does not apply to damages resulting from injury to life, limb, or health, nor to damages resulting from a breach of essential contractual obligations. An essential obligation is one whose fulfillment is a prerequisite for the proper use of the service and on whose compliance users may reasonably rely. Liability for damages resulting from the negligent breach of essential obligations is limited to compensation for damages that were foreseeable at the start of the user relationship and that typically occur.
20. Reservation of the Right to Make Changes
The UHH reserves the right to amend these Terms of Use as necessary. The currently valid version of the Terms of Use will be posted in an appropriate location. Changes may be made in particular:
- if required due to a change in the legal situation
- if technical advancements, new features, or adjustments are required.
UHH will inform users of any amendments to the Terms of Use in an appropriate manner (e.g., via email or through the user account).
21. Final Provisions
Should individual provisions of these Terms of Use be or become invalid or unenforceable in whole or in part, the validity of the remaining provisions shall remain unaffected. The invalid or unenforceable provision shall be replaced by a legally valid and enforceable provision that most closely approximates the intent and purpose of the invalid or unenforceable provision. If no legally valid and enforceable provision can be determined even after such substitution, the statutory provisions shall apply. The same applies to any gaps in the provisions.
The Service Directive dated July 30, 2021, is hereby repealed effective June 5, 2026.