a) Data Controller under the GDPR

The controller for Zoom’s services in connection with the provision of the University of Hamburg’s Zoom service, as defined by the General Data Protection Regulation, is the University of Hamburg, a public-law corporation. The contact information is as follows:

University of Hamburg
represented by the President

Mittelweg 177
20148 Hamburg
praesident"AT"uni-hamburg.de

b) Contact person for questions regarding data processing

Questions regarding the data processing described below can be directed to

University of Hamburg Data Center
Application Systems (APP)

Schlüterstr. 70
20146 Hamburg

rrz-serviceline"AT"uni-hamburg.de

c) Data Protection Officer

You can also contact the Data Protection Officer at:

Data Protection Officer of the University of Hamburg
Mittelweg 177
20148 Hamburg
dsb"AT"uni-hamburg.de

When participating in a Zoom meeting without your own user account, the following logging and metadata related to the conference are processed:

Meeting information (topic/title, optional description, start time, end time), login alias, role in the meeting (host, co-host, participant), join time, end time, IP address, location determined based on IP address, software version, computer name, network type, network connection information, audio/video hardware used and its utilization, data center, language setting, profile picture (optional), operating system, for phone dial-in: phone number, as well as the time of entry and exit.

When participating via your own user account, the following metadata is also processed:  
First name, last name, phone number (optional), email address, password, profile picture (optional).

In addition, the following content data may be processed:
Image, video, and audio data; when using the “IM Chat” feature during a Zoom meeting, chat content and data exchanged via chat (e.g., documents) are also processed.

When using “Team Chat” in the Zoom software outside of a meeting, the same content data as when using the “IM Chat” feature, as well as first and last names, may be processed as metadata.

The UHH uses Zoom for the following purposes and stores content data as follows (for the storage of logging and metadata, see below under “Storage of Logging and Metadata”):

a) Online Teaching

b) Online exam

c) Research

d) Other

Afterward, they are deleted or anonymized so that they can no longer be linked to a specific individual.

The legal basis(es) for the processing is/are:

1. The processing of students’ personal data in the context of online instruction and online exams is based on Article 6(1)(e), (2), and (3) of the GDPR in conjunction with Section 111 of the Hamburg Higher Education Act (HmbHG).
   Students may log in without using their UHH-related user ID via the Shibboleth procedure of the UHH’s central login service (login.uni-hamburg.de) and using a pseudonym instead of their real name.
2. The processing of employees’ personal data—provided they are not participating as research subjects in a research project—is based on Article 6(1)(e), (2), and (3) of the GDPR in conjunction with Section 10(1)–(3) of the Hamburg Data Protection Act (HmbDSG) in conjunction with Section 85(1), sentence 1, of the Hamburg Budget Act (HmbBG).
   Employees may log in to      without registering, using their UHH-related user ID via the Shibboleth procedure of the UHH’s central login service (login.uni-hamburg.de) and a pseudonym instead of their real name.
3. The processing of applicants’ personal data is based on Art. 6(1)(e), (2), and (3) in conjunction with § 10(1)–(3) of the HmbDSG.
4. The processing of personal data for external communication partners (i.e., individuals who are neither students nor employees of the UHH) is generally based on Article 6(1)(b) of the GDPR, provided that such processing takes place within the framework of contractual relationships, or on Article 6(1)(a) of the GDPR in the case of voluntary use of Zoom. Notwithstanding the above, the legal basis may depend on the specific reason for participation.
5. The legal basis for the processing of personal data when using Zoom to conduct research projects is generally the consent of the participants pursuant to Article 6(1)(a) of the GDPR or, where applicable, Article 9(2)(a) of the GDPR in the case of the processing of health data. Depending on the research project, the legal basis may also arise from Article 6(1)(e) in conjunction with paragraphs 2 and 3 of the GDPR, in conjunction with § 11(1) of the HmbDSG.

Personal data is transferred to the following recipients / categories of recipients:

• Internal: University of Hamburg Data Center, Application Systems (APP)
• Externally: Zoom Video Communications, Inc.

Zoom Video Communications, Inc., headquartered in the U.S. ( https://zoom.us/) , processes personal data on behalf of the University of Hamburg (UHH). It may use the data in accordance with our instructions and for our purposes, but not for its own purposes; that is, it may neither use the data for advertising nor disclose it to third parties.

To ensure an adequate level of protection, Zoom Video Communications, Inc. has obtained certification under the EU-U.S. Data Privacy Framework.

Data processing when using the UHH’s Zoom service takes place on systems operated by Zoom Video Communications, Inc. The servers used are located in the EU, specifically in Frankfurt.

You have the following rights:

a) Right to Withdraw Consent

If the processing is based on consent, you may revoke your consent at any time with future effect without having to follow any specific formalities. Once we receive your notice, your data may no longer be processed. It must be deleted immediately unless there is another legal basis for the processing. This does not affect the processing that has already taken place.

b) Right of Access

Under Article 15 of the GDPR, you have the right to access your data from the data controller.

c) Right to Rectification

Under Article 16 of the GDPR, you may request that the controller rectify inaccurate data.

d) Right to erasure

You have the right to have your personal data erased, or the “right to be forgotten,” under Article 17 of the GDPR with respect to the data controller.

a) Right to restriction of processing

You have the right to request that the controller restrict the processing of your personal data in accordance with Article 18 of the GDPR.

b) Right to Data Portability

If you have consented to the data processing or if a contract for data processing and the data processing is carried out using automated processes, you have the right to data portability (Article 20 of the GDPR).

c) Right to Object

If the processing is based on Article 6(1)(e) or (f) of the GDPR, you have the right to object to the processing pursuant to Article 21 of the GDPR by contacting the data controller.

d) Right to lodge a complaint

You have the right to lodge a complaint regarding the processing of your personal data with a competent data protection supervisory authority.

In some cases, your request may not be granted. If your request cannot be granted for legal reasons, you will be informed of the reason for the denial.