Data protection information on the use of MS Teams at Aareal Bank
Use of Microsoft Teams and transcription functions
In the context of our communication, we use the tool “Microsoft Teams” from Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
We process participants’ personal data when conducting meetings, telephone calls or online meetings via Microsoft Teams. This includes in particular:
- Personal details (e.g. name, e-mail address)
- Communication content (e.g. spoken posts, chat messages)
- Meta and connection data (e.g. IP address, time, duration of the session)
When transcription is activated in a Teams meeting, the spoken word is automatically converted into text, processing the attendees’ audio to create a searchable meeting minutes.
Transcription is activated solely for specific purposes, in particular:
- Documentation of meeting content
- Follow-up and quality assurance
- Support of the traceability of votes and results
The legal basis for processing is Article 6(1)(f) GDPR. Our legitimate interest lies in the efficient execution and documentation of internal and external communication. If processing is carried out in connection with a contractual relationship, Article 6(1)(b) GDPR applies in addition.
Insofar as audio content is processed in individual cases, this can also be done on the basis of consent granted pursuant to Art. 6 (1) (a) GDPR, if such consent has been obtained or is required.
Participants will be made aware of their participation in meetings that have the transcription function activated. Participants can control their participation in such meetings (e.g. by not contributing to a speech or leaving the meeting).
The recipient of the data is Microsoft as the provider of the platform. Microsoft may obtain access to the data within the scope of the provision of services and processes them as a processor on the basis of a corresponding contract in accordance with Article 28 GDPR.
A transfer of data to third countries cannot be ruled out. This takes place exclusively in compliance with the requirements of Art. 44 et seq. GDPR (in particular using suitable safeguards such as standard contractual clauses).
The specific storage period for recordings and transcripts depends on the respective processing purpose and internal deletion concepts. Unless further regulations exist in this regard, the data will be deleted as soon as it is no longer required for the aforementioned purposes and there are no legal storage obligations to the contrary.
