Data protection notice

Data protection information on the processing of personal data (Bavaria)

Responsible party and their data protection officer (besides the license party)

Microsoft Ireland Operations Limited 

One Microsoft Place, South County Business Park, Leopardstown Dublin 18, Ireland

Microsoft Corporation  

One Microsoft Way Redmond, Washington 98052

Affected individual’s rights 

General 

Related to the processing of your personal information, you have the following rights pursuant to Art 15 ff DSGVO as an affected individual: 

  • You may request the information, if we process personal information related to you. If this is the case, you have the right to information about the personal information and about further information related to the processing (Art. 15 DGSVO). Please note that this right to information may be restricted in some instances or may be excepted (see in particular, Art. 10 BayDSG). 
  • In instances where personal information related to you is not (or no longer) correct or is incomplete, you may request a correction or, if applicable, completion of this information. 
  • If the legally required conditions are fulfilled, you may request the deletion of your personal information (Art. 17 DSGVO) or restriction of the processing of this information (Art. 18 DSGVO). The right to have information deleted pursuant to Art. 17 (1) and (2) DSGVO does not exist, inter alia, if the processing of personal information is necessary to perform a task. In the public interest or in the exercise of public authority (Art. 18 (3) letter b DSGVO). 
  • If you have agreed to data processing or a data processing agreement exists and data processing is being carried out using an automated process, you are entitled to data portability if required (Art. 20 GDPR) 
  • You have the right to complain to a supervisory authority in accord with Art. 51 GDPR about the processing of your personal information. The responsible supervisory authority for Bavarian public offices is the Bavarian State Data Protection Officer, Wagmüllerstraße 18, 80538 Munich. 

We will inform you of your right of revocation and your right to object, specifically. 

Right of Revocation 

You may object to the processing of your personal information by us at any time for reasons arising from your specific situation (Art. 21 GDPR). If the legal conditions are met, we will subsequently discontinue processing your personal information. 

Purpose

Setup and operation of workstations, including maintenance, product support, and continuous improvement and statistical use analysis  including disclosure for the following purposes of Microsoft 

  1. Billing and account administration 
  2. Remuneration, 
  3. Internal reporting and modelling 
  4. Combating fraud 
  5. Cybercrime or cyber attacks 
  6. Improving core functionality relating to accessibility, data protection, or energy efficiency 
  7. Financial reporting 
  8. Adherence to statutory requirements 

Legal regulations 

  • For the university and persons who are identifiable in communication and documents Art. 6 Para. 1 (e) in conjunction with Art. 4 BayDSG (in particular § 3a ArbStättV, Art. 13 BayBGG, Art. 11 Para. 1 BayEGovG, § 13 Para. 7 TMG, Art. 6 Para. 1 BayDSG, Art. 10 Para. 1 BayHSchG, Art. 7 BayHO, Art. 20a GG, Art. 3, 3a, 141 BayVerf) 
  • For persons who use Office 365 in the role of
  • Employee, in addition Art. 6 Para. 1 (b) GDPR in conjunction with Art. 4 BayDSG (§ 106 Gewerbeordnung)
  • Civil servants, in addition Art. 6 Para. 1 (c) GDPR in conjunction with Art. 4 BayDSG (Art. 33 Para. 5 GG)

Legal basis for the disclosure to Microsoft (beyond the processing of data) 

  • For licensed parties, Art. 6 Para. 1 (b) GDPR and Art. 49, Para. 1 (c) (1 and 6)
  • For purposes not contractually required, Art. 5, Para. 1, line 1, no. 2; Art. 49, Para. 1 (d) GDPR (2-5, 7, 8) 

Data categories 

  1. Documents and files 
  2. Problems and answers  
  3. Communication data 
  4. Person-related basic information 
  5. Authentification data 
  6. Contact information 
  7. Profiling 
  8. Logfile with accessing information 
  9. System-generated protocol data 

Categories of affected persons 

  • For data categories 1-9: persons who use or administer Office 365 
  • For data categories 3, 8, 9: persons who are identifiable in communications and documents 

Receiver  

  • Microsoft Ireland Operations Limited for the purpose of data processing and contract fulfilment  
  • Microsoft Corporation for the purpose of data processing and contract fulfilment and own purposes 
  • And their subcontracted processing agents and support providers 

Guarantees for international data transfer 

Microsoft Corporation  

Storage period 

  • 90 days after account deletion upon request or after objection (data categories 4-7) 
  • 90 days after deletion of content after cessation of the requirement (data categirues 1-3) 
  • 180 days (data categories 8, 9)