Privacy notice for Microsoft Teams

regarding data processing and your privacy rights

The protec­tion of the personal data of our employees, customers and busi­ness part­ners is very impor­tant to us. In addi­tion, there are legal require­ments that oblige us to protect this data. Based on this respon­si­bility and legal oblig­a­tion, we would like to inform you about the processing of your personal data within Microsoft Teams and your rights as a data subject in accor­dance with Arti­cles 13 and 14 of the GDPR.

We provide this infor­ma­tion to ensure trans­parent processing of personal data. We process your personal data exclu­sively in accor­dance with the applic­able data protec­tion laws, in partic­ular the General Data Protec­tion Regu­la­tion (GDPR).

1. The controller respon­sible for processing your personal data is:

SONAX GmbH
Münch­ener Str. 75
86633 Neuburg
Germany

Phone: +49 / 84 31 / 53-0
Email: info@sonax.de
Internet: www.sonax.com

2. Contact details of the data protec­tion officer of the controller:

Ms Vera Schneider
Email: daten­schutz@sonax.de

also avail­able via the contact details of the controller.

3. Personal data that we process

The controller uses the ‘Microsoft Teams’ service provided by Microsoft Ireland Oper­a­tions Ltd., One Microsoft Place, South County Busi­ness Park, Leop­ard­stown, Dublin 18, Ireland, or Microsoft Corpo­ra­tion, One Microsoft Way, Redmond, WA 98052-6399, USA. For more infor­ma­tion about the processing of your personal data, please refer to the Microsoft privacy policy. We process personal data in Microsoft Teams in elec­tronic form as described below and as required within the scope of the working and customer rela­tion­ship. This includes in partic­ular

• Microsoft access data, device data (log data), IP address, call quality

• Authen­ti­ca­tion and licence data, data for multi-factor authen­ti­ca­tion, etc.

• Contact and commu­ni­ca­tion data (busi­ness and private): surname, first name, address, tele­phone number, email address

• Appoint­ments (time and loca­tion details with company address)

• Appoint­ment types: virtual or in person; appoint­ment types such as consul­ta­tion, meeting, group event, seminar, tour, etc.

• User avail­ability

• Infor­ma­tion in free field regarding meeting content

• Personal data within chats and shared docu­ments

• Stored profile picture

• User activ­i­ties, e.g. time, date, type of access; data, docu­ments accessed; editing, deleting docu­ments; editing teams, chan­nels, notes in the note­book, etc.

Within the scope of the working and customer rela­tion­ship, you only need to provide the personal data that we require for the meeting with Microsoft Teams.

Microsoft Teams includes a noti­fi­ca­tion feature that informs users about the meeting via email. Microsoft Teams is inte­grated into Outlook and is also avail­able as an app. Each appoint­ment booked online creates a meeting link that is sent to the partic­i­pants so that they can join via a web browser, phone dial-in or the Teams app.

Infor­ma­tion regarding personal data that we process in connec­tion with our website at www.sonax.com can be found in a sepa­rate privacy policy at https://​www.sonax.com/​en/​footer/​legal/​privacy-policy.

4. Data subjects

The following are partic­u­larly affected by this data processing:

• Customers, busi­ness part­ners, service providers, etc.

• Employees or contact persons of the controllers, customers, busi­ness part­ners, service providers, etc.

5. Purpose and legal basis of data processing

We process the personal data provided for the plan­ning and organ­i­sa­tion of meet­ings, commu­ni­ca­tion, project collab­o­ra­tion, IT secu­rity and system stability, i.e. for the purposes of fulfilling contracts, e.g. employ­ment, customer or busi­ness partner rela­tion­ships, or for legal purposes.

Any further processing of your data for other purposes will only take place if this is compat­ible with the purposes, e.g. of the employ­ment, customer or busi­ness partner rela­tion­ship, or if you have given your express consent. The legal basis for data processing for contrac­tual and legal purposes is provided by Art. 6 para. 1 b, c GDPR in conjunc­tion with other legal bases such as statu­tory reten­tion oblig­a­tions. If you have given us your consent to process personal data, we will process your data in accor­dance with Art. 6 para. 1a GDPR.

Where neces­sary, we also process your data beyond the actual fulfil­ment of the contract to protect our legit­i­mate inter­ests or those of third parties. This includes in partic­ular:

• the imple­men­ta­tion of and compli­ance with data protec­tion and IT secu­rity require­ments

• the asser­tion and enforce­ment of legal claims

• the preser­va­tion of evidence within the scope of limi­ta­tion periods

The legal basis for this data processing is Art. 6 para. 1f GDPR. We process this data within the scope of a balancing of inter­ests to protect our legit­i­mate inter­ests or those of third parties. An over­riding legit­i­mate interest exists due to the purposes described above.

6. Recip­i­ents of personal data, forwarding to third parties

Within our organ­i­sa­tion, only depart­ments and persons who need your data to fulfil contrac­tual or legal oblig­a­tions have access to it. Only the admin­is­tra­tors of Microsoft Teams at the controller have further rights.

If service providers are engaged for order processing, this is only done on the basis of Art. 28 GDPR after careful selec­tion and review of the tech­nical and organ­i­sa­tional secu­rity provi­sions and ensuring an adequate level of protec­tion in accor­dance with Art. 44 ff. GDPR for service providers outside the EU.

When using Teams, Microsoft is used as a processor and is subject to our instruc­tions when processing personal data, as we are the controller within the meaning of the GDPR. Any transfer of personal data is based on our legit­i­mate interest pursuant to Art. 6 para. 1 lit. f GDPR in designing our IT processes effec­tively, as well as on the provi­sions on order processing pursuant to Art. 28 GDPR, according to which we have care­fully selected third-party compa­nies and external service providers, regu­larly review them and have contrac­tu­ally obliged them in accor­dance with Art. 28 (3) GDPR to process all personal data exclu­sively in accor­dance with our instruc­tions.

We only transfer your personal data to external third parties if this is required by law or contract or if you have given your consent. Data trans­fers to third coun­tries may occur within the scope of tech­nical require­ments (e.g. support access) or commu­ni­ca­tion (video confer­encing) as well as other excep­tions expressly provided for in the GDPR. Other­wise, no data will be trans­ferred to third coun­tries.

7. Storage period and dele­tion periods

We store your personal data primarily for the fulfil­ment of contrac­tual or legal oblig­a­tions. Log data is gener­ally stored for 60 days. Your data will gener­ally be deleted after the purpose of storage no longer applies, e.g. because the contrac­tual service has been provided or the legal basis no longer applies, or imme­di­ately if you with­draw your consent. Storage may also take place if required by law, for example in a number of cases to fulfil statu­tory reten­tion oblig­a­tions. The data will also be stored for as long as there is an over­riding legit­i­mate interest or it is neces­sary for the perfor­mance of our tasks, e.g. for law enforce­ment, preser­va­tion of evidence within the frame­work of limi­ta­tion periods or data secu­rity.

Upon termi­na­tion of the contrac­tual rela­tion­ship with Microsoft, the stored customer data will be deleted in accor­dance with Art. 28 (3) lit. g GDPR after 180 days at the latest, unless statu­tory reten­tion periods prevent this, see chapter ‘Storage and dele­tion of data’ on page 20 of the DPA from Microsoft.

8. Volun­tary provi­sion of personal data

You are under no legal or contrac­tual oblig­a­tion to partic­i­pate in meet­ings with Microsoft Teams or to provide us with your personal data. Alter­na­tively, you can use tele­phone or email. However, you cannot use Microsoft Teams without the processing of personal data as described above.

9. Your rights as a data subject

You have the right

• pursuant to Art. 15 GDPR, to request infor­ma­tion about your personal data processed by us.

• pursuant to Art. 16 GDPR, to request the imme­diate correc­tion of incor­rect or incom­plete personal data stored by us.

• pursuant to Art. 17 GDPR, to request the dele­tion of your personal data stored by us.

• pursuant to Art. 18 GDPR, to request the restric­tion of the processing of your personal data.

• pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a struc­tured, commonly used and machine-read­able format or to request its transfer to another controller (data porta­bility).

Right to with­draw consent

In accor­dance with Art. 7 (3) GDPR, you have the right to with­draw your consent to data processing at any time. As a result, we will no longer be permitted to continue processing the data based on this consent. The with­drawal of consent does not affect the lawful­ness of the processing carried out on the basis of the consent until the with­drawal. If you wish to exer­cise your right of with­drawal, an informal noti­fi­ca­tion via any known commu­ni­ca­tion channel is suffi­cient.

Right to lodge a complaint with a super­vi­sory authority

You have the right to lodge a complaint with a super­vi­sory authority in accor­dance with Art. 77 GDPR. As a rule, you can contact the super­vi­sory authority of your usual place of resi­dence or work­place or our regis­tered office.

Right to object

If your personal data is processed on the basis of legit­i­mate inter­ests pursuant to Art. 6 (1) f GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, provided that there are reasons for this arising from your partic­ular situ­a­tion or the objec­tion is directed against direct marketing. In the latter case, you have a general right to object, which we will imple­ment without you having to specify a partic­ular situ­a­tion.

If you wish to exer­cise your right to object, an informal noti­fi­ca­tion via any of the known commu­ni­ca­tion chan­nels is suffi­cient.

After you have exer­cised your right to object, we will no longer process your personal data for these purposes, unless we can demon­strate compelling legit­i­mate grounds for the processing that over­ride your inter­ests, rights and free­doms, or if the processing serves to assert, exer­cise or defend legal claims. This does not apply if the processing is for direct marketing purposes. In this case, we will no longer process your personal data for this purpose.

10. Up-to-date­ness and changes to this privacy infor­ma­tion

This privacy infor­ma­tion is currently valid and was last updated in April 2025.

Due to the further devel­op­ment of our processes and services or due to changes in legal provi­sions, it may be neces­sary to adapt this privacy policy. You can access the current privacy infor­ma­tion at any time here.