Privacy Notice for Recording, Transcribing, and Processing Data in Microsoft Teams Meetings Using Copilot and Standard Functionality

1. Introduction

Kia Europe GmbH (“Kia EU ”, “we ”, “us ”, “our ”) processes personal data when it records and/or transcribes Microsoft Teams (“Teams ”) meetings, including where standard Teams functionality and Microsoft Copilot (“Copilot ”) are used. This Privacy Notice explains how Kia EU processes personal data in this context. It is addressed to individuals whose personal data may be processed when participating in Teams meetings organised or hosted by Kia EU (“you ”, “your ”). This includes:

• (potential) customers and other individuals with whom we communicate in a professional context, including their employees, representatives, consultants, and advisors;

• business partners ,such as vendors, service providers, affiliated entities, and Kia dealers, as well as their employees, representatives, consultants, and advisors

• participants in meetings, workshops, trainings, webinars, or similar business events conducted via Microsoft Teams;

• other external participants who are invited to or otherwise join a Microsoft Teams meeting hosted by Kia EU, regardless of whether a direct contractual or business relationship exists; and

• any other individuals whose audio, video, name, image, or other personal data may be processed through the recording, transcription, or related functionality of Microsoft Teams during such meetings.

This Privacy Notice applies exclusively to the processing of personal data in the context of:
• Audio and video recordings of Teams meetings;
• Automated transcription of spoken content; and
• Related processing performed within Teams, including the use of Copilot features where enabled.

This Privacy Notice supplements Kia EU’s general Microsoft Teams Privacy Notice, which continues to apply to the general use of Microsoft Teams.

Please note that, in addition to this Privacy Notice, where appropriate, we may inform you about the processing of your personal data separately, for example in consent forms or additional privacy notices.

2. Controller

Kia EU is the controller of the personal data processed in accordance with this Privacy Notice, unless expressly stated otherwise.

Contact Details
Kia Europe GmbH
Theodor-Heuss-Allee 11
60486 Frankfurt am Main, Germany
Email: info@kia-europe.com

If you have any questions about or in connection with this Privacy Notice, you may also contact our Data Protection Officer ("DPO ") at:

Kia Europe GmbH
- Data Protection Officer -
Theodor-Heuss-Allee 11
60486 Frankfurt am Main, Germany
Email: dpo@kia-europe.com

3. Categories of Personal Data

The types of personal data processed by Kia EU in the context of Teams meetings depend on the features used during the meeting (e.g. recording, transcription, Copilot) and information you choose to share. Such processing may fall within the categories set out below (the “Data Categories ”) and is subject to the content and information that you provided in connection with the relevant Teams meeting. In particular:

• User Data: data that relate directly to you as a user of Teams, such as your name and/or username, profile picture (associated with your Teams account), language preferences, and other profile information visible to meeting participants;

• Contact Data: data that enable communication with you (e.g., email address, telephone number);

• Communication Data: data that form the content of communication. Where the recording feature is enabled, this may include audio data (voice of participants when not muted), video data (images of participants when the camera is activated), and screen-sharing activity. Meeting recordings may also include any other content shared during the meeting, such as presentations, documents, or chat messages.

• Transcription Data: where the transcription feature is enabled, audio data (voice of participants who are not muted) is processed in order to generate a written transcript of what was said during the meeting.

• Microsoft Copilot in Teams: when Copilot is activated, the information processed is the audio (spoken words of all participants in the meeting) and the identity of each speaker to attribute comments and actions correctly. This includes your name and any profile information visible about you in the meeting.

4. Purposes and Legal Basis of the Processing

We process personal data only to the extent permitted by law and necessary for the relevant purposes. In the context of Microsoft Teams meetings, personal data collected through the use of recording, transcription, and Copilot in Teams is processed in a proportionate and transparent manner and solely for clearly defined and legitimate business purposes. The specific purposes for which the relevant Data Categories are processed, as well as the applicable legal bases are as follows:

Purposes	Legal Bases
Training purposes: to support the preparation of training materials and ensure the quality, consistency, and effectiveness of meetings and related processes.	Art. 6(1)(f) GDPR (legitimate interest), and where applicable Art. 6(1)(c) GDPR (legal obligation).
Project and operational purposes: to document meetings, track progress, ensure alignment on project goals, and verify completion of tasks.	Art. 6(1)(f) GDPR (legitimate interest).
Accessibility purposes (transcription only): to make meetings accessible to individuals with hearing impairments or those who prefer written content over listening.	Art. 6(1)(f) GDPR (legitimate interest), and where applicable Art. 6(1)(c) GDPR (legal obligation).
Documentation purposes (transcription only): to generate written records of meetings, including summaries, minutes, key discussion points, decisions, and action items for future reference.	Art. 6(1)(f) GDPR (legitimate interest).
Task management: to support the organization, assignment, decisions and follow-up of tasks arising from meetings.	Art. 6(1)(f) GDPR (legitimate interest).

5. Recipients or Categories of Recipients

Generally, personal data collected in the context of Teams recordings, transcriptions, and Copilot in Teams is not disclosed to third parties, unless such disclosure is necessary for the purposes described in this Privacy Notice or required by applicable law. In particular, personal data may be shared with the following recipients:

• Kia group companies: We may disclose your personal data to other companies that are members of the Kia group, including our affiliated companies in Europe and our parent company Kia Corporation in the Republic of Korea for our internal administrative purposes (Art. 6(1)(f) GDPR), or because it is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR). In some cases, the disclosure may also be based on your consent (Art. 6(1)(a) GDPR).

• Service provider (Microsoft): We may disclose your personal data to Microsoft Ireland Operations Limited and other companies of the Microsoft group, which provide Microsoft Teams and associated services, including recording, transcription, and Copilot in Teams. Microsoft processes personal data on behalf of Kia EU and, in certain cases, may act as an independent controller in accordance with its own privacy policies. Further information is available in Microsoft’s privacy statement: https://privacy.microsoft.com

• Courts and regulatory bodies: Personal data may be disclosed to courts, regulatory authorities, or other third parties where required by law or where necessary to establish, exercise, or defend legal claims.

• Others: In the context of Teams meetings, recordings, transcripts, summaries, and other outputs may be shared with participants and relevant stakeholders in accordance with the purposes described in this Privacy Notice.

6. International Transfer of Personal Data

Kia EU is part of an international group of companies. As a result, Teams meeting content and related personal data may be shared with Kia Corporation, 12 Heolleung-ro, Seocho-gu, Seoul, 06797, Republic of Korea (hereinafter referred to as “Kia HQ”), for internal purposes and based on Kia EU’s legitimate interest (Art. 6(1)(f) GDPR). Transfers of personal data to the Republic of South Korea take place on the basis of the European Commission’s adequacy decision pursuant to Article 45 GDPR. Therefore, personal data may be transferred outside the European Economic Area (“Third Country”), while ensuring an adequate level of protection. Appropriate technical and organisational safeguards are in place to protect personal data.

7. Data Retention

As a general rule, Teams meeting recordings and transcriptions are retained for a period of 45 days and are automatically deleted thereafter, unless a longer retention period is required or justified in individual cases.

8. Your Legal Rights

If you have any questions about our processing of your personal data, we are happy to provide you with the information about the personal data concerning you and the related processing activities.

Under the GDPR, you have the right to request access to your personal data and further information about our processing of your personal data (Art. 15 GDPR ). Subject to the legal requirements being met, you also have a right to obtain: (a) rectification of your personal data (Art. 16 GDPR ); (b) erasure of your personal data (Art. 17 GDPR ); and (c) restriction of processing of your personal data (Art. 18 GDPR ). You also have a right to data portability (Art. 20 GDPR ) and a right to lodge a complaint with a data protection authority (Art. 77 GDPR ).

Where we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time (Art. 7(3) GDPR) . The withdrawal of your consent will not affect the lawfulness of processing based on such consent before its withdrawal.

Your right to object : Where we process your personal data based on legitimate interests, you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR ).

To exercise your rights, you may contact us at any time using the contact details provided in sec. 2 above.

9. Definitions

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation). “Personal data” means any information relating to an identified or identifiable natural person.

“Process”/”Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Microsoft Teams” or “Teams” means the collaboration platform provided by Microsoft used for meetings, communication, recording, transcription, and related functionalities.
“Microsoft Copilot in Teams” or “Copilot” means the artificial intelligence functionality integrated into Microsoft Teams that generates outputs such as meeting summaries, transcripts, and task-related suggestions based on meeting content.

“Recording” means the capture and storage of audio, video, and shared content during a Microsoft Teams meeting.

“Transcription” means the automated conversion of spoken content during a Microsoft Teams meeting into written text.