Privacy Notice for Recording, Transcribing, and Processing Data in Microsoft Teams Meetings Using Copilot and Standard Functionality

1. Introduction

Kia Europe GmbH (“Kia EU ”, “we ”, “us ”, “our ”) processes personal data when it records and/or transcribes Microsoft Teams (“Teams ”) meetings, including where standard Teams functionality and Microsoft Copilot (“Copilot ”) are used. This Privacy Notice explains how Kia EU processes personal data in this context. It is addressed to individuals outside of Kia EU whose personal data may be processed when participating in Teams meetings organised or hosted by Kia EU (“you ”, “your ”). This includes any participants in Teams meetings (e.g. workshops, trainings, webinars, or similar business events conducted via Teams) such as:

  • (potential) customers and other individuals with whom we communicate in a professional context, including their employees, representatives, consultants, and advisors;

  • business partners , such as vendors, service providers, affiliated entities, and Kia dealers, as well as their employees, representatives, consultants, and advisors;

  • other external participants who join a Teams meeting hosted by Kia EU, regardless of whether a direct contractual or business relationship exists; and

  • any other individuals whose audio, video, name, image, or other personal data may be processed through the recording, transcription, or related functionality of Teams during such meetings.

  This Privacy Notice applies exclusively to the processing of personal data in the context of:
  • Audio and video recordings of Teams meetings;
  • Automated transcription of spoken content; and
  • Related processing performed within Teams, including the use of Copilot features where enabled.

  This Privacy Notice supplements Kia EU’s general Microsoft Teams Privacy Notice, which continues to apply to the general use of Teams.

  Please note that, in addition to this Privacy Notice, where appropriate, we may inform you about the processing of your personal data separately, for example in consent forms or additional privacy notices.

2. Controller

Kia EU is the controller of the personal data processed in accordance with this Privacy Notice, unless expressly stated otherwise.

Contact Details
Kia Europe GmbH
Theodor-Heuss-Allee 11
60486 Frankfurt am Main, Germany
Email: info@kia-europe.com

If you have any questions about or in connection with this Privacy Notice, you may also contact our Data Protection Officer ("DPO ") at:

Kia Europe GmbH
- Data Protection Officer -
Theodor-Heuss-Allee 11
60486 Frankfurt am Main, Germany
Email: dpo@kia-europe.com

3. Categories of Personal Data

The types of personal data processed by Kia EU in the context of Teams meetings depend on the features used during the meeting (e.g. recording, transcription, Copilot) and information you choose to share. Such processing may fall within the categories set out below (the “Data Categories ”) and is subject to the content and information that you provided in connection with the relevant Teams meeting. In particular:

  • User Data : data that relate directly to you as a user of Teams, such as your name and/or username, profile picture (associated with your Teams account), language preferences, and other profile information visible to meeting participants;

  • Contact Data : data that enable communication with you (e.g., email address, telephone number);

  • Communication Data : data that form the content of communication. Where the recording feature is enabled, this may include audio data (voice of participants when not muted), video data (images of participants when the camera is activated), and screen-sharing activity. Meeting recordings may also include any other content shared during the meeting, such as presentations, documents, or chat messages.

  • Transcription Data : where the transcription feature is enabled, audio data (voice of participants who are not muted) is processed in order to generate a written transcript of what was said during the meeting.

  • Microsoft Copilot in Teams : when Copilot is activated, the information processed is the audio (spoken words of all participants in the meeting) and the identity of each speaker to attribute comments and actions correctly. This includes your name and any profile information visible about you in the meeting.

4. Purposes and Legal Basis of the Processing

We process personal data only to the extent permitted by law and necessary for the relevant purposes. In the context of Teams meetings, personal data collected through the use of recording, transcription, and Copilot in Teams is processed in a proportionate and transparent manner and solely for clearly defined and legitimate business purposes. Depending on the specific Data Category and purpose concerned, we rely on different legal bases as set out below. The specific purposes for which the relevant Data Categories are processed, as well as the applicable legal bases, are as follows:

       

Purposes	Legal Bases
Recording (audio/video) for the creation of a recording, for the recording to be used for training purposes, project and operational purposes, or task management purposes.	Art. 6(1)(a) GDPR (consent)
Recording (audio/video) for the creation of transcription document, for the transcription document to be used for accessibility purposes, documentation purposes, project and operational purposes, or task management purposes.	Art. 6(1)(a) GDPR (consent) for the recording. Art. 6(1)(f) GDPR (legitimate interest) for the use of the respective transcription document. Our legitimate interests are: • in relation to accessibility purposes: ensuring that meeting content is accessible to participants and colleagues who may benefit from a written record of the discussion, including for reasons of language, hearing, or other individual needs; • in relation to documentation purposes: maintaining reliable and accurate internal records of business discussions and decisions, for continuity, internal accountability, and reference purposes; • in relation to project and operational purposes: ensuring the efficient and effective delivery of our projects and day-to-day business operations, including by allowing teams to accurately refer back to matters discussed and agreed during a meeting; • in relation to task management purposes: enabling the identification, allocation, tracking, and follow-up of tasks and action items arising from meetings, so that agreed actions are carried out.

5. Recipients or Categories of Recipients

Generally, personal data collected in the context of Teams recordings, transcriptions, and Copilot in Teams is not disclosed to third parties, unless such disclosure is necessary for the purposes described in this Privacy Notice or required by applicable law. In particular, personal data may be shared with the following recipients:

  • Kia group companies: We may disclose your personal data to other companies that are members of the Kia group, including our affiliated companies in Europe and our parent company Kia Corporation in the Republic of Korea for our internal administrative purposes (Art. 6(1)(f) GDPR), or because it is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR). In some cases, the disclosure may also be based on your consent (Art. 6(1)(a) GDPR).

  • Service provider (Microsoft): We may disclose your personal data to Microsoft Ireland Operations Limited and other companies of the Microsoft group, which provide Teams and associated services, including recording, transcription, and Copilot in Teams. Microsoft processes personal data on behalf of Kia EU and, in certain cases, may act as an independent controller in accordance with its own privacy policies. Further information is available in Microsoft's privacy statement: https://www.microsoft.com/de-de/privacy

  • Courts and regulatory bodies: Personal data may be disclosed to courts, regulatory authorities, or other third parties where required by law or where necessary to establish, exercise, or defend legal claims.

  • Others: In the context of Teams meetings, recordings, transcripts, summaries, and other outputs may be shared with participants and relevant stakeholders in accordance with the purposes described in this Privacy Notice.

6. International Transfer of Personal Data

Kia EU is part of an international group of companies. As a result, Teams meeting content and related personal data may be shared with Kia Corporation, 12 Heolleung-ro, Seocho-gu, Seoul, 06797, Republic of Korea (hereinafter referred to as “Kia HQ”), as referenced above. Transfers of personal data to the Republic of Korea take place on the basis of the European Commission’s adequacy decision pursuant to Article 45 GDPR. Therefore, personal data may be transferred outside the European Economic Area (“Third Country”), while ensuring an adequate level of protection. Appropriate technical and organisational safeguards are in place to protect personal data.

7. Data Retention

As a general rule, Teams meeting recordings and transcriptions are retained for a period of 45 days and are automatically deleted thereafter, unless a longer retention period is required or justified in individual cases.

 In exceptional cases, recordings and transcriptions may be retained for a longer period where necessary for a documented business, legal, compliance, audit, training, project documentation, or dispute management purpose. Such recordings and transcriptions will be deleted once they are no longer required for that purpose.

8. Your Legal Rights

If you have any questions about our processing of your personal data, we are happy to provide you with the information about the personal data concerning you and the related processing activities.

 Under the GDPR, you have the right to request access to your personal data and further information about our processing of your personal data (Art. 15 GDPR ). Subject to the legal requirements being met, you also have a right to obtain: (a) rectification of your personal data (Art. 16 GDPR ); (b) erasure of your personal data (Art. 17 GDPR ); and (c) restriction of processing of your personal data (Art. 18 GDPR ). You also have a right to data portability (Art. 20 GDPR ) and a right to lodge a complaint with a data protection authority (Art. 77 GDPR ).

 Where we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time (Art. 7(3) GDPR ). The withdrawal of your consent will not affect the lawfulness of processing based on such consent before its withdrawal.

 Your right to object : Where we process your personal data based on legitimate interests, you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR ).

  To exercise your rights, you may contact us at any time using the contact details provided in sec. 2 above.

9. Definitions

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

 “GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation). “Personal data” means any information relating to an identified or identifiable natural person.

 “Process”/”Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

  “Teams” has the meaning given to it in section 1.

 “Microsoft Copilot in Teams” or “Copilot” means the artificial intelligence functionality integrated into Teams that generates outputs such as meeting summaries, transcripts, and task-related suggestions based on meeting content.

  “Transcription” means the automated conversion of spoken content during a Teams meeting into written text.