MS Teams Privacy Notice

1. Introduction

This privacy notice (“Privacy Notice ”) is issued by each of the Kia group members listed in section 10 below (“Kia Europe Group ”). The protection of your personal data is of the utmost importance to each member of the Kia Europe Group.

The purpose of this Privacy Notice is to inform you about the processing of your personal data by the relevant member of the Kia Europe Group in connection with the use of the video conferencing tool Microsoft Teams (“Teams ”). The Kia Europe Group members use Teams to set up and carry out video (conference) calls (which also provides for the option to use the chat function during the relevant call), including online meetings and seminars (“Video Calls ”).

2. Controller

The relevant member of the Kia Europe Group that has set up the Video Call (“Relevant Kia Entity ”) is the independent controller of the personal data processed in accordance with this Privacy Notice, unless expressly stated otherwise. The contact details of each member of the Kia Europe Group are provided in section 10 below.

3. Data Protection Officer

If you have any questions about or in connection with this Privacy Notice, you may also contact the Relevant Kia Entity’s data protection officer (“DPO ”). The contact details of each Kia Europe Group member’s DPO are also provided in section 10 below.

4. Categories of Personal Data

The types of personal data that the Relevant Kia Entity processes may fall under any of the categories set out below (the “Data Categories ”) and are also subject to the content and information that you share with the Relevant Kia Entity in connection with the relevant Video Call:

• • User Data: data that relate directly to you as a user of Teams (e.g., login data, profile picture, user name, language preference);
• • Contact Data: data that enable communication (e.g., email address, telephone number);
• • Communication Data: data that form the content of communication (e.g., content of chats or information shared with other participants using the function of screen sharing) and data that relate directly to your use of your camera and/or microphone;
• • Usage Data: metadata (e.g., IP address, date, time of call, location).

5. Purposes and Legal Basis of the Processing

The Relevant Kia Entity processes the Data Categories listed above to set up and carry out Video Calls.
Insofar as the relevant Video Call is necessary in connection with a contract that you have entered into with the Relevant Kia Entity, or to take steps prior to entering into a contract with the Relevant Kia Entity, the Relevant Kia Entity’s legal basis for the processing of the personal data is Art. 6(1)(b) GDPR .
If the legal basis of Art 6(1)(b) GDPR does not apply to the Relevant Kia Entity’s processing of your personal data, the Relevant Kia Entity processes the relevant personal data on the basis of its legitimate interests (Art. 6(1)(f) GDPR) , which is to have an efficient way of communicating with you.
Please note that the Relevant Kia Entity will never record any of the Video Calls with you, without having communicated this with you in advance and having obtained your prior valid consent for such recording. In such case, the legal basis would be Art. 6(1)(a) GDPR.

6. Disclosure of Personal Data to Third Parties

Generally, the personal data collected in relation to Video Calls will not be disclosed to third parties , unless such data has expressly been shared for such purpose. However, in certain cases it may be necessary to share certain data with the Microsoft Teams service provider (namely, the Microsoft Corporation or other affiliates of the Microsoft group). This will be done solely in connection with the purposes set out above.
Microsoft will process such data: (a) to provide Teams in accordance with the Relevant Kia Entity’s documented instructions; and (b) for its legitimate business operations in connection with its delivery of Teams to the Relevant Kia Entity (e.g., billing and account management; combatting fraud; compliance with legal obligations). To the extent Microsoft processes the relevant personal data for its legitimate business operations as set out under (b), Microsoft is an independent controller in this respect and responsible for the added responsibilities of a controller under the GDPR. Microsoft’s privacy notice is available here: https://privacy.microsoft.com/en-ca/privacystatement

7. International Transfer of Personal Data

Any content data will be stored in data centres located in the European Union . However, it may also be required for the purpose of using the Teams service to transfer certain personal data to Microsoft Corporation in the United States. The United States do not provide an adequate level of protection for personal data. Therefore, all transfers to Microsoft Corporation in the United States are governed by the EU Standard Contractual Clauses , a copy of which can be requested at it-service-desk@kia.eu . The EU Standard Contractual Clauses have been supplemented with an addendum which provides additional safeguards to the Relevant Kia Entity and additional redress to the data subjects to whom the relevant personal data relates. With respect to any transfer of personal data from the United Kingdom to the European Union and for which Kia UK LTD is the controller, the relevant basis for such transfer is the UK adequacy regulation for the European Union and the European Economic Area.

8. Data Retention

The Relevant Kia Entity will only process your personal data for as long as it is necessary for the purposes set out in this Privacy Notice or as required by applicable law. Usually, this means that any Personal Data will be deleted at the latest within 180 days from collection or creation. When determining the retention period, the Relevant Kia Entity takes into account the purposes for which it processes the relevant personal data and whether such purposes can be achieved without the data, the categories of the relevant data, risks in the event of a data breach and legal obligations that require the Relevant Kia Entity to retain the data.

9. Your Legal Rights

If you have any questions about the Relevant Kia Entity’s processing of your personal data, the Relevant Kia Entity is of course happy to provide you with the information about the personal data concerning you and the related processing activities (Art. 15 GDPR). Subject to the legal requirements being met, you also have a right to obtain: (a) rectification of your personal data (Art. 16 GDPR); (b) erasure of your personal data (Art. 17 GDPR); and (c) restriction of processing of your personal data (Art. 18 GDPR). You also have a right to data portability (Art. 20 GDPR) and a right to lodge a complaint with a data protection authority (Art. 77 GDPR). Where the Relevant Kia Entity processes your personal data on the basis of your consent, you have the right to withdraw your consent at any time (Art. 7(3) GDPR).
Your right to object : Where the Relevant Kia Entity processes your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Furthermore, where the Relevant Kia Entity processes your personal data for direct marketing purposes, you have a right to object to such processing at any time (Art. 21(2) GDPR).

10. Details of Controllers *

11. Tips for better Video Conferencing

When sharing your screen on a Video Call, you should make sure that except for the document or information you intend to show to the other participants on the call, no other data can be seen . You should also close all other email and messenger programmes to avoid that any other content is shared with or shown to the other participants (including notifications of receipt of email and/or messages). It is also advisable that you use a virtual background to keep your privacy (in particular, when attending a Video Call from home). Please always check your surroundings and make sure that other people in the background cannot be seen or heard . The same applies to personal items.
Lastly, please note that the processing of special categories of personal data (e.g., health data or political opinions) is only permitted under certain conditions and should be avoided . Please refrain from communicating any of such data on a Video Call with any member of the Kia Europe Group.

12. Definitions

“controller ” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
“GDPR ” means (i) with respect to Kia UK LTD as a controller, Regulation (EU) 2016/679 as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended from time to time (also known as the UK GDPR); and (ii) with respect to any of the other Kia Europe Group members listed in section 10, the Regulation (EU) 2016/679 (General Data Protection Regulation).
“personal data ” means any information relating to an identified or identifiable natural person.
“process ”/ ”processing” means any operation or set of operations which is performed on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.