The University of Luxembourg provides the Webex platform to allow for the holding and recording of virtual events or meetings and events or meetings with virtual participation (“Virtual Events”) organised by the University of Luxembourg within the University and between the University and other stakeholders.

This Information Notice describes how the University processes personal data when Virtual Events are recorded on Webex.

Webex is a cloud-based application provided by the University to users with the aim of offering more flexibility and improving communication and collaboration both within the University and between the University and external parties. One of the core capabilities in Webex includes the recording of Virtual Events which are hosted on Webex on the University’s behalf. The University remains responsible for the Virtual Event recordings and access to such recordings are provided by the Event Organizer to University staff members and external parties in accordance with its internal policies for the following specific purposes:

• To have a record of the meeting and potential transcript of Event Organisers’ and participants’ meeting contributions where agreed;
• To record online webinars or other meetings held for training purposes in the context of learning and development activities; and/or
• To support participant accessibility where agreed, for example when meeting participants cannot attend a meeting, are on leave, or suffer from bad connectivity during Virtual Events.

There are specific cases when recordings are not acceptable, in cases where matters involving personnel information warranting special protection to preserve its privacy are being discussed.

The legal basis for processing of your personal data may be any of the following:

• Processing is necessary for the performance of a contract to which the University is a party; and/or
• Processing is in the legitimate interest of the University, for the purpose of the effective execution of Virtual Events.

It is therefore not necessary to obtain consent from Virtual Event participants about the Event recording as a legal basis for the personal data processing.

Normally Event Organisers are responsible for making decisions on the following:

• Need to hold a Virtual Event, the topic, agenda and list of participants;
• Whether a Virtual Event needs to be recorded;
• Defining the purpose of the Virtual Event recording;
• Applying and monitoring the University’s internal retention rules with respect to recordings captured as an official record;
• Further identifying, classifying and labelling personal data processed during that recording, for its management and retention and for ensuring compliance.

The task of setting up the meeting may be performed by other University staff in their specific administrative capacities on behalf of the Event Organiser.

In case you have any queries or requests relating to the processing of your personal data recorded during this Virtual Event, you can contact the Event Organiser.

Please read Webex’s privacy statements for further information on the data that Webex collects from you and how they use this data.

• Webex Privacy Statement

When recording using Webex, the following personal data may be subject to processing:

• Information of the participant: first name, last name, telephone number, profile picture, affiliation, the University organisational unit, email address;
• Meeting metadata: topic, description, participant IP-addresses, device/hardware information;
• When recorded: voice and video of the participant, file of all video, audio and presentation recordings, audio recording files, text file of the meeting chat, audio transcription; and/or
• When dialling in with a phone: information about the incoming and outgoing telephone number, start and end time.

Virtual Event participants will be informed transparently ahead of time that the Virtual Event content shall be recorded, preferably at the time of the invitation, which is included in the event information sheet or email with registration link. Additionally, and in particular in cases where providing advance notice is not possible, event participants will be informed orally at the beginning of the event about the planned recording.

The University will hold the Virtual Event recording for the retention period specified by the Event Organiser. Such recordings will be retained only for the time necessary to fulfill the specified purpose(s).

If the Virtual Event is being recorded for the purpose of establishing an accurate record, the recording may be captured as a University official record. Such a record will be kept in line with the University’s internal records retention schedule(s).

We implement appropriate organisational, administrative, physical and technical measures to protect the security of personal data from unauthorised or accidental access, damage, loss, disclosure or other risks presented by data processing.

The recording shall be classified and processed in accordance with privacy, information security and personnel policies. Before saving the file of the recording, the Event Organiser will ensure that that access to the information is properly protected in line with its classification.

Virtual Event recordings will only be shared with Virtual Event participants and authorised University personnel specified by the Event Organiser in line with its classification.

Virtual Event participants from the University may access Webex Virtual Events recordings from the Details tab of the meeting event. External Virtual Event participants will be able to view the Virtual Event recordings once the Event Organiser provides respective access from a storage place set up for external sharing following the standard University security policy.

Virtual Event recordings on Webex will not be shared with third parties unless the University satisfies itself that the third party affords appropriate protection for the personal data processed in the context of this recording.

Virtual Event participants may always request access to Virtual Event recordings, including information on how to request access, verification, rectification, and/or deletion of their personal data, insofar as the specified purpose for which personal data is processed is not frustrated. For all such requests, please contact the Event Organiser.