In this privacy notice, we explain how we process your personal data in connection with AI-powered transcription and minute-taking for business meetings. For additional information regarding the handling of your personal data, please refer to the general privacy policy on our website: https://www.rwu.de/kontakt/datenschutz
Name and Address of the Data Controller
Data controller within the meaning of Article 4(7) of the GDPR:
Ravensburg-Weingarten University of Applied Sciences
Doggenriedstraße 70
D - 88250 Weingarten
Represented by: Rector Professor Dr.-Ing. Thomas Spägele
Tel: 0049 (0) 751/501-9344
Email: info@rwu.de
Website: https://www.rwu.de/
External Data Protection Officer
Our external data protection officer can be reached at:
Name: Benedict Lenz
Email: dsb@rwu.de
Website: https://www.exacon-gmbh.de
Information on Data Processing
Nature and Purpose of Processing
During official meetings, the university may use AI-powered systems to automatically transcribe conversation content and generate summaries, meeting minutes, results, tasks, or other structured documentation from it.
To this end, the content spoken during the meeting is processed in real time and automatically converted into text. This processing serves to support and partially automate the manual creation of meeting minutes, as well as to ensure consistent and traceable documentation of meeting outcomes.
AI-supported meeting minutes can be used in particular in administration, research, and teaching, as well as in inter-university projects.
Processing is generally carried out via real-time transcription. No permanent audio recording of the spoken word is created as part of this process. The audio data required for this purpose is processed exclusively for a short period during real-time transcription and is subsequently discarded.
The texts generated from the transcription can then be automatically structured, summarized, and prepared for the creation of meeting minutes by the AI system used. AI-generated content is not adopted as binding documentation without review; rather, it can be reviewed by the responsible individuals and corrected as necessary before further use.
Data Categories
In the context of AI-assisted transcription and minute-taking, the following categories of personal data, in particular, may be processed—depending on the content and purpose of the respective meeting:
- Personal identification data: e.g., last name, first name, title
- Electronic identification and account data: e.g., user account, email address, technical identification data
- Organizational and employment data: e.g., position, organizational unit, faculty or department affiliation, functional area affiliation
- Work and project data: e.g., tasks, responsibilities, project-related information, meeting outcomes
- Communication and conversation content: all content spoken during active real-time transcription, as well as any transcripts, summaries, and minutes generated from it
- Audio data: temporarily processed speech and audio signals as part of real-time transcription; the audio signal is not permanently stored
- Optional information: additional personal information voluntarily provided by meeting participants during the conversation or as required by the situation
Depending on the subject matter and course of a meeting, special categories of personal data as defined in Article 9 of the GDPR may also be discussed, such as health data, information regarding political opinions, religious beliefs, or ethnic origin. It is not technically possible to limit real-time transcription to specific categories of data during an ongoing conversation.
Legal Bases
The processing of personal data in the context of AI-supported transcription and recording of business meetings is based on Article 6(1)(f) e of the GDPR in conjunction with Section 3a of the Baden-Württemberg State Data Protection Act (LDSG) and the legal provisions applicable to the specific context of the meeting. These include, in particular, § 15(1) of the Baden-Württemberg State Data Protection Act (LDSG) for meetings in an employment context, as well as § 12 of the Baden-Württemberg State Higher Education Act (LHG) for processing related to students.
To the extent that special categories of personal data pursuant to Article 9(1) of the GDPR are processed in the context of a meeting, the permissibility of such processing depends on the specific subject matter and purpose of the meeting and on a relevant exception under Article 9(2) of the GDPR. This may be the case, for example, when processing health data in an employment context under Article 9(2)(b) of the GDPR in conjunction with the relevant employment law provisions, or in the field of scientific research under Article 9(2)(j) of the GDPR in conjunction with the relevant research regulations.
Recipients and Transfers to Third Countries
The data processed as part of AI-assisted transcription and minute-taking is made available within the university only to those persons who require it for the respective official purpose. Transcripts, summaries, and meeting minutes may be shared, in particular, with meeting participants and other individuals to the extent necessary for the documentation, follow-up, or further processing of the discussed content.
External software providers and other technical service providers may be engaged for the technical implementation of transcription and meeting minutes. To the extent that these parties process personal data on behalf of the university, they are engaged as data processors in accordance with Article 28 of the GDPR and may process the data exclusively within the scope of the contractually specified purposes and instructions.
To the extent that the processing of personal data in connection with the technical service providers takes place outside the European Union (EU) or the European Economic Area (EEA), such processing occurs only in compliance with the specific requirements of Articles 44 et seq. of the GDPR. In particular, an adequacy decision by the European Commission or appropriate safeguards pursuant to Article 46 of the GDPR may be used for this purpose.
Retention Period
The audio data processed as part of real-time transcription is not stored permanently but is discarded immediately after technical processing.
For transcripts, summaries, meeting minutes, and documentation derived therefrom, the retention period depends on the specific purpose of processing as well as the applicable legal, organizational, or technical retention and deletion periods. Personal data is deleted as soon as it is no longer necessary for the respective purpose and there are no legal or other retention obligations that prevent its deletion.
Consequences of Withholding Consent
Participation in business meetings is generally not contingent upon consent to AI-assisted transcription and minute-taking, as the processing is based on a legal basis. Separate consent is therefore not required for regular use.
If you object to the processing for reasons arising from your specific situation, we will assess whether, in the specific case, there are compelling legitimate grounds for continued processing or whether the meeting can be conducted without AI-assisted transcription or documented in another manner.
Functions for biometric speaker identification or speaker recognition are used only on the basis of explicit consent. If such consent is not granted, these functions may not be used.
Automated Decision-Making
Automated decision-making within the meaning of Article 22 of the GDPR does not take place. Should we use automated decision-making procedures in individual cases in the future, we will provide separate notice of this to the extent required by law.
Your Rights as a Data Subject
Data subjects may contact the data controller or the data protection officer directly with any questions regarding data protection and the processing of their personal data.
Right of Access (Art. 15 GDPR)
You may request information about your stored data.
Right to Rectification (Art. 16 GDPR)
You may request that inaccurate data be corrected.
Right to erasure (Art. 17 GDPR)
You may request that we erase your data, provided the legal requirements are met.
Right to Restriction of Processing (Art. 18 GDPR)
You may request that the processing of your data be restricted, provided the legal requirements are met.
Right to Data Portability (Art. 20 GDPR)
To the extent technically feasible, you have the right to receive your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
You may object to the processing of your data at any time for reasons arising from your particular situation, provided that the processing is based on Art. 6(1)(e) or (f) of the GDPR.
Right to Withdraw Consent (Art. 7(3) GDPR)
If you have given your consent todata processing, you may withdraw it at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to the withdrawal. Please direct your withdrawal to the contact information provided for the Data Protection Officer or the data controller.
Timeframes for Complying with Data Subjects’ Rights
We generally strive to respond to all requests within 30 days. However, this timeframe may be extended for reasons related to the specific right of the data subject or the complexity of your request.
Competent Supervisory Authority
We take your concerns and rights very seriously. However, if you believe that we have not adequately addressed your complaints or concerns, you have the right to file a complaint with a competent data protection authority:
The State Commissioner for Data Protection and Freedom of Information
P.O. Box 10 29 32
70025 Stuttgart
Phone: 07 11/61 55 41-0
Fax: 07 11/61 55 41-15