On this page, you will find privacy information on the creation of Microsoft accounts for use by RWTH students.

1. Controller responsible for data processing
2. Data Protection Officer
3. General information on data processing
4. General information
5. Rights of data subjects

1. Controller responsible for data processing

The controller within the meaning of the EU General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:

Rector of RWTH Aachen University
Templergraben 55
52062 Aachen (street address)
52056 Aachen (mailing address)
Email: (Send an email to:) rektorat@rwth-aachen.de
Website: www.rwth-aachen.de/rektorat (opens in new tab)

Responsible office for internal processing:

IT Center of RWTH Aachen University
Seffenter Weg 23
52074 Aachen
Email: (Send an email to:) servicedesk@itc.rwth-aachen.de
Website: www.itc.rwth-aachen.de (opens in new tab)
 

2. Data Protection Officer

Contact details for the officially appointed Data Protection Officer:

Data Protection Staff Unit of RWTH Aachen University
Templergraben 83
52062 Aachen (street address)
52056 Aachen (mailing address)
Germany
Email: (Send an email to:) dsb@rwth-aachen.de
Website: www.rwth-aachen.de/datenschutz (opens in new tab)
 

3. General information on data processing

Scope of use

M365 account (use of the Microsoft account for licensing M365 applications).

Scope of personal data processing

Like other software manufacturers, Microsoft uses licenses assigned to individual users. Therefore, a personal Microsoft account is required to use Microsoft 365 (M365). This RWTH Microsoft account is created by the IT Center based on your data from the RWTH Identity Management system and is managed by the IT Center.

For RWTH students, the Microsoft account is created after activation via IdM Selfservice. This account allows you to use M365 and the Microsoft products licensed to you for as long as and to the extent that they are provided by RWTH and for as long as you are a student at RWTH.

Purpose of data processing

The provision of M365 includes the use of licensed products and services, the provision of updates, ensuring information security, and technical and customer-related support. Usage also generates statistics and discloses data to Microsoft which, according to Microsoft's DPA from April 2025, is used for the following purposes:

• Billing and account management
• Compensation, such as calculating employee commissions and partner incentives
• Internal reporting and business modeling, such as forecasting, revenue, capacity planning, and product strategy
• Financial reporting

Current and archived versions of the DPA are available for download on the Microsoft Products and Services Data Protection Addendum (DPA) (opens in new tab) page.

Data is transferred on the basis of a data processing agreement and the EU-US Data Privacy Framework. If the adequacy decision is declared invalid, Microsoft's Standard Contractual Clauses will be used.

As part of the Microsoft EU Data Boundary, RWTH has chosen data residency in the EU. 

Providing the data is necessary to use the service. If the data is not provided, the service cannot be used.

Anonymized usage statistics are generated. RWTH does not monitor performance or behavior based on your use of your M365 account. Likewise, no decisions are made based on automated processing within the meaning of Art. 22 GDPR. 

Visibility of your activities

Since the RWTH Microsoft account is an online account and M365 is a cloud-based service offering a very broad range of software and services, it is not possible to provide a definitive assessment of the visibility of your activities. The following section addresses the most commonly used applications and the activities that may be visible.

Your activities may be visible whenever you collaborate with other users in MS Teams.

Other users can search for and invite you in MS Teams. Your name and other data from your RWTH Microsoft account may be visible in this context.

When collaborating on documents, changes that you or others make to shared documents, as well as metadata such as modification times, may be visible.

User profile

Initially, your RWTH Microsoft account only contains your first and last name, the RWTH email address stored in your user account, and your affiliation status with RWTH. Some services allow you to add further information to your user profile yourself. However, we advise against doing so because this information is not required to use the services. Any such additions are voluntary, but should be avoided in accordance with the principle of data minimization.

Data categories and data subjects

The following data categories (1-6) are processed and stored when using M365:

1. Basic personal and contact data (email address, last name, first name, cloud ID)
2. Profiling (data generated when using the license: last use of the license, date and name of edited files
3. Access log file (data about the device used: device, operating system, IP address, access date) and system-generated log data (access and modification history, file name
4. Documents and files (data that users independently store in the cloud, e.g., chat content, author and creation date, author and modification date)
5. MFA methods (e.g., phone number, authenticator app, one-time password)
6. Microsoft Teams groups (first and last name, cloud ID, online activity if not disabled)

When using M365, the data of the following data subjects is processed and/or stored to the extent specified:

• Persons who use M365 online (data categories 1-6)
• Persons who can be identified in communications and documents (data categories 2, 3)
• Persons who use Office 365 locally (data categories 1, 2, 3, 5)

Legal basis for the processing of personal data

Legal basis for data processing

The provision of M365 and its use by RWTH students is based on the following legal basis:

Art. 6(1), sentence 1, lit. a), i.e., use of M365 by students with consent to data processing.

Data deletion and retention period

In general, the accounts of RWTH students are automatically deleted when the corresponding status in IdM is lost, e.g., when leaving the University. The following deletion periods apply to data stored by Microsoft:

To allow the account to be restored, data in data categories 1, 2, 3, 5, and 6 is stored for an additional 30 days after the account is deleted, but is then only visible to administrators.

Documents and files (data category 4) can either be deleted manually by the user or are automatically deleted when the account is deleted. To allow users or administrators to restore data in the event of accidental deletion, this data is stored for an additional 30 days, but is no longer visible to other users.

In collaborative workspaces (data categories 4, 6), data is generally retained for as long as the workspace exists. The data must be deleted manually.

Data in data category 3 is generally deleted after 180 days.
 

Groups of persons or individuals authorized to access the data

Persons authorized to access the data are generally employees of the responsible office who, due to their position or function, have access to specific data relevant to their duties:

• Administrators have full access to all data categories for the purpose of managing the tenant.
• Support staff have read access to data in the user directory from all data categories for support purposes.
• MS Teams users who belong to an MS Teams group can view personal data from data categories 4 and 6 of other MS Teams users in that group, both internal and external. Guests within the group can also view the specified data.
• RWTH members who use MS Teams can use the search function in MS Teams to view personal data from data category 6 of other RWTH MS Teams users.
• When collaborating with external partners: the external partner as a "guest" with the appropriate authorization (invitation) by RWTH users (data categories 4, 6)
   

Other recipients of the data

• Microsoft Ireland Operations Limited, for the purposes of data processing and contract fulfillment
• Microsoft Corporation, for the purposes of data processing, contract fulfillment, and its own purposes

4. General information

• M365 is operated by Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052.
• When using M365, the Microsoft Terms of Use (opens in new tab), the Microsoft Product and Online Services Terms (opens in new tab), and the RWTH Terms of Use for M365 apply.
• Microsoft's privacy information for M365 can be found on the Microsoft Privacy Statement (opens in new tab) page.
   

5. Rights of data subjects

Pursuant to Article 15 et seq. GDPR and subject to the conditions defined therein, you have the right to obtain information about the personal data concerning you, as well as the right to rectification or erasure, restriction of processing, the right to object to processing, and the right to data portability. Pursuant to Article 77 GDPR, you also have the right to lodge a complaint with the data protection supervisory authority (opens in new tab) if you believe that the processing of personal data concerning you violates this Regulation.

Please note: This is an english translation of the original german version. In the event of any discrepancies or questions regarding its interpretation, the german version shall prevail.