World-class privacy

To fulfil the requirements of Art. 30 GDPR, TeamViewer implemented Records of Processing Activities (RoPA). It is the central document of the data protection management system which takes into account any processing of customer, employee, contractor, and visitor data handled by TeamViewer and processed by TeamViewer or our processors.

The RoPA is actively and regularly maintained on a departmental basis and is also centrally administered by the legal department for which TeamViewer uses a data management software.

TeamViewer has implemented and follows a 2-step risk assessment process with a well-founded process-related data protection analysis to meet the data protection risk management requirements of GDPR (Art. 35 and 36). This process includes a pre-assessment and, if necessary, a Data Protection Impact Assessment (DPIA) for each process documented in the Records of Processing Activities (RoPA).

To support our DPIA process as well as document the DPIAs conducted, TeamViewer uses a data management software.

To fulfil the requirements of Art. 15-21 GDPR, TeamViewer determined the department Customer Support to manage all incoming Data Subject Requests (DSR). TeamViewer mainly receives Data Subject Requests via web form or email at privacy@teamviewer.com.

Requests via letter, fax, and phone are less common. In addition, TeamViewer has an established process for handling DSR by employees, which is overseen by the HR department.

TeamViewer has implemented an appropriate level of security through established Technical and Organizational Measures (TOMs) that ensure that the requirements of Art. 32 in conjunction with Art. 25 GDPR are met.

We demonstrate compliance by having adopted internal policies and implemented TOMs which meet in particular the data protection risks identified.

These measures include: Minimizing the processing of personal data in pursuance of the proportionality and necessity, pseudonymising personal data as soon as possible; transparency with regard to the functions and processing of personal data and establishing and improving security features.

TeamViewer systematically takes into account the right to data protection when developing and designing our products, services, and applications. We also implement appropriate Technical and Organizational Measures within the operations regularly.

The description of these TOMs can be found as Annex 2 to the Data Processing Agreement.

TeamViewer has established a systematic contractual framework that requires appropriate contracts to be concluded and archived. To fufill Art. 26-28 GDPR the process includes controls to ensure appropriate contracts of sufficient type and quality are entered into. This ensures data protection obligations are in place with third party suppliers, partners/resellers, and between TeamViewer Group companies.

When entrusting a processor with processing activities, TeamViewer only employs processors that provide sufficient guarantees, including for the security of processing, and implement Technical and Organizational Measures (TOMs) which will meet the requirements of GDPR and the additional requirements of TeamViewer. TeamViewer uses the above mentioned contractual framework to systematically pre-assess sub-processors. TeamViewer’s sub-processors are located within the EEA with the exception of additional features, against separate order or activation of function modules. Further details can be found in Annex 3 to the Data Processing Agreement.

Handling of data protection issues is the responsibility of all employees within the TeamViewer organization, with established accountability for defined topics by the Senior Leadership Team (SLT) and the Board of Management.  The company’s Management  Board and the Audit Committee of the Supervisory Board also receive regular formal data protection reports.

On top of that, our departmental GDPR leads, with additional support from our legal department, function as first contact for our employees within each department to ensure company-wide GDPR compliance.

The TeamViewer SE and its affiliates, including TeamViewer Germany GmbH (“TeamViewer”), takes the protection of personal data very seriously. Therefore, data protection is one of our compliance focus areas as described in our Compliance Policy which sets the tone from the top for compliance with EU general data protection regulations.

“Think Privacy” demonstrates our commitment to data protection and is the overall objective when implementing new processes and products in which we handle personal data.

See our General Privacy Notice to learn more about our purposes of data processing.

TeamViewer has an established deletion concept which is overseen centrally and actively maintained on an ongoing basis at a departmental level, including retention periods and timelines to ensure a consistent approach to data deletion.

Additionally, once a year during the company-wide data deletion month all employees are requested to delete the unstructured data they keep in their systems and are responsible for.

These concerted and systematic efforts address the requirement that in terms of GDPR personal data may only be stored as long as it is required for the purpose for which it is processed (Art. 25 (2) and Art. 5 (1 lit b and e) GDPR in conjunction with recital 39 and 66).

TeamViewer has established a streamlined data breach notification process in accordance with Art. 33 and 34 GDPR. The process includes the exact and comprehensive documentation of each incident by using a standardized template.

In addition, a detailed risk assessment is done by the legal department in accordance with the risk assessment matrix provided by the body of the independent German data protection supervisory authorities of the federal and state governments (DSK Kurzpapier Nr. 18 Risiko für die Rechte und Freiheiten natürlicher Personen).

Each incident is assessed within the target time frame of 72 hours and concludes with a decision of whether the regulating authorities or the affected individuals need to be notified. TeamViewer management is informed about all incidents and internal records are maintained.