Privacy Statement Continuing Education
This privacy statement is specifically intended for participants of and those interested in continuing education at Utrecht University (UU).
UU aims to handle the personal data of everyone who participates in our education or shows interest in one of the programmes we offer with care.
In this privacy statement we inform you in general terms about the personal data we process, the purposes for which we do so, your privacy rights and other matters that may be of interest to you.
The personal data we collect from you will be processed by UU for the following purposes:
- To assess whether participants meet the admission criteria;
- To register participants;
- To create a personal account for participants that allows them to log into the online learning environment for OvP (Osiris);
- To enable participants to download and use study materials;
- For awarding and issuing diplomas or (partial) certificates;
- To send practical information to participants, for example when due to unforeseen circumstances there is a change in the program;
- To process payments;
- To maintain OvP alumni registration;
To send newsletters to those interested in our programmes.
When you participate in an OvP course, the following personal data about you may be processed:
- First and last name;
- Gender;
- Date of birth;
- Country of birth;
- City of birth (optional);
- Nationality;
- E-mail address;
- Phone number;
- Street name and house number;
- Postal code;
- City;
- Language;
- Student number;
- Copy of proof of identity;
- (Business) invoice details;
- Status of payment, date of payment, amount paid etc.
- Job title;
- Educational level;
- Data necessary for admission;
- Content of correspondence.
When you indicate through professionals.uu.nl that you want to be kept informed about our programmes or place yourself on the waiting list, the following data are processed:
- First name;
- Insertions (optional);
- Last name (optional);
- E-mail address;
- Organization (optional);
- Job title (optional);
- Field of interest (optional).
UU collects (personal) data directly from you, but in appropriate cases, UU also receives personal data through third parties. This only happens in accordance with the law or when you have specifically given your consent.
UU may only process your personal data on a basis that is specified by law. UU processes your personal data on the following basis(s):
1. Performance of an agreement
The processing is necessary for the performance of an agreement we have entered into or will enter into with you or to comply with a legal obligation incumbent on us.
UU processes personal data listed above for the performance of the agreement we enter into with participants. In addition, we process financial data pursuant to the legal tax obligation. If UU wishes to process personal data for purposes other than those described above, UU will only do so if we have obtained consent or have a legitimate interest.
2. Legitimate interests
The processing is necessary to pursue the legitimate interests of UU or a third party.
UU processes your personal data on the basis of legitimate interest. This can be a legitimate interest of the UU or of a third party. That legitimate interest includes maintaining an alumni registration system and encouraging alumni connection with UU.
3. Consent
You have consented to this processing of your personal data, via a form on professionals.uu.nl.
Through our website it is possible to be informed about the programmes we offer. If you fill out a form on our website, we will notify you when the start date of a course is known or send you newsletters on programmes that match your interests.
UU does not retain your personal data longer than is strictly necessary to fulfill the purposes for which the data was collected. OvP therefore maintains the following retention periods:
- Personal data of participants will be kept for 50 years after completion of the course.
- Personal data of participants who have not fully completed their application or course will be kept for 1 year after the end date of the course.
- Your financial data will be kept for 7 years after the last payment due to legal retention requirements.
- Personal data of potential participants who have filled in the form to stay informed of our programmes or area of interest will be kept as you continue to show interaction with our mailings. Once you have been inactive for three years, we will delete your data.
UU may commission other organizations to provide certain parts of our services on our behalf. If such organizations process personal data as part of that assignment, we call them processors. UU makes agreements with these processors to ensure confidential and careful handling of personal data. These agreements are laid down contractually in so-called processor agreements.
Your personal data will never be rented or sold. However, the UU may share your (personal) data with third parties if, for example, you have given permission to do so or if this is necessary to perform an agreement between you and the UU.
The categories of third parties with which the UU shares personal data are:
- we have engaged them to process certain data;
- it is necessary to execute the agreement we have with you;
- we are required to do so by law (for example, if the police demands the data in case of suspected crime).
The parties that process personal data on our behalf are:
- ICT suppliers and service providers (e.g. Osiris and Azorus);
- Online tools for examination and evaluation;
- Payment provider;
- Collection agency.
Organizations involved in processing your personal data may also potentially be located outside the European Economic Area (EEA). Separate rules apply to countries located outside the EEA. Transfer may only take place to third countries with an adequate level of protection, this can be based on an adequacy decision of the European Commission, appropriate safeguards and or specific exceptions. If you would like to know more about this, please contact privacy@uu.nl.
The AVG gives you a large number of rights regarding your personal data. For example, you have the right to be informed promptly, clearly and completely about our processing of your data. Hence, among other things, this privacy statement. You also have the right to view your data and to have them corrected or deleted. In certain cases, you have the right to have the processing of your data temporarily frozen ("restricted"), the right to object to processing and the right not to be subjected to decisions resulting from fully automated processes (i.e., without human intervention) that could seriously affect you. And finally, in some cases, you have the right to have an entire set of data we hold about you transferred to another organization. This is called the right to portability.
If we process your data based on your consent, you have the right to withdraw this consent. This is possible at any time, even after we have already collected your data. Withdrawing consent is as easy as giving it, and you do not have to say why you are withdrawing your consent. Please note that if you withdraw your consent, we are not obliged to undo what we have done with your personal data up to that point. Therefore, withdrawing your consent does not have retroactive effect.
You have the right to know which of your personal data we are processing. At your request, we will provide you, free of charge, with an overview of all those data or a specific part in which you are interested. In doing so, we will provide you with additional information, such as why we are processing these data, how long we keep them, and so on.
We must ensure that all your personal data is correct. If you notice (or believe) that certain personal data is factually incorrect, you can ask us to correct it. And because our data must not only be correct, but also complete, you may supplement that data. In some cases, you can do this by providing us with a statement that we will add to your data.
There are situations in which you can ask us to delete certain information about you. You can do this, for example, if you believe that we no longer need this data or that we are processing it unlawfully, if you have withdrawn your consent or if you have objected to the processing. We will then examine whether there are legitimate reasons to retain your personal data nevertheless. If there are no such reasons, we will delete your data.
In certain cases, we process your personal data because it is necessary for the performance of a task carried out in the public interest or for the protection of our legitimate interests (or those of another person or organization). In such cases, we will not ask you to consent to the processing, but you may object based on your specific situation. If you object, we will suspend processing and balance your rights, freedoms and interests against our interests. In doing so, we will pay attention to your specific situation. If our interests are overriding, we will resume processing. If the rights, freedoms and interests in your specific case are more important, we will stop the processing permanently. In either case, we will let you know what we have decided.
Limiting processing is nothing more than allowing you to temporarily 'freeze' processing. If you ask us to restrict the processing of your personal data, we may not do anything with it other than keep it. You have the right to restrict the processing of your personal data if any of the following situations apply:
- You dispute the accuracy of the data, in which case we will stop processing your data until we have verified its accuracy.
- The processing is unlawful or UU no longer needs your personal data for the purpose for which the data was collected and you do not want us to delete your personal data.
- You have objected, in accordance with your right to object, to the processing of your personal data and you are awaiting the outcome on your objection.
You do not have to accept decisions that are made without a human being being involved, even though those decisions have a material impact on you.
For participants of or those interested in the education of continuing education, automated decisions that they are materially affected by are never made by UU.
If we process personal data about you on the basis of your consent or an agreement entered into with you, you have the right to receive (back) the data you have provided digitally in a common file format. You are free to pass this data on to another party.
If you wish to exercise one or more of the above rights, you can submit a request using the Privacy Request Form (uu.nl). We will then have one month to respond to your request. For very complex requests (or if we receive many requests at once) we sometimes need more time (up to two additional months). We will let you know within that first month.
When exercising your rights, it is necessary that we first establish your identity. We do this in a manner appropriate to the situation at hand and the right you wish to exercise.
Individual assessment
Please note that the rights described above are not absolute rights. We assess each request individually. Sometimes circumstances may prevent us from fulfilling a particular request. If so, we will let you know why.
The UU handles personal data confidentially. The UU takes appropriate technical and organizational measures to protect your personal data.
Technical measures
In order to optimally protect your personal data against unauthorized access or use, the UU employs appropriate security technology. We will report (attempted) misuse. The UU also takes organizational measures to secure personal data against unauthorized access.
Organizational measures
Within the organization, the UU has taken a large number of measures to ensure that your data are not only technically secure, but also that the chance of human error and misuse is kept to a minimum.
As a result of the above information, do you have any specific questions or comments about this privacy statement? Please feel free to contact us. To do so, please send a message to privacy@uu.nl.
UU has appointed a data protection officer (FG). This is an internal advisor and supervisor who may also be of interest to you, namely if you want information about our processing of personal data or if you want to file a complaint about it. You can contact our FG at fg@uu.nl.
Please note that you also have the right to file a complaint with the regulator, the Authority for Personal Data (Autoriteit Persoonsgegevens).
Contact details Utrecht University
Heidelberglaan 8
3584 CS Utrecht
Tel. (030) 253 35 50
Privacy statement: version
This privacy statement was last amended on 14 August 2024. From time to time, changes are made to this privacy statement. Please check our website to make sure you are consulting the most recent version.