Privacy

Contact details of the controller:

Stichting Hogeschool van Amsterdam is the controller for the purposes of processing the personal data and special personal data of students¹ and employees² currently associated with Amsterdam University of Applied Sciences, but also future or former students or employees, persons participating in research, and visitors. Contact details:

Stichting Hogeschool van Amsterdam
Wibautstraat 3b
1091 GB Amsterdam
(Postbus 1025, 1000 BA Amsterdam)

Data protection officer

Amsterdam University of Applied Sciences has appointed a data protection officer, who ensures that personal data is processed in accordance with the applicable regulations. The data protection officer is registered with the Dutch Data Protection Authority.

The data protection officer can be reached at: functionarisgegevensbescherming@hva.nl 

Types of personal data

The following personal data and special personal data may be processed by Amsterdam University of Applied Sciences.

• Name and address details, place and date of birth, passport photo, student ID number, Ministry of Education, Culture and Science correspondence number, citizen service number, IBAN, copy of proof of ID, diplomas from (preliminary) training;
• Details of studies and academic progress;
• Other personal data required by law;
• Individual data or special personal data required to successfully support students and employees in terms of health and well-being;
• Insurance details for employees, and for students but only in cases where students are living abroad;
• Other statutory personal data required pursuant to specific legislation (for example, the Dutch Higher Education and Research Act, tax legislation, the Dutch Compulsory Identification Act, Eligibility for Permanent Incapacity Benefit (Restrictions) Act, etc.).

Purposes of processing

Personal data may be processed for the purposes of teaching activities, operational management and research, including:

• Enrolment for a degree programme or a course, or employment as a member of staff;
• Processing academic results, academic progress and other related information;
• Handling requests for information; 
• Conducting and improving the provision of services to (prospective) students, employees and alumni;
• Providing further information about various matters relating to the AUAS; choosing a degree programma, studying or alumni;
• Organising elections;
• Staff recruitment and selection;
• Security and improvement of our websites;
• Scientific or historical research or statistical purposes;
• Monitoring employee performance;
• Internal address books.

Personal data will only be used for the purposes specified above. Your consent will be required if AUAS wishes to process personal data for other purposes and there is no other basis for processing this information. In this case, you will be informed of the specific purpose and the retention period. You can withdraw your consent again at any time.

Bases for processing

AUAS will usually process your personal data on the basis of the following:

• Implementing an agreement concluded with you;
• Statutory obligations;
• Legitimate interests;
• Your consent to processing in specific situations;
• Public interest of scientific research.

AUAS will only process personal data for the purposes for which it has been obtained.

Recipients of personal data:

AUAS may instruct other organisations to process personal data on its behalf. In this case, a processing agreement will be concluded which will contain provisions to protect your privacy rights.
AUAS may pass your personal data on to other bodies including the following:

• Government institutions (e.g. Dienst Uitvoering Onderwijs (DUO, government body for the implementation of education), Ministry of Education, Culture and Science, Employee Insurance Agency, Immigration and Naturalisation Service, Tax and Customs Administration);
• The accountant;
• Municipalities;
• NUFFIC (Dutch organisation for internationalisation in education), study choice 123;
• Partner institutions in the Netherlands and abroad (e.g. for the purposes of sharing information).

AUAS will only pass personal data on to organisations outside of the European Union if:

• There is an appropriate level of data protection in the country concerned in the opinion of the European Commission, or there is an EU US Privacy Shield for companies in the US; or 
• An agreement is in place governing the protection of your rights in accordance with the GDPR.

Retention periods:

Careful handling of personal data also includes AUAS not retaining this data for longer than is necessary. AUAS observes the relevant statutory obligations and, if the rules are not set down in law, will abide by the 'Universities of Applied Sciences Selection List' of the Netherlands Association of Universities of Applied Sciences.

Camera surveillance:

AUAS uses camera surveillance to ensure your safety and that of others, and the safety of your personal property. Images are deleted after four weeks, or once an incident has been dealt with if a longer retention period is required for this.

Your rights in relation to the processing of your personal data

As the owner of your personal data (the 'data subject'), you have the following rights under the GDPR:

• The right to access your personal data:
  You can exercise this right by consulting the SIS (Student Information System) or DSPM (Digital Servicepoint for Employees). If you would like to receive further information on this, please submit a request via juridischezaken@hva.nl
  Future or former students or employees, persons participating in research, and visitors can submit a request via juridischezaken@hva.nl.
   

• The right to correct incorrect data (rectification):
  You can also exercise this right yourself directly by amending your information in the SIS or DSPM. If you want to have other data amended, please submit a request via juridischezaken@hva.nl
  AUAS cannot deviate from the relevant information recorded at DUO or in the Municipal Personal Records Database (GBA).
   
• The right to be forgotten (erasure of personal data):
  You can submit a request via juridischezaken@hva.nl to have your (surplus) personal data deleted from AUAS systems. Such a request cannot be granted if AUAS has an obligation to retain this data.
  If the personal data was being processed on the basis of your consent, you can withdraw your consent at any time.
   
• The right to object to processing:
  You can submit an objection via juridischezaken@hva.nl if you believe the processing of your personal data is not legitimate.
   
• The right to restrict processing:
  If you have submitted a request to have data corrected or erased, or have lodged an objection, you can request a temporary suspension of processing.
   
• The right to data portability:
  You can submit a request via juridischezaken@hva.nl to receive your personal data in a machine-readable format, or to have it transferred by AUAS to another institution. This is only possible if processing has taken place on the basis of consent or pursuant to an agreement.

Complaints

If you believe that AUAS has failed to observe privacy regulations and/or its privacy policy correctly, you can submit a complaint to the data protection officer. You can also do this if you are not satisfied with how your request or objection has been handled. Please submit your complaint by email to:
functionarisgegevensbescherming@hva.nl

You can also submit a complaint to the Dutch DPA via its website. 

¹_{This also includes participants in training courses.}

²_{This also includes non-salaried staff (self-employed persons) and/or persons carrying out work for AUAS on another basis.}