Scope of Application
Radboud University processes the personal data of its students to fulfil its obligations as an educational institution and to provide them with the best possible education.
Radboud University respects the privacy of its students and ensures that how students’ personal data are handled at Radboud University complies with the applicable regulations. In this student privacy statement, in addition to the general privacy statement, we specifically inform you – as a student – on how students' personal data are handled, for which purposes and on what basis students' personal data are processed, how these personal data are processed, which rights you have if your personal data are processed and where you can submit any questions or requests regarding your privacy.
What are personal data?
Personal data are data that provide information on an identified or identifiable natural person.
Which of your personal data, as a student, do we process?
In the case of students, we process the following personal data:
- Contact details (name, home address, e-mail address, telephone number);
- Nationality and place of birth;
- Unique registration number;
- BurgerServiceNummer (BSN, Citizen's Service Number);
- Bank account number (IBAN);
- Information regarding your study results, study progress and supervision;
- Correspondence and interaction data such as e-mails, letters, messages or other information that is exchanged when you contact us or when we contact you;
- The contact details of the person you specified to us as your contact person (for emergencies);
- Images or footage;
- Financial information that you have provided to us;
In most cases, these are personal data that we have obtained directly from you. Sometimes we also receive personal data through third parties, in so far as this is in accordance with the law or if you have given your explicit consent for this.
At your own request and with your explicit consent, we may also process your medical data. For example, this may include personal data required for taking appropriate action in an emergency.
Objectives of processing
The objectives for which the Radboud University processes students’ personal data are:
- Organising, planning and implementing education;
- Supervising students;
- Informing students on relevant matters concerning study and student facilities or other education or Radboud University related topics;
- Answering questions posed by you;
- Responding to complaints, objections and disputes;
- Improving the quality of our education and services;
- Calculating, documenting and collecting amounts due;
- Keeping records, as well as other internal management activities;
- Complying with statutory obligations, such as retaining administration data and carrying out audits.
Without your permission, your personal data will not be processed further for an objective that is not compatible with the aforementioned objectives, unless there is a statutory exception.
Grounds for processing
The processing of the aforementioned personal data is based on one of the following grounds:
- The processing is necessary for the fulfilment of an agreement to which you are a party, or to take measures at your request for the conclusion of a contract;
- The processing is necessary to comply with a legal obligation;
- You have given your permission for this processing of your personal data;
- The processing is necessary to protect our or a third party’s legitimate interests, except where the interests or fundamental rights and freedoms of the data subject – which oblige the protection of personal data – outweigh those interests, in particular where the data subject concerned is a child.
- The processing is necessary to perform a task in the public interest or to exercise public authority entrusted to us;
- The processing is necessary to protect your vital interests or the vital interests of other persons.
Soon, you can find more detailed information on which grounds apply for which processing of personal data by using this link.
Special categories of personal data (see the pdf-version (pdf, 307 kB) for all details) will only be processed if the conditions/ grounds for exception specifically mentioned for that purpose in Article 9 of the General Data Protection Regulation (GDPR) are met.
Mandatory or voluntary provision of personal data
If we ask for your personal data, we will make clear if the provision of the data requested is necessary or mandatory and what the (possible) consequences are if the data are not provided. Our starting point is that we do not process more personal data than necessary for the purposes described.
Exchange of data with third parties
Radboud University may share your personal data with third parties to perform its tasks. Sometimes we are required to do so by applicable laws and regulations and sometimes we ask third parties to assist us in processing your personal data for the purposes mentioned above. Examples include sharing personal data with the Education Executive Agency (Dienst Uitvoering Onderwijs, DUO), the Immigration and Naturalisation Service (IND) or the use of ICT applications.
You will soon be able to find more detailed information on this topic via this link.
If Radboud University shares your personal data with a third party that processes the personal data on behalf of Radboud University, we will sign a processor's agreement with that third party which meets the requirements of the applicable privacy regulations.
We will not share your information with third parties who intend to use it for their own purposes, unless this is necessary to comply with legal obligations or you have given us permission to do so. In addition, we will never sell or rent your personal data to third parties.
If a third party outside the European Economic Area should process any personal data, measures will be taken to ensure an appropriate security level.
Automated decision-making and profiling
Radboud University does not make use of profiling in combination with automated decision-making.
We do not store your personal data for longer than is necessary. We determine the retention period based on legislation and regulations.
If statutory retention periods apply for the relevant personal data, we will observe those periods. In the event statutory and agreed upon retention periods should differ, the longer period will be applicable. Should you want to have your personal data erased at an earlier stage, this could be done in certain circumstances. Please refer to the heading ‘Right to rectification and erasure’.
Security of personal data
The Radboud University takes appropriate technical and organisational measures to protect your personal data against loss or any form of unlawful processing. Measures that are applied as much as possible in this context include encryption and pseudonymisation of personal data, encryption of communication and treating personal data as confidential.
Radboud University respects the rights that you have pursuant to current data protection laws and regulations. Below we give you some more information about these rights and how you can invoke them.
Right of access
You have the right to verify which of your personal data Radboud University processes.
Right to rectification and erasure
In specific circumstances, you are entitled to have your personal data rectified or erased if the data are not – or are no longer – correct or if the processing is – or is no longer – legitimate.
Right to object
When Radboud University processes your personal data by reason of a legitimate interest or a task carried out in the public interest, you have the right to object to that processing.
If you object to your personal data being used to inform you about Radboud University’s activities and similar processing (“direct marketing”), we will always honour this objection. In that case, your data will no longer be used for direct marketing.
If you object to any other form of processing with respect to your personal data, we will verify if we can honour your objection. If your objection carries more weight than the interest we have in processing your personal data – and in continuing to do so, we will stop processing these data. If we are of the opinion that our legitimate interest to continue processing your personal data outweighs yours, we will explain our position.
Right to restriction of processing
In specific circumstances, you also have the right to restriction of processing your personal data. This means that Radboud University temporarily “freezes” the processing of your data. You can invoke this right while waiting for the assessment of a request for rectification, if the data should have to be erased because the processing is unlawful but you should request restriction of processing instead of erasure, if Radboud University no longer needs the data whereas you still need these data for legal proceedings – or the preparation of legal proceedings – or pending the assessment of an objection.
Right to data portability
If Radboud University processes your personal data on the basis of your consent or an agreement entered into, you have the right, with respect to these data, to receive (in return) the data you provided us with digitally, in a commonly used format. You are then free to transmit these data to any other party.
Withdrawal of consent
If Radboud University processes your personal data on the basis of your consent, you usually have the right to withdraw your consent. We will immediately stop the processing. Withdrawal of consent has no retro-active effect. Any processing that has taken place up to that moment will, therefore, remain lawful.
Exercising the rights referred to above
If you want to invoke one of the rights referred to above, you can contact the Data Protection Officer via the Data Protection Office by sending an email to: email@example.com.
Radboud University does not charge any costs when you exercise the rights referred to above – except where rights are abused.
In principle, Radboud University will respond to your request within a month. If answering your question should take more time, which we hope will not be the case, we will inform you about this within a month. The complexity of the requests and/or the number of requests could lead to the response time being delayed by a maximum of three months.
Radboud University may request further proof of identity when you file a request. We apply this rule to prevent personal data being provided to the wrong person or being changed incorrectly and to prevent any changes in the way in which those personal data are processed by us. In order to be able to handle your request as efficiently as possible, we ask you to present your ID.
Balancing individual interests involved in a request
Radboud University would like to point out that the rights described above do not constitute absolute rights. Specific circumstances may lead to a specific request not being honoured. We will assess each request on an individual basis. In the event we cannot honour a specific request, we will explain why not, stating reasons. The right to object to the use of data for direct marketing purposes is an absolute right, unsubscribing for possibly commercial forms of communication will in any event be honoured.
Data Protection Officer
Radboud University has a Data Protection Officer (DPO).
The DPO supervises compliance with the data protection laws and regulations and advises Radboud University on the data protection laws and regulations. The DPO is independent. The DPO reports directly to the Executive Board. Furthermore, the DPO is the contact person for questions concerning privacy, both for you, as a data subject, and for the supervisor.
Under the data protection laws and regulations you can also file complaints with the national supervisor, the Dutch Data Protection Authority. You will find further details on the website of the Data Protection Authority: (www.autoriteitpersoonsgegevens.nl).