Privacy Policy Radboud Writing Lab

I. SCOPE OF APPLICATION

I.1 What are personal data?

Personal data are information that tells us something about an identified or identifiable natural person.

I.2 Processing of personal data by Radboud in’to Languages

Radboud in’to Languages processes the following personal data:

I.2.1 From all our students, we process:

1. Name;
2. Adress;
3. Postal code and city;
4. Gender;
5. Phone number;
6. Date of birth;
7. Username (student number, employee number, external account number);
8. E-mail adress;
9. If taken: the result of an intake test; 
10. If taken: the report of an intake assessment
11. If taken: sound recordings of aural exams; 
12. If permitted by the course participants: recordings of online lessons

I.2.2 In addition to the data referred to in point I.2.1, we process the following personal course participants’ data from subject to the integration requirement:

1. BSN;
2. Country of bith.

I.2.3 In addition to the data referred to in point I.2.1, we process the following personal data of candidates for the EVC assessment certificate as a competent NT2 teacher and course participants of the NT2 teacher training course:

1. Audio recordings of assessments and final interviews.

I.2.4 We process the following data in the case of our translation, interpretation or editing service clients:

1. Name;
2. Position and departmental name; 
3. Adress; 
4. Postal code and place of residence; 
5. Phone number;
6. E-mail adress; 
7. Source files, such as texts; 
8. Texts that have been delivered (translated texts, subtitles and edited texts).

I.3 Objectives of Processing

Radboud in’to Languages processes the data for the following reasons:

• To be able to confirm your registration and to correspond about registration, course dates, times and assessment.
• To be able to collect course fees.
• To be able to inform you about test results and certification.
• For course participants who are obliged to take the Dutch civic integration examination: to be able to meet the Blik op Werk certification criteria in accordance with the Civic Integration Act. For these course participants, we exchange information with DUO and Blik op Werk.
• To be able to grant you access to Brightspace, the digital learning environment of Radboud University.
• To be able to provide translation, interpretation or editing services in the case of our translation, interpretation or editing service clients;
• To develop translation memories to boost the efficacy with which we execute contracts in the case of our translation services (this refers to texts and jargon specific to our clients).

Note: Radboud in’to Languages does not process more personal data than necessary. Radboud in’to Languages may use your data for marketing purposes and to send you information about our offer, but only if you have given explicit permission. If you wish to revoke your previously given consent, you can do so at any time via: privacy [at] into.ru.nl (privacy[at]into[dot]ru[dot]nl).

I.4 Grounds for Processing

Radboud in’to Languages exchanges your personal data on the basis of one of the following grounds:

• You have granted us permission to process your personal data; this concerns the personal data referred to under points I.2.1 and I.2.3.
• The processing is necessary for the execution of a contract to which you are party, or to take measures at your request prior to the conclusion of a contract; this concerns the personal data referred to under points I.2.1 and I.2.3.
• The processing is necessary to comply with a statutory obligations incumbent upon us: this concerns the personal data referred to under point I.2.2.

The processing of special categories of personal data shall only take place if the conditions specifically stated in the law have been met, or if one of the grounds for exception stated in the applicable laws and regulations have been met.

I.5 Compulsory or voluntary provision

If we ask for your personal data, we will make clear if the provision of the data requested is necessary or mandatory and what the (potential) consequences are if the data are not provided. Our starting point is that we do not process more personal data than necessary for the purposes described.

I.6 A. Access to data

Within the Radboud in’to Languages organisation, your personal data are processed exclusively by those persons who are required to do so in order to carry out their duties and only for the sake of providing the service for which you have consented to the processing of your personal data.

B. Exchange internally within Radboud University

Radboud in’to Languages may share data of RU employees who take courses at Radboud in’to Languages in the context of the university Language Policy with Radboud Finance and Control for the purpose of applying legal provisions.

C. Exchange with Third Parties

It may happen that Radboud in’to Languages shares your personal data with third parties outside Radboud University in the context of the performance of its tasks, but only if you have given your prior consent. Radboud in’to Languages will provide your data to the following third parties in the context of the performance of its tasks:

Personal data of course participants with an integration obligation to:

• DUO
• Blik op Werk
• Panteia

Personal data of course participants of the NT2 teacher training course:

• Blik op Werk
• Panteia

Pursuant to GDPR regulations, we have drawn up data processor agreements with these parties.

If Radboud in’to Languages shares your personal data with a third party who processes data under the instructions of Radboud in’to Languages, we will enter into a processing contract with that third party, which contract meets the requirements laid down in the applicable privacy laws and regulations.

Radboud in'to Languages does not provide personal data to third parties who are going to use the data for their own purposes, unless this is necessary to meet legal obligations or unless you have given us permission for this.

If a third party outside the European Economic Area should process any personal data, measures will be taken to ensure an appropriate security level.

I.7 Automated decision-making and profiling

Radboud in’to Languages makes / does not make use of profiling in combination with automated decision-making.

I.8 Retention Period

Your data is stored no longer than necessary. 
If legal retention periods apply to the personal data, we will adhere to them. If statutory or agreed periods differ, the longest retention period will be used. For example, we are obliged keep all exam data for at least 5 years and financial data for 7 years.
We keep data of persons obliged to participate in a civic integration programme for 5 years, taking into account the legal integration period and any right to an extension of that period.
Should you want to have your personal data erased at an earlier stage, this could be done in certain circumstances. See also the information under the heading “Right of Rectification and Erasure”.

I.9 Protection of Personal Data

Radboud in’to Languages will undertake all appropriate technical and organisational measures to protect your personal data against loss or any form of unlawful processing. Measures that are applied as far as possible in this context include encryption and pseudonymisation of personal data, encrypted communications, and the handling of personal data as confidential.
In accordance with Article 25 of the GDPR (privacy by design en privacy by default), we normally conduct a preliminary DPIA (data protection impact assessment) when procuring a new application and may conduct another one if necessary (Article 35 of the GDPR).

II. YOUR RIGHTS

Radboud in'to Languages respects the rights you have under applicable laws and regulations. Below we will inform you about these rights and how you can exercise them.

Right of Inspection;
You have the right to see what personal data Radboud in'to Languages processes about you.

Right to Rectification and Erasure;
Under certain circumstances, you have the right to have your personal data changed or deleted if the data is currently not or no longer correct, or if the processing is currently not or no longer justified.

Right to Object;
If we process your personal data on the basis of a legitimate interest or a task of public interest, you have the right to object to this.

If you object to the use of your personal data to inform you about activities of Radboud in’to Languages and similar ("direct marketing") processing, we will always honour this objection. Your data will then no longer be used for this purpose.

If you object to other forms of processing of your personal data, we will check whether we can approve and comply with your objection. If the interest you have stated outweighs the interest we have in the processing of your personal data, we will stop processing this data. If we believe that we have a more serious legitimate interest in continuing the processing of the personal data, we will explain that.

Right to Restriction;
Under certain circumstances, you are also entitled to restrict the processing of your data. This means that Radboud in’to Languages temporarily “freezes” the processing of your data. You can invoke this right while waiting for the assessment of a request for rectification, if the data should have to be erased because the processing is unlawful but you should request restriction of processing instead of erasure, if Radboud in’to Languages no longer requires the data whereas you still need these data for legal proceedings – or the preparation of legal proceedings – or pending the assessment of an objection.

Right to Data Portability;
If we process your personal data on the basis of your consent or an agreement concluded with you, you have the right to request that we return this data to you digitally in a common file format. You are free to then forward that data to another party.

Withdrawal of consent;
If we process your personal data on the basis of your consent, you often have the right to withdraw your consent. We will then cease processing immediately. Consent cannot be withdrawn retroactively. This means that all processing that has already taken place remains lawful.

II.1 Exercising the above-mentioned rights

If you wish to exercise one of the above-mentioned rights, you may contact Mr R. Sarelse, the Radboud University data protection officer, at: mijnprivacy [at] ru.nl (mijnprivacy[at]ru[dot]nl).
Radboud University does not charge you for exercising the above-mentioned rights, with the exception of abuse.

II.1.1 Time limits

In principle, we will respond to your request within a month. Should the answer to your question or request take more time, we will inform you of this within a month. Due to the complexity of the requests and/or the number of requests, the answer period may increase to a maximum of three months.

II.1.2 Identification

For any request, we are permitted to request further proof of your identity. We do this to prevent us from providing personal data to the wrong party, unlawfully making changes to the personal data, or processing your data in an inappropriate fashion. In order to make the processing of your request as smooth as possible, we ask that you present your ID.

II.1.3 Each request is assessed individually

We would like to point out that the rights described above are not absolute rights. There may be circumstances that prevent us from complying with a particular request. We will assess each request individually. If we are unable to comply with a particular request, we will inform you of this and include the reasoning for our decision. However, the right to object to the use of data for direct marketing purposes is absolute. Requests to unsubscribe from any commercial communications will therefore be honoured in all cases.

III. SUPERVISION

III.1 Data Protection Officer

Radboud University has appointed a Data Protection Officer (DPO).
The DPO supervises compliance with the privacy legislation at Radboud University and advises on privacy legislation. The DPO is independent. The DPO reports directly to the Executive Board. Furthermore, the DPO is the contact person for questions concerning privacy, both for you as a data subject and for the supervisor.

For requests regarding the exercise of one of the aforementioned rights, you can contact the DPO Office by e-mail via: mijnprivacy [at] ru.nl (mijnprivacy[at]ru[dot]nl). If you have any questions or complaints about this privacy statement or our privacy policy, you can contact the DPO Office by e-mail at privacy [at] ru.nl (privacy[at]ru[dot]nl).

III.2 Supervisory Body

Supervisory Body
Pursuant to privacy laws and regulations, you can also submit complaints to the national supervisory body, the Data Protection Authority. You can find the contact details on the website of the Data Protection Authority.