This privacy statement supplement applies to the processing of the personal data of prospective students (students with an interest in a programme at Radboud University) by the Department of Education Marketing (hereinafter referred to as OM). OM is part of Radboud University. This privacy statement supplement is to be read in conjunction with Radboud University's Privacy Statement. OM respects your privacy and ensures that your personal data are processed in compliance with applicable laws and regulations. In this statement we inform you about how OM handles your personal data, for what purposes and on what grounds this occurs, how your personal data is processed, what rights you have when your personal data are processed, and where you can direct questions or requests related to your privacy.
What are Personal Data?
Personal data are data that relate to an identified or identifiable natural person.
Personal Data Processing by OM
OM processes the following personal data relating to you: first and last name, interests in programmes and study opportunities, previous education, date of birth, nationality, email address, address, telephone number, contact moments, and any other information you provide to us. A record is kept of how you have contacted Radboud University, what information activities you may be participating in, and what information you have requested.
Processing purposes
OM processes your personal data for the following purposes:
- to complete your information request or register your participation in an information activity;
- to conduct administration and internal management of activities;
- to get in touch with you and respond to any questions you may have;
- to inform you about information activities and study opportunities;
- to complete your enrolment or to provide support when enrolling in a programme;
- to allow us to send you digital newsletters via email;
- to improve the website and OM’s services;
- to comply with legal obligations, such as administrative obligations and the obligation to retain this information.
Your personal data will not be processed further without your consent for a purpose that is not in keeping with this.
Grounds for Processing
OM processes your personal data on one of the following grounds:
- a) you have consented to your personal data being processed;
- b) the processing is necessary for the performance of a contract to which you are a party, or to take measures, at your request, prior to a contract being entered into;
- c) the processing is necessary for representing our legitimate interests or those of a third party, except where such interests are outweighed by the interests or fundamental rights and freedoms of the data subject which interests and rights require the protection of personal data, particularly if the data subject is a child.
Processing special categories of personal data only takes place if the conditions specifically stated in the law have been met, or if one of the grounds for exception stated in the applicable laws and regulations has been met.
Compulsory or voluntary provision
When we ask you for personal data, we make it clear whether the provision of the requested data is necessary or mandatory and what the possible consequences are if the data are not provided. The basic principle is that we do not process more personal data than is necessary for the described purposes.
Exchange with Third Parties
As part of the performance of its duties, OM may share your data with third parties outside Radboud University involved in the transactions.
If OM shares your data with a third party that processes the data on behalf of OM, we will enter into a processing agreement with that third party, which agreement meets the requirements of the applicable privacy laws and regulations.
OM does not provide personal data to third parties who are going to use the data for their own purposes, unless this is necessary to meet legal obligations or unless you have given your consent to do so.
If personal data are processed by a third party outside the European Economic Area, measures are taken to ensure an appropriate level of security.
Automated Decision-Making and Profiling
OM does not currently use profiling in conjunction with automated decision-making.
Retention Period
Your data will be retained for a maximum of five years if you are interested in a programme and attend information activities but you are not enrolled in a programme at Radboud University. If you do enrol in a programme, the retention period indicated in the privacy statement supplement for students and participants applies.
If legal retention periods apply to the personal data in question, we will observe them. If statutory or agreed periods differ, the longer retention period applies. Under certain circumstances it is possible to delete your personal data sooner. See also the information under the heading “Right of Rectification and Erasure”.
Personal Data Security
Radboud University takes the appropriate technical and organisational measures to protect your personal data against loss and any form of unlawful processing. Measures that are applied as far as possible in this context include encryption and pseudonymisation of personal data, encrypted communications, and the handling of personal data as confidential.
Your rights
OM respects the rights you have under applicable laws and regulations. Below we will inform you about these rights and how you can invoke them.
Right of Access;
You have the right to see what personal data OM processes about you.
Right of Rectification and Erasure;
Under certain circumstances, you have the right to have your personal data rectified or erased if the data are currently not or no longer correct, or if the processing is currently not or no longer justified.
Right to Object;
If we process your personal data on the basis of a legitimate interest or a task of public interest, you have the right to object to this.
If you object to the use of your personal data to inform you about activities of OM and similar direct marketing processing, we will always accept this objection. Your data will then no longer be used for this purpose.
If you object to other forms of processing of your personal data, we will check whether we can accept your objection. If the interest you have stated outweighs the interest we have in the processing of your personal data, we will stop processing these data. If we believe that we have a more compelling legitimate interest in continuing the processing of the personal data, we will explain that.
Right to Restrict Processing;
Under certain circumstances, you are also entitled to restrict the processing of your data. This means that OM temporarily “freezes” the processing of your data. You can invoke this right while waiting for the assessment of a request for rectification if you have requested that the data be erased due to unlawful processing, but instead of requesting that the data be erased, you request that the processing of the data be restricted in the event that OM no longer needs the data while you still need the data (to prepare) for a lawsuit or pending the assessment of an objection.
Right to Data Portability;
If we process your personal data on the basis of your consent or an agreement concluded with you, you have the right to request that we return these data to you digitally in a commonly used, machine-readable format. You are free to then forward those data to another party.
Right to Withdraw Consent;
If we process your personal data on the basis of your consent, you have the right to withdraw your consent. We will then cease processing immediately. Consent cannot be withdrawn retroactively. This means that all processing that has already taken place remains lawful.
Exercising the abovementioned rights
If you wish to exercise one of the abovementioned rights, you can contact the Radboud University Data Protection Officer (www.ru.nl/personen/sarelse-r/) or via email: mijnprivacy [at] ru.nl (mijnprivacy[at]ru[dot]nl).
Radboud University does not charge you, except in the event of abuse, for exercising the abovementioned rights.
Time frame
In principle, we will respond to your request within a month. Should the answer to your question or request take more time, we will inform you of this within a month. Due to the complexity of the requests and/or the number of requests, the answer period may increase to a maximum of three months.
Identification
For any request, we are permitted to request further proof of your identity. We do this to prevent personal data being provided to the wrong party, unlawful changes being made to the personal data, or your data being processed in an inappropriate fashion. In order to make the processing of your request as smooth as possible, we ask that you present your ID.
Each request is assessed individually
We would like to point out that the rights described above are not absolute rights. There may be circumstances that prevent us from complying with a particular request. We will assess each request individually. If we are unable to comply with a particular request, we will inform you of this and state reasons for our decision. However, the right to object to the use of data for direct marketing purposes is absolute. Requests to unsubscribe from any commercial communications will therefore be honoured in all cases.
Supervision
Data Protection Officer
Radboud University has appointed a Data Protection Officer (DPO).
The DPO supervises compliance with the privacy legislation at Radboud University and advises on privacy legislation. The DPO is an independent party and reports directly to the Executive Board. Furthermore, the DPO is the contact person for questions concerning privacy, both for you as a data subject and for the supervisor.
For requests concerning the exercise of one of the aforementioned rights, please contact the DPO office by email via mijnprivacy [at] ru.nl (mijnprivacy[at]ru[dot]nl). If you have any questions or complaints about this privacy statement or our privacy policy, you can contact the DPO Office by email via privacy [at] ru.nl (privacy[at]ru[dot]nl).
Supervisory Body
Pursuant to privacy laws and regulations, you can also submit complaints to the national supervisory body, the Dutch Data Protection Authority. You can find the contact details on the website of the Data Protection Authority (www.autoriteitpersoonsgegevens.nl).