Privacy Policy

Privacy Policy
Version 06-03-2019

Your privacy is important to INKOM (part of Maastricht University) and INKOM therefore treats your data with care. INKOM is the controller of your personal data. This privacy statement explains how INKOM handles personal data.

Contact details

If you have a query about this privacy statement or you want to know more about how UM handles personal data, or if you have a complaint, please contact:

 

Maastricht University

attn. Data Protection Officer

Postbus 616

6200 MD Maastricht

privacy@maastrichtuniversity.nl

 

You can also contact UM’s Data Protection Officer directly by emailing fg@maastrichtuniversity.nl.

 

Purposes

Your personal data is collected and processed for a specific purpose, namely to take part in the INKOM week. INKOM will use your personal data to ensure that your application and INKOM week runs smoothly and so that we have enough information about you to act in case of emergencies. This could be as a new student or as part of the volunteers working to make INKOM a success.

What personal data does INKOM process

INKOM only processes the data which you provide or which is obtained because of your participation in the INKOM week. This could be data provided when opening the account or derived from pictures and films, taken at the different venues during the INKOM week or data derived from the wrist band you wear as described in the terms and conditions . INKOM receives personal data directly from you or from a third party that is authorised or required to share this personal data with INKOM.

Below you can find an overview of the categories of (special) personal data that INKOM processes.

Category of personal data

Examples

Name and address details

Naam, adress, postal code, town/city

Age-related data

Age and date of birth, wrist band 18+

Contact details

(Email) address(es) and telephone number(s), ICE contacts

Gender

Nationality

Financial data

IBAN

Identification data

Study program

Student ID number

Account data

Login details, social media accounts, IP addresses

Location data

Logging data, IP address, building access data

Photos and video images

Visual materials, promotional materials, camera images

 

 

Personal preferences

Allergy information

IP adress

Group forming preferences, diet preferences

Dietary allergies, severe allergies

(In case of fraud)

Sensitive personal data are data that are special in nature. For example, these can be data that reveal your race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or sexual orientation. The term sensitive personal data also includes data about your health, genetic data or biometric data through which you can be identified (e.g. a fingerprint). INKOM only processes sensitive data when it is permitted to do so by law.

Lawful basis for the processing of personal data by INKOM

Besides needing a purpose for processing personal data, a lawful basis is required. Whenever INKOM processes your personal data, it does so with a lawful basis for processing.

INKOM primarily processes your personal data to perform a contract with you which is reached at the moment you complete your account and accept the terms and conditions.

Other grounds for processing your data are:

  • to comply with a statutory obligation (for instance when law enforcement is involved)
  • to protect your vital interests or the vital interests of a third party (for instance in case of a medical emergency)
  • to serve the legitimate interests of INKOM

INKOM has a legitimate interest during the INKOM week to make photos and recordings for films, the website, promotional purposes, journalistic purposes, social media, etcetera. By entering an event terrain, the participant acknowledges this legitimate interest of the organization to use the participant's imagery for films, the website, journalistic purposes, promotional purposes, and to use it on social media platforms like Instagram, Facebook, YouTube, Vimeo and Snapchat as well as physical promotional material such as flyers and posters. "

Retention periods

INKOM does not keep personal data for longer than is necessary to achieve the purpose of processing. In some cases, INKOM is subject to a statutory duty of retention which determines how long data has to be kept. Personal data can also be kept for a longer period for historical, statistical and scientific purposes.

Recipients of personal data

INKOM shares data with third parties where this is necessary for the performance of its tasks, e.g. suppliers of software that is used to process personal data or other service providers that need personal data to provide their services. INKOM concludes written agreements with these parties concerning the processing and security of personal data.

Your rights

Privacy legislation gives you a number of rights in relation to your personal data. Your rights, as well as how to exercise them, are set out below.

Exercising your rights
If you wish to exercise one of the rights described below, please email privacy@maastrichtuniversity.nl or contact the Data Protection Officer directly at fg@maastrichtuniversity.nl.

The Data Protection Officer will inform you, within a month of receiving your request, whether and, if so, how your request will be dealt with. This time limit may be extended by one month on two occasions. If the time limit is extended, you will be notified in good time that this is the case.

ID
In order to be sure that information is shared with the right person, UM may ask you for proof of ID when you exercise your rights. If you are providing proof of your identity in the form of an identity document, it is advisable to use the KopieID App to make a secure copy of the document. This is an app created by the government that allows you to add a watermark to the copy of your identity document and to delete data that are not required. UM requires you, at the very least, to render your BSN number and passport photo and the so-called Machine Readable Zone at the bottom of the document illegible.

Charges for exercising your rights
Exercising your rights under the new privacy legislation is free of charge. If you request additional copies, however, UM may charge you an administrative fee. You will be advised of this in advance.

If your request is manifestly unfounded or excessive, particularly if you repeatedly submit a request, UM may charge an administrative fee for processing your request or refuse to accept the request. You will be advised of this in writing.

Right of access
You have the right to know whether your personal data are being processed by INKOM (as part of UM). If they are, you also have the right to know what data are being processed, for what purpose, whether and with whom they are being shared and how long they will be kept.

Right to rectification
If the personal data relating to you that INKOM is processing are found to be incorrect, you have the right to have these data corrected. If the personal data relating to you that UM is processing are found to be incomplete, you have the right to have these data completed.

Right to erasure
You have the right to have personal data relating to you that UM is processing erased, but only in the following circumstances:

  • Your personal data are no longer necessary for the purpose for which they were being processed;
  • You have withdrawn your consent and UM has no other lawful basis for continuing to process your personal data;
  • You have objected to the processing and UM has no compelling legitimate grounds for continuing to process your personal data;
  • It has been proven that your personal data have been processed unlawfully;
  • UM has a legal obligation to erase your personal data.

You do not have the right to erasure in the following circumstances:

  • The processing of your personal data are necessary to exercise the right of freedom of expression and information;
  • UM has to process your personal data in the context of a legal obligation and/or a task carried out in the public interest;
  • The processing of your personal data is necessary for public health purposes in the public interest;
  • The processing of your personal data is necessary for archiving purposes in the public interest, scientific research or statistical purposes, and erasure of the data is likely to render impossible or seriously impair the achievement of these purposes;
  • UM requires your personal data for the establishment, exercise or defence of a legal claim.

Right to restrict processing
You have the right to stop UM from processing your personal data (temporarily), without it being deleted. You only have this right in the following circumstances:

  • You contest the accuracy of the personal data processed by UM;
  • Your data have been processed unlawfully, but you do not want the data to be deleted;
  • UM no longer needs your personal data, but you need it in order to establish, exercise or defend a legal claim;
  • You have objected to the processing of your personal data by UM and are waiting for UM’s response.

If processing is restricted, your personal data will continue to be stored by UM. UM will only process personal data in respect of which processing has been restricted:

  • with your consent;
  • to establish, exercise or defend a legal claim;
  • to protect another person’s rights;
  • for reasons of important public interest.

Right to data portability
If personal data are processed on the basis of your consent or for the performance of a contract, you have the right to have these personal data transferred to a third party. The processing must be digital. In addition, transfer of the data must not adversely affect the rights of others.

Right to object
If UM processes your personal data on the basis of a task carried out in the public interest or on the basis of its legitimate interests, you can object to this. UM will then weigh up the various interests once again. If, having weighed up all the interests involved, UM believes that it has compelling legitimate grounds for continuing to process your personal data, your objection will be rejected. The same applies if your personal data are necessary for the establishment, exercise or defence of a legal claim.

Rights related to automated individual decision-making, including profiling
In principle, UM does not make decisions based solely on automated individual decision-making, including profiling.

Right to withdraw your consent
If your personal data are processed on the basis of your consent, you can withdraw this consent at any time. The withdrawal of your consent does not have retroactive effect.

Complaints

If you have a complaint about the way UM processes your personal data, please contact UM using the contact details below.

Maastricht University
attn. Data Protection Officer
PO Box 616
6200 MD Maastricht
privacy@maastrichtuniversity.nl

You can also contact UM’s Data Protection Officer directly by emailing fg@maastrichtuniversity.nl.

Additionally, you can submit a complaint to the Dutch Data Protection Authority. Details of how to do this can be found on the Data Protection Authority’s website.