How does the UvA process your personal data?

Lawfulness, fairness and transparency

All processing performed by the UvA is in accordance with the GDPR and in proportion to the objective to be achieved. The UvA will inform its data subjects of the work methods used in and the objective of the processing. Current information can be found in the privacy statementExternal link.

Information on your rights with regard to this processing can be found on the page about your privacy rights.

Purpose limitation

The UvA only processes personal data for the objective for which they are collected. Your personal data may be used for a different purpose if the new purpose is related to the original objective of their collection.

Data minimisation

The UvA does not collect more data than required for the objective of its collection. Where possible, the UvA will delete or anonymise data as soon as possible.

Correctness

The UvA safeguards the correctness of personal data and updates these when required. You can check your data by submitting a request for inspection and can subsequently request that the UvA adapts, restricts, deletes or 'forgets' your personal data.

Storage limitation

The UvA and its processors do not store personal data for longer than is required for the processing. Exceptions to this rule are the retention obligation that arises from tax laws, among other things, as well as the admissibility with regard to archiving and research.

Integrity and confidentiality

By means of fitting technical and organisational measures, personal data are processed in such manner that appropriate security is safeguarded.

Accountability

Personal data are processed under the responsibility of the controller, who must ensure and be able to demonstrate that the processing is in accordance with the GDPR.

Conditions for processing

The UvA only processes personal data if the processing takes place on one or more of the following bases:

• Your permission;
• A necessity for the performance of an agreement;
• A legal obligation;
• The protection of a vital interest;
• The discharge of a duty of public interest or public authority; or
• A justified interest of the UvA. An example of this basis is processing personal data for the benefit of the organisation or the provision of education. However, for this basis, there will be a balancing of interests between the UvA's interests and the rights of the data subject.

Though it is a common misunderstanding, this fact means that processing does not always require permission.

What information should I keep in mind when processing personal data?

Make sure to take the following principles into account each time that you process personal data:

• Do not collect more data than is required for the specific purpose (data minimisation);
• Do not use data for any purpose other than for which they are intended (purpose limitation);
• Do not store data for longer than is required (storage limitation);
• Ensure that the data are accurate and up to date (accuracy);
• Treat the data as confidential and protect them properly (security).

If you are in any doubt or require advice and you would like to consult someone, please contact Legal Affairs via avg@uva.nlExternal link or the Data Protection Official via fg@uva.nlExternal link.