Your privacy rights

As a student you have the right to know what is happening to your personal data and why.

UvA’s procedures

The basic principle is that the UvA will provide you with information on a data processing operation whenever the UvA collects or receives personal data that relate to you. This may take the form, for example, of explanatory notes to fields on a form. The UvA also provides you with information through its privacy statementExternal link.

As a student you have the right to inspect personal data relating to you that are processed by or on behalf of the UvA.

UvA’s procedures

The UvA receives the enrolment data of its students through the national enrolment portal Studielink. We store these data in the Student Information System (SIS), which is the source system for all student data. SIS is connected to a number of other systems that receive data from SIS for various purposes. E.g. the Identity management system for access and account provisioning.

Inspect your own personal data

In most cases, you can inspect your personal data straight away using the following self-service options:

• You can view your personal data via Studielink.
• You can view your study progress data via SIS, which can be found at sis.uva.nlExternal link.

Which data does the UvA share and why?

In most cases, you can inspect your personal data straight away using the self-service options in SIS. In addition there is an overview of the systems that the UvA uses to process personal data.

The right to data portability means that you can submit a request to receive your personal data in a ‘machine-readable format’, or to have it transmitted directly to another institution. This can only be done if processing takes place on the basis of consent or in the context of the performance of an agreement between you and the UvA, and only relates to data that have been provided directly by you to the UvA.

The UvA does not receive the above-mentioned personal data directly from the student, but rather from Studielink. You can retrieve and access these data via StudielinkExternal link. You can also transmit these data to another educational institution.

Based on a request for inspection, you can ask us to rectify, restrict processing of, erase or 'forget' your personal data.

Rectification

By rectification of data, we mean amending or adding to your data. You can make such a request if your data are incomplete or not (or no longer) correct. The UvA is keen to ensure the accuracy of your personal data and is therefore happy to rectify your data, whether at your request or on its own initiative.

The right to rectification is designed to rectify obvious errors in the case of readily identifiable inaccuracies, e.g. an error in your date of birth. It cannot be used to trigger a substantive review, e.g. you cannot use the right to rectification to correct exam grades or research results.

It may be that, as a result of a statutory obligation, the UvA cannot amend your personal data or can only amend it under specific conditions. If this is the case, you will be notified of the reasons for this.

How can you amend your data?

You can amend your data through StudielinkExternal link. For data that you cannot amend yourself, you can submit a request. Please note: the UvA cannot depart from the data contained in the Personal Records Database.

Restriction of processing

Under the right to restriction of processing, the processing of your personal data, excluding the storage thereof, is temporarily suspended. You can invoke this right if you are unsure about the correctness of the data relating to you that the UvA processes, for example. In the case of a restriction of processing request, your personal data are not deleted. After all, it must remain possible for the requested restriction to be undone.

If the UvA requires your personal data on account of a compelling interest, the UvA can and will continue to process your personal data for this purpose and the restriction of processing request will be rejected. If this is the case, you will be notified of the reasons for this.

Right to erasure and ‘right to be forgotten’

You also have a right to erasure and a ‘right to be forgotten’. You can ask the UvA to delete your data. You can also ask the UvA to remove any link to your personal data ('to be forgotten'). Requests for erasure of personal data and requests to be forgotten can also be rejected. Reasons for this include a statutory processing obligation, a task carried out in the public interest or archiving.

Can I ask the UvA to delete my data after I graduate?

You will have the right to have your personal data deleted in certain circumstances, for example if processing has been unlawful. This right is not absolute and must always be weighed up against other rights and interests.

For example, the UvA will not comply with a request to delete your diploma registration, as the Public Records Act (Archiefwet) requires the UvA to archive diploma registrations.

Although application of the right to deletion may be excluded, appropriate safeguards will always be necessary (security and data minimisation, for example).

However, a request to inspect archive records is possible, provided that the request is targeted.

Before your personal data are processed, the various interests will be assessed, meaning your right to privacy will be balanced against the interest in processing the data. This assessment is general and abstract.

If a specific situation applies to you, you can inform the UvA of this situation. This will enable the UvA to reconsider the interest in processing the data based on your new or specific situation. 

If a processing activity is based on your consent, it is not possible to object to it. In that case, you may, however, withdraw your consent.