Privacy Statement Ulearning

Version of 7-12-2021

In this privacy statement, Utrecht University will explain what will happen to your personal data when it will be processed through the Ulearning platform.

Who is accountable for the data processing?

Utrecht University, located at Heidelberglaan 8, 3584 CS Utrecht, The Netherlands, is responsible for any data processing elaborated upon in this privacy statement.

For what purposes will my personal data be processed?

Your personal data will be processed to make it possible to give online courses and offer course related study materials to employees, students and external individuals.

What personal data will be processed?

If you use Ulearning through a Solis account, the following data will be processed. This generally applies to employees and students.

• Your unique userID,
• Your first- and last name,
• Your UU email address,
• Your IP address, and
• Logging data regarding your activities within the Ulearning platform.

Additionally, it is possible to upload a profile picture to your profile, which will then be possible. You are free to not upload a picture.

If you use Ulearning without a Solis account, the following data will be processed, This generally applies external individuals.

• Your unique userID,
• Your email address,
• Your password,
• Your first- and last name,
• Your IP address, and
• Logging data regarding your activities within the Ulearning platform.

Additionally, it is possible to upload a profile picture to your profile, which will then be possible. You are free to not upload a picture.

How long will my personal data be saved?

If you are using Ulearning using a Solis account, your personal data will be deleted two years after your Solis account has been disabled.

If you are not using Ulearning using a Solis account, your personal data will be deleted two years after your last activity on the Ulearning platform.

Will my personal data be shared with third parties?

It is possible that your personal data will be share with another party. This will be done to deliver certain services within the Ulearning platform. Whenever this will happen, you will be properly informed beforehand.

What is the legal basis for this data processing?

The legal basis used for this data processing is dependent on the relation of the data subject to Utrecht University. The legal bases used are necessity for performance of a contract, necessity for carrying out a task of public interest and legitimate interest.

Necessity for performance of a contract

If you are following a course or class at Utrecht University while not being a student at Utrecht University, and this course or class is being given through the Ulearning platform, then the contract on the basis of which this course or class is being given to you will serve as the base of the data processing that will take place within the Ulearning platform.

Public interest

Public interest will be used as the main legal basis for data processing within the Ulearning platform if you are a student at Utrecht University. Utrecht University derives this public interest from the “Wet op hoger onderwijs en wetenschappelijk onderzoek”, or Higher Education and Research Act. Within this legislation, Utrecht University is tasked by law to provide education to its students. This task given to Utrecht University serves as the public interest legal basis for data processing when it comes to the education of students within the Ulearning platform.

Legitimate interest

Legitimate interest is used as the main legal basis for data processing of Utrecht University employees within the Ulearning platform. The legitimate interest of Utrecht University is derived from its goal to provide its employees with a digital environment in which they can continuously develop themselves and their work related skills. This by offering them online courses within this environment.

Data processing is required to achieve this goal. Offering personalized courses in an online portal can only be achieved in such a way that one’s online identity must be validated. Otherwise it will not be possible to resume courses you started or monitor any progress.

Data protection interests of the employees must be measured against the interests of Utrecht University. In principle, data subjects do not have an interest in just having their data processed. The rather bare data processing that takes place within the Ulearning platform does not go further than the original goals set out before the data processing. This is a factor to consider.

The legitimate interest of Utrecht University prevails above the data protection related interests of the employees in this case. This is the case, mainly because the dataprotection should be considered to be small and employees will receive something in return for their data being processed. The actual interest of Utrecht University for their employees to continuously develop themselves also weighs heavily in this consideration.

Legitimate interest will also be used as a legal basis when it comes to security logging for all end users.

Utrecht University has a legitimate interest to keep their digital environments safe and monitor this against abuse. Logging is a necessary measure to achieve this goal. This measure is proportional to ensure that any abuse will be found so fitting action can be undertaken.

End users do not have an immediate interest served when their data is being processed. However, they also profit from their personal data being properly protected, something this very processing will achieve.

Since there are barely any conflicting interests here, the legitimate interest of Utrecht University stands.

What rights do I have under the GDPR and how can I exercise these?

As a data subject, you have certain rights. These are the rights of access, rectification, erasure, data portability, restriction of data processing the rights to object to the data processing. If you want to use any of these rights, you can send your request to Privacy@uu.nl. You may be asked for proof of identity during this procedure.

When you object to the data processing, this will be examined on a case-by-case basis whether this objection can or must be met. Utrecht University will discontinue the processing of personal data unless urgent legitimate grounds are presented that outweigh your interests, rights and freedoms.

Will there be any automated decision making or profiling?

This data processing does not constitute any automated decision making or profiling. This means that there will never be a decision made without human intervention.

Questions

If you have any questions about this privacy statement, you can reach out to privacy@uu.nl. If you have a complaint, you can reach the Utrecht University Data Protection Officer at fg@uu.nl. You are also free to file a complaint at the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.