Privacy statement  

In this privacy statement, we explain what happens to your personal data when it is processed through the Ulearning platform. 

Who is responsible for data processing? 

Utrecht University is responsible for the data processing described in this privacy statement.  

For what purposes are my personal data processed? 

Your personal data will be processed for the purpose of providing online courses and offering course related study materials to employees, students and external individuals. Besides, attendance-related data will be processed for administrative accountability of participation costs. 

In addition, the UU may use anonymised data to gain insight into how many employees in each unit have completed specific (mandatory) trainings and to take targeted actions to improve participation and awareness. 

What personal data is processed? 

If you use Ulearning through a Solis account, the following data will be processed. This generally applies to UU employees and students. 

• Your unique userID, 

• Your first- and last name, 

• Your UU email address, 

• Your IP address,  

• Logging data regarding your activities within the Ulearning platform, 

• Attendance registration per session – this data may be recorded by you or by the course organizer for in person or hybrid training sessions. 

Additionally, you may upload a profile picture to your profile. If you do so, your profile picture will be processed. Uploading a profile picture is optional. 

If you use Ulearning without a Solis account, the following data will be processed. This generally applies to participants in Continuing Education. 

• Your unique userID, 

• Your first- and last name, 

• Your email address, 

• Your password, 

• Your IP address, 

• Logging data regarding your activities within the Ulearning platform, 

• Attendance registration per session – this data may be recorded by you or by the course organizer for in person or hybrid training sessions. 

Additionally, you may upload a profile picture to your profile. If you do so, your profile picture will be processed. Uploading a profile picture is optional. 

How long is this personal data kept? 

If you are using Ulearning using a Solis account, your personal data will be deleted two years after your Solis account has been disabled. 

If you are not using Ulearning using a Solis account, your personal data will be deleted two years after your last activity on the Ulearning platform. 

Logging-related data will be deleted after 30 days. 

Attendance registration-related data will be deleted after X days. 

Will my data be shared with third parties? 

It is possible that your personal data will be share with another party. This will be done to deliver certain services within the Ulearning platform. Whenever this will happen, you will be properly informed beforehand. 

Will my data be transferred to third countries? 

No, data will not be transferred to third countries outside the European Economic Area.  

What is the legal basis for this data processing?  

The legal basis for this data processing depends on the relationship between the data subject and the University. 

Necessity for the performance of a contract 

If you are following a course or class at Utrecht University while not being a student or employee at Utrecht University, and this course or class is being offered through the Ulearning platform, then the contract on the basis of which this course or class is being offered to you will serve as the legal basis for the processing of your personal data that will take place within the Ulearning platform. 

Public interest 

Public interest will be used as the main legal basis for data processing within the Ulearning platform if you are a student at Utrecht University. Utrecht University derives this public interest from the Higher Education and Research Act (“Wet op hoger onderwijs en wetenschappelijk onderzoek”). Within this legislation, Utrecht University is tasked by law to provide education to its students. This task given to Utrecht University serves as the public interest legal basis for data processing when it comes to the education of students within the Ulearning platform. 

Legitimate interest of the UU 

To process employee data in the Ulearning platform, the UU relies on its legitimate interest to provide its employees with a digital learning environment in which they can continuously develop their professional knowledge and work-related skills. For this purpose, it is necessary to validate users’ online identities in order to track course progress and provide personalized learning content. Without identity validation, it would not be possible to resume previously started courses or monitor learning progress. 

Security logging is also carried out based on the legitimate interest of the UU to prevent misuse of the platform and to ensure the security of user data. 

In addition, the UU may process attendance data based on its legitimate interest in recording which employees have participated in training sessions for which costs are incurred.  

What rights do I have under the GDPR and how can I exercise them? 

The GDPR gives you a number of rights with regard to your personal data. You have the right to access your data and to have it corrected or deleted. In this processing, you also have the right to temporarily freeze (‘restrict’) the processing of your data, the right to object to the processing and the right to have your dataset transferred to another organisation.  

How can I exercise these rights? 

If you want to exercise one or more of the above rights, you can submit a request using the privacy request form. We will then have one month to respond to your request. For very complex requests (or if a lot of requests come in at the same time), we sometimes need more time (up to two months extra). We will let you know within that first month. 

Is there automated decision-making or profiling?  

There is no automated decision-making. This means that decisions are never made without human intervention. There is also no profiling. 

Questions? Complaints? 

Do you have any specific questions regarding the above information or do you have any comments regarding this privacy statement? Feel free to contact us. You can send a message to privacy@uu.nl. 

The UU has appointed a Data Protection Officer (DPO). This is an internal advisor and supervisor who may also be important to you, namely if you want information about our processing of personal data or if you want to file a complaint about it. You can contact our DPO via fg@uu.nl. 

We would like to point out that you also have the right to file a complaint with the supervisory authority, the Dutch Data Protection Authority. 

Contact details Utrecht University  

Heidelberglaan 8  

3584 CS Utrecht  

Tel. (030) 253 35 50 

Privacy Statement: Version and Policy Document 

This Privacy Statement was last modified on 18 December 2025. From time to time, we will make changes to this Privacy Statement.