The UvA Privacy Statement explains the purposes and methods for processing personal data obtained through the UvA website(s) (which also include www.auf.nl/en).

We may amend the Privacy Statement from time to time. This Privacy Statement was last amended on 16 August 2021.

1. About the UvA

The Executive Board of the UvA is responsible for the processing operations covered by this Privacy Statement within the meaning of the General Data Protection Regulation ('GDPR'). This means that the UvA decides which personal data will be processed, for what purpose and in what way. The UvA is responsible for the careful and proper processing of your personal data.

The UvA is located at Spui 21, 1012 WX in Amsterdam. Our postal address is PO Box 19268, 1000 WX Amsterdam, The Netherlands. If you have any questions, please send an email to avg@uva.nl

2. What personal data do we process?

This Privacy Statement provides information about the processing of personal data for the purpose of contact with alumni. An 'alumnus' is anyone who has completed a study at the UvA and has received a diploma. If you have studied with us, we have your personal data. We are legally obliged to keep some of this data, for example, in order to be able to prove that you have obtained a degree from us. We retain other data so that we can keep in touch with you.

We use the following data for this purpose:

• Name, address, place of residence;
• Telephone number, email address;
• Date of birth, gender;
• Language preference;
• Study data (such as the your study programme and the year of your graduation);
• Career information and information about events you attended;
• Bank and payment details.

3. Why do we process personal data?

More specifically, the processing of personal data in connection with alumni contacts concerns the following objectives:

• Keeping in touch with our alumni;
• Offering services, such as network and knowledge-sharing meetings;
• Informing alumni about relevant news, developments at the UvA and developments specific to their field of study;
• Evaluating the curriculum, programme and professional perspectives.

4. What is the processing based on?

In order to be able to process your personal data, the processing must be based on one of the principles of the GDPR. In the case of alumni contacts, this is the 'legitimate interest' principle. If you no longer wish to be contacted, we will delete all your contact details.

5. Newsletters

We would like to keep you informed about developments concerning the UvA and the alumni network. Furthermore, we would like to invite you to events we organise. We do this by post and by email. Every email contains an unsubscribe link. In addition to that, in every paper newsletter we indicate how you can unsubscribe from receiving this kind of information.

6. To whom does the UvA provide personal data?

In order to be of service to you, we use other parties to process personal data on our behalf. Third parties we engage include, for example, satisfaction researchers. For some transfers, we have to ask your permission. Sometimes we are obliged by law to provide personal data to, for example, the tax authorities, the police or a supervisory body.

If we have personal data processed by a third party and we have and retain control over the processing, we conclude a written processing agreement with these processors. In this agreement, we make agreements about the purpose, duration and scope of the processing, the storage terms and the security measures of the personal data, among other things. A processor, in the sense of the GDPR, can be, for example, a party that performs certain IT work for us or delivers mail.

7. How do we secure your personal data?

We take security measures to limit abuse of and unauthorised access to personal data. For example, we ensure that only the necessary people have access to your data, that access to the data is protected and that our security measures are checked regularly.

8. How long do we keep your personal data?

In principle, we save the personal data we process in the context of alumni contact for life, because the UvA likes to maintain contact with its alumni. Personal data which are subject to a statutory retention period are deleted as soon as this period has expired. If you would like us to delete your data sooner, please submit a request using the contact details below.

9. Your rights with regard to personal data

If you have any questions about how we process your personal data, please submit them to relatiebeheer@uva.nl. We will be happy to assist you.

You have the following rights for which you can submit a request to us:

• To inspect the personal data we process about you;

• To have errors corrected; and

• To request the deletion of personal data.

To make a request in this regard, please contact relatiebeheer@uva.nl.

If you believe that your personal data are being processed in contravention of the GDPR, you can submit a complaint to the Data Protection Officer (DPO) via fg@uva.nl. The DPO is the link between the UvA and the external supervisor (the Dutch Data Protection Authority). The DPO acts independently and can consult with or seek advice from the Dutch Data Protection Authority regarding your complaint.

If you disagree with the outcome of the DPO’s handling of your complaint, you can submit a complaint to the Dutch Data Protection Authority directly. The Dutch Data Protection Authority will handle the complaint or request and make a decision on it.