Privacy Statement for future students

Personal data are pieces of information that can enable another person to identify you. There are many kinds of personal data, the obvious ones being someone's name, address and place of residence. Those data relate directly to a particular person or can be traced back directly to that person. There are also indirect personal data. These are data that say something about a person when combined with other data. In other words, they can be traced back to a person indirectly. Examples include your postal code combined with other data that can be traced back to you indirectly.

Hanze UAS processes your personal data for the following purposes:

• to inform school pupils and other interested parties about degree programmes offered by Hanze
• to recruit new students and promote Hanze
• to execute requests for information or record your participation in an information activity or open days
• to contact you and respond to your questions
• to provide information about new existing information activities and study options
• to complete and provide support with enrolment for a degree programme
• to send digital newsletters transmitted by email
• to meet legal requirements, including the requirement to keep records and the retention obligation
• to improve Hanze's website and services

We will not continue to process your personal data for a purpose that is incompatible with these purposes.

If you would like to know more about a particular degree programme or if, for example, you wish to take part in taster sessions or open days, Hanze will process the following personal data:

• first and last name
• address
• date of birth
• nationality
• email address
• prior education
• interests in degree programmes and study options

A record will also be made of how you contacted Hanze, which information activities you participated in and which information you requested from us.

Hanze processes your personal data based on one of the following bases:

a) You have given consent to the processing of your personal data.

b) Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.

c) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, in particular where the data subject is a child.

Processing of special categories of personal data takes place only if the conditions specified in the law are met, or where any of the grounds for exception mentioned in the applicable legislation and regulations apply.

Our website and/or service has no intention to collect data on website visitors under the age of 16, unless consent has been granted by their parents or guardian. However, we are unable to verify whether a visitor is over 16 years of age. We would therefore advise parents to be involved in the online activities of their children to prevent children’s data from being collected without their consent. If you are convinced that we have collected data about a minor without consent, please contact us at [email protected]. We will then delete this information.

After every campaign/recruitment year, we send an email to school pupils or course participants who did not enrol in the end. Perhaps you did not pass, decided to take a sabbatical or have chosen a different educational institution. We will ask you what your situation is in that email. Let us know if you wish to remain in the campaign for the coming academic year or if you are no longer interested in studying at Hanze.

In the event that you do not respond to this email, we will assume that you are no longer interested and will not email you again. We will subsequently keep your personal data for a maximum of two years, because you may still be in contact with us during that period, and we would like to recognise you again in order to guide you as effectively as possible to a suitable study choice.

If you do enrol for a degree programme, the retention period indicated in the specific privacy statement for students and course participants of Hanze will apply.

If you would prefer your personal data to be removed, that will be possible in certain circumstances. See also the information in the section headed ‘your rights as a data subject’.

We will not disclose your personal data unless a legal obligation requires us to do so. Your data will be processed internally only for educational purposes, such as arranging open days or events.

Hanze will not sell your personal data to third parties and will only provide these data if this is necessary for the performance of our agreement with you or to comply with a legal requirement.

We will conclude a processing agreement laying down agreements on, for example, the obligations of the data controller and the processor, the retention period, rights of data subjects and liability with companies that process data on our behalf. Hanze will remain responsible for those processing operations and stipulate that the processor must secure those data adequately with organisational and technical measures.

Hanze UAS follows the basic principle that personal data will be processed within the European Economic Area. Should it be necessary to process data outside the EEA, Hanze will make a Data Transfer Impact Assessment (DTIA) or what is known as a risk analysis for that specific transfer and – if necessary – take adequate measures to be able to guarantee an appropriate level of protection.

Automated decision-making means that decisions are made by computer programs or systems without any human intervention. Hanze will not take any decisions based on automated processing operations that could have an impact on you as a prospective student.

We take the protection of your personal data seriously and have taken appropriate measures to prevent misuse, loss, unauthorised access, inappropriate disclosure and unauthorised changes. This way, your data will be accessible only by persons authorised to have access by virtue of their positions or duties. The information security and privacy policy is based on the Royal Netherlands Institute of Chartered Accountants (NBA) Maturity Model of the Dutch professional association for IT auditors (NOREA) and the ISO27001/2:2017 standard. If you believe that your data are not being adequately protected or there are indications of misuse, please contact:

 [email protected]

You are entitled to inspect, correct or delete your personal data. You are also entitled to withdraw your consent for the processing of data or to lodge an objection to the processing of your personal data by Hanze.

You have the right of data portability, and the right to have your data removed from our employee records system in the customary way and then have them processed elsewhere, for example, with your new employer.

You can submit a request for the inspection, correction, deletion or transfer of your personal data, a request to withdraw your consent or an objection to the processing of your personal data to [email protected]. We will respond to your request as soon as possible but within four weeks at the latest.

Hanze would also like to point out that you have the possibility to submit a complaint to the national supervisory authority, the Dutch Data Protection Authority.