Privacy Statement OnStage

Personal data are pieces of information that can enable another person to identify you. There are many kinds of personal data, the obvious ones being someone's name, address and place of residence. Those data relate directly to a particular person or can be traced back directly to that person. There are also indirect personal data. These are data that say something about a person when combined with other data. In other words, they can be traced back to a person indirectly. Examples include your postal code combined with other data that can be traced back to you indirectly.

Onstage is the monitoring and recording system for the work placement and final-year programme used at Hanze. The data we process in that system are processed for the following purposes:

• posting vacancies for work placements and final projects for the students of Hanze
• linking students to their work placement or final project company
• keeping track of, supervising, organising and assessing the progress made by students during the work placement and the final-year programme
• managing and storing work placement and graduation documents in accordance with the law
• enabling lecturers to verify students

To be able to use Onstage, you need to be linked to a work placement or graduation dossier. Once you are linked to a dossier, your personal data will be processed in Onstage, enabling you, for example, to access the job bank or register your final project. Some data will be processed when you are linked to a dossier, while others will be processed during the process because, for example, you have uploaded a work placement assignment.

Student:

• name
• address
• town/city
• email (private and student)
• telephone number
• school and degree programme
• passport photograph
• gender
• registration period
• student ID number
• study progress overview
• reports, assignments and reflections
• assessment forms
• work placement/final project contract
• date of birth
• country of birth
• nationality

Work placement or final project company:

• name (contact person, supervisor, etc.)
• telephone number
• email
• work placement/final project contract

Employee:

• name
• email
• four-letter code

For data processing to be legally valid, we must be able to rely on one of the six legal bases provided for by the General Data Protection Regulation (GDPR).

As an educational institution, we have been given a number of tasks under the law that relate to teaching. Many of those tasks are laid down in the Dutch Higher Education and Research Act (Wet op het Hoger Onderwijs en Wetenschappelijk Onderzoek, WHW). We will sometimes process your personal data when performing those teaching duties. On such occasions, we will process those personal data because, for example, it is necessary for carrying out a task in the public interest. In Onstage, we will process certain personal data on this basis, including, for example, to keep track of study progress and to teach courses. We rely on the ‘public interest’ basis for processing operations carried out based on such tasks.

As an educational institution, we are sometimes obliged to process certain data for a certain length of time. For example, we are obliged under the Selection List of the Netherlands Association of Universities of Applied Sciences to keep your final project for a certain length of time. We are not permitted to depart from this rule because it is a legal requirement.

The personal data of other data subjects, such as employees (e.g. lecturers), are also processed in Onstage. Examples include back office support and your work placement lecturer’s assessment of your work placement report. Personal data of the company where your work placement takes place will also be stored in Onstage. Examples include the contact details and assessment forms of your supervising trainer. The processing of those data is based on the performance of the work placement or final project agreement.

We respect your privacy and will retain your personal data for no longer than is necessary. There may be occasions when the law requires us to retain certain data for a particular period. Those obligations are included in Hanze's Selection List. Details of how long data are retained are provided below.

• Assignments, reports and other work placement documents are uploaded to your work placement dossier. The work placement dossier is retained for seven years.
• Your final project and reflection reports are uploaded to your final project dossier. The final project dossier is retained for seven years.
• If you do not complete the process satisfactorily, your dossier will be deleted two months after the completion of the process.

The personal data that are processed in Onstage come from various internal sources. Students’ data are retrieved from Osiris, the student records system. Employees’ data are retrieved from AFAS, the employee records system.

A work placement or final project company can pass on details of vacancies to the placement office and/or the work placement coordinator. The placement office and/or work placement coordinator will then post them in Onstage.

We will not disclose your personal data to third parties, unless a legal obligation requires us to do so. Examples include obligations arising under the Student Finance Act 2000 (Wet studiefinanciering 2000) or the Dutch Higher Education and Research Act (WHW).

In the event that we commission a supplier to perform a particular service for us, we always conclude a processing agreement to protect your data. Lastly, we share data internally for teaching purposes.

Internally, access is given to:

• Supervisor: your personal supervisor will be given access to your dossier for the supervision of the process. This is so that they can keep track of the progress you are making on your work placement and assess it. Your supervisor will lose access to the dossier once the process is completed.
• Examination Board: the Examination Board will be given temporary access to all examination dossiers for a degree programme to check the quality for accreditation purposes. Several dossier will be selected so that quality checks can be carried out. The contents of those dossiers are then checked. The functional manager grants that access, which lasts for six months.
• Placement office/work placement coordinator: school-specific access for the management and creation of dossiers, the associated administrative tasks and provision of support.
• Functional manager: full access to be able to perform tasks and manage Onstage.
• Archivist: full access to the documentation management, archiving and deleting files.

Externally, access is granted to:

• The supplier: Hanze does not own Onstage. This system is supplied by Xebic. Xebic is established in Ede, the Netherlands. Hanze UAS has a processing agreement with Xebic. That processing agreement contains agreements on the processing of your personal data, including an agreement whereby your data will remain within the European Economic Area (EEA) and will be adequately protected.

Xebic has an account within Hanze's Onstage environment. That account is used only for administrative purposes and to provide Hanze UAS with support.

• Work placement or final project company: your degree programme can opt to send an automatic email to the work placement or final project company when you register your work placement or final project company in Onstage. In that email, the company will be thanked for accepting a student. The email will disclose only your name and the name of your supervisor, as well as some general information about Hanze UAS.
• The Accreditation Organisation of the Netherlands and Flanders (NVAO) is allowed to inspect examination dossiers once every five years for the accreditation of the degree programme. It checks the quality and content of the dossiers before going on to make a decision on the retention of accreditation.

Automated decision-making means that decisions are made by computer programs or systems without any human intervention. There is no automated decision-making in Onstage.

We take the protection of your personal data seriously and have taken appropriate measures to prevent misuse, loss, unauthorised access, inappropriate disclosure and unauthorised changes. This way, your data will be accessible only by persons authorised to have access by virtue of their positions or duties. The information security and privacy policy is based on the Royal Netherlands Institute of Chartered Accountants (NBA) Maturity Model of the Dutch professional association for IT auditors (NOREA) and the ISO27001/2:2017 standard. If you believe that your data are not being adequately protected or there are indications of misuse, please contact:

 [email protected]

You are entitled to inspect, correct or delete your personal data. You are also entitled to withdraw your consent for the processing of data or to lodge an objection to the processing of your personal data by Hanze.

You can submit a request for the inspection, correction, deletion or transfer of your personal data, a request to withdraw your consent or an objection to the processing of your personal data to [email protected]. We will respond to your request as soon as possible but within four weeks at the latest. 

Hanze would also like to point out that you have the possibility to submit a complaint to the national supervisory authority, the Dutch Data Protection Authority.