Privacy Statement Osiris

Personal data are pieces of information that can enable another person to identify you. There are many kinds of personal data, the obvious ones being someone's name, address and place of residence. Those data relate directly to a particular person or can be directly traced back to that person. There are also indirect personal data. These are data that say something about a person when combined with other data. In other words, they can be traced back to a person indirectly. Examples include your postal code combined with other data that can be traced back to you indirectly.

Osiris is the system Hanze UAS uses to record the data of course participants and/or students and to record study progress. The data we process in that system are processed for the following purposes:

• to facilitate logistical student administration
• to organise teaching and examination administration
• to track and record our students’ study progress
• to manage documents and their archiving
• financial accounting concerning students, for the payment of tuition fees
• to record data for the purposes of the support provided by Hanze Student Support
• to analyse academic results with a view to improving teaching

When you register with our institution, we will start by processing your data in Osiris. Some data will be processed when you first register, while others will be processed in the course of your studies. Examples include study progress data, such as examination results.

Student/Course participant:

•  name
•  address
•  town/city
•  gender
•  date of birth
•  place of birth
•  country of birth
•  municipality
•  nationality
•  school email address
•  external email address
•  email address for registration
•  language of instruction
•  passport photograph
•  mobile or other telephone number
•  study progress
•  payment details
•  additional resources for examination administration (not medical data)
•  Hanze Student Support notes
•  general notes that students may view
•  student ID number
•  student attendance list for examinations
•  diploma data
•  previous education

Students from outside the EEA

• second nationality, if applicable
•  residence document
•  residence document application date
•  residence document start and expiry date
•  alien registration number
•  institutional status with the Immigration and Naturalisation Service (IND)

Employee

• four-letter code
•  name
•  email
•  work telephone number
•  the rights of the employee in Osiris
•  current employee/employee leaving Hanze UAS

For data processing to be legally valid, we must be able to rely on one of the six legal bases provided for by the General Data Protection Regulation (GDPR).

As an educational institution, we have been given a number of tasks under the law that relate to teaching. Many of those tasks are laid down in the Dutch Higher Education and Research Act (Wet op het Hoger Onderwijs en Wetenschappelijk Onderzoek, WHW). We will sometimes process your personal data when performing those teaching duties. On such occasions, we will process those personal data because, for example, it is necessary for carrying out a task in the public interest. In Osiris, we process certain personal data on this basis, including, for example, to keep track of study progress and/or to allocate special provisions. We rely on the ‘public interest’ basis for processing operations carried out based on such tasks.

 As an educational institution, we are sometimes obliged to process certain data concerning you. Such an obligation may arise under the Dutch Higher Education and Research Act or the Student Finance Act 2000 (Wet studiefinanciering 2000). The data we record when you register with our institution are an example of this. For data processing to be legally valid, we rely on the ‘legal obligation’ basis.

The personal data of other data subjects, such as employees (e.g. lecturers), are also processed in Osiris. Examples include back office support or a lecturer's examination mark.

We respect your privacy and will retain your personal data for no longer than is necessary. There may be occasions when the law requires us to retain certain data for a particular period. Those obligations are included in Hanze's Selection List. We have set out below for how long your data will be retained.

• Examination attendance lists are deleted four months after definitive recording of the results in Osiris.
• Data concerning special provisions are retained for one year after the end of entitlement to those provisions.
• Academic results and study progress records are retained for up to seven years after termination of enrolment.
• Data concerning your (annual) enrolment, authorisation for the payment of tuition fees and the proof of your enrolment are retained for up to seven years after enrolment.
• Diploma data are retained for 50 years.
• The other data in Osiris that do not have a legal retention period are deleted two years after a student terminates their enrolment.

The personal data that are processed in Osiris come from various internal sources. We receive data from Studielink, the Education Executive Agency (DUO) and the municipality where you live. Those parties collaborate to ensure that students are enrolled correctly in accordance with the Higher Education and Research Act (WHW) and other legislation. This is so that you can be correctly identified and so the amount in tuition fees you have to pay be can be determined.

For employees, we retrieve data from AFAS, the system used to record employee data.

We will not disclose your personal data unless a legal obligation requires us to do so. Examples include obligations arising under the Student Finance Act 2000 or the Dutch Higher Education and Research Act. In the event that we commission a supplier to perform a particular service for us, we always conclude a processing agreement to protect your data. Lastly, we share data internally for teaching purposes.

Internally, access is given to:

• Lecturers and/or Academic Counsellors: lecturers and academic counsellors are given access to Osiris in order to perform their tasks. Lecturers and academic counsellors are given access only to those student data they need to perform their duties.
• The school’s administrative employees: they have access only to information they need to perform their duties. Those duties include linking students to education programmes, enrolling students in curricular components and developing teaching.
• Examination Board: it is given access to the information it needs to perform its duties. For instance, the Examination Board grants exemptions.

The Examination Board secretary will check to make sure that you have met the requirements of the final examination subjects at the end of your studies. During those checks, the secretary will verify that you have obtained the required credits and have produced a completed work placement and final project dossier. The checks do not include checks of content. The Student Administration, which is responsible for the actual processing of your diploma, will be notified when you satisfy the requirements of the final examination subjects.

• Hanze Student Support: Hanze Student Support supports and helps students to deal with stress and tension during their studies. The data recorded by the student counsellor or student psychologist are confidential and cannot be accessed by other people.
• Marketing and communication employees: they can view details of students’ degree programmes and study progress in order to give study choice advice.
• Student Administration: this body is given access in order to perform duties regarding the registration and deregistration of students and arranging graduation ceremonies.
• International Student Office: the Office takes care of the process students from outside the European Economic Area undergo with regard to, for example, immigration and financial guarantees.

Externally, access is granted to:

• The supplier: Hanze UAS does not own Osiris. Osiris is a system that is supplied by CACI. CACI is established in Amsterdam, the Netherlands and has a processing agreement with Hanze UAS to protect your personal data. That processing agreement contains agreements on the processing of your personal data, including an agreement whereby your data will remain within the European Economic Area (EEA) and will be adequately protected.
• The auditor: the auditor checks enrolments and the degrees obtained, based on the legal obligation that must be met in order to receive funding.
• DUO: DUO checks, among other things, the enrolment and results of students, based on the legal obligations to provide students with student finance, for example.
• Institutional status with the Immigration and Naturalisation Service: this is for the provision of residence permits and other resources for students from outside the EEA, based on the legal obligation provided for in, for example, the Aliens Act 2000 (Vreemdelingenwet 2000).

Automated decision-making means that decisions are made by computer programs or systems without any human intervention. Such decision-making also takes place within Osiris. Osiris will automatically enrol you before 1 September for a specific period if you satisfy the enrolment conditions. This results in an automatic notification stating that you are enrolled. The reason we use automated decision-making is because we enrol a large number of students every year. This makes it virtually impossible to include human intervention in such decisions.

In our view, there are few adverse consequences in using automated decision-making. After all, the enrolment conditions are provided by law, and for your enrolment to be valid, you must meet them.

There may be occasions when something goes wrong with the automated decision-making process. If you believe you have been disadvantaged in the automated decision-making process, you are entitled to request human intervention. You may contact the Examination Board for your degree programme with regard to this.

We take the protection of your personal data seriously and have taken appropriate measures to prevent misuse, loss, unauthorised access, inappropriate disclosure and unauthorised changes. This way, your data will be accessible only by persons authorised to have access by virtue of their positions or duties. The information security and privacy policy is based on the Royal Netherlands Institute of Chartered Accountants (NBA) Maturity Model of the Dutch professional association for IT auditors (NOREA) and the ISO27001/2:2017 standard. If you believe that your data are not being adequately protected or there are indications of misuse, please contact:

[email protected]

You are entitle to inspect, correct or delete your personal data. In addition, you have the right to object to the processing of your data by Hanze. 

You can submit a request for the inspection, correction, deletion or transfer of your personal data, a request to withdraw your consent or an objection to the processing of your personal data to [email protected]. We will respond to your request as soon as possible but within four weeks at the latests.

Hanze would also like to point out that you have the possibility to submit a complaint to the national supervisory authority, the Dutch Data Protection Authority.