Right to be informed

As an employee, student, guest, visitor or external partner of the UvA, or as a participant in scientific research, you have the right to know what is happening to your personal data and why.

Right of inspection

As an employee, student, guest, visitor or external partner of the UvA, or as a participant in scientific research, you have the right to inspect personal data relating to you that are processed by or on behalf of the UvA.

Right to data portability

You can submit a request to receive your personal data in a ‘machine-readable format’ or to have the UvA transmit it to another institution. This can only be done if processing takes place on the basis of consent or on the basis of a contract, and only relates to data that you yourself as data subject have provided.

Right to rectification, to restriction of processing, to erasure and ‘to be forgotten’

Based on a request for inspection, you can ask us to rectify, restrict processing of, erase or 'forget' your personal data.

Rectification

By rectification of data, we mean amending or adding to your data. You can make such a request if your data are incomplete or not (or no longer) correct. The UvA is keen to ensure the accuracy of your personal data and is therefore happy to rectify your data, whether at your request or on its own initiative.

Changes to your contact details at work or at home, your account number or your name can be made through the Self-Service tool. In the Self-Service tool, click on ‘My data' > 'Personal data' > 'Inspect or rectify personal data'.

Please note

The right to rectification is designed to rectify obvious errors in the case of readily identifiable inaccuracies, e.g. an error in your date of birth. It cannot be used to trigger a substantive review, e.g. you cannot use the right to rectification to correct exam grades or research results.

It may be that, as a result of a statutory obligation, the UvA cannot amend your personal data or can only amend it under specific conditions. If this is the case, you will be notified of the reasons for this.

Restriction of processing

Under the right to restriction of processing, the processing of your personal data, excluding the storage thereof, is temporarily suspended. You can invoke this right if you are unsure about the correctness of the data relating to you that the UvA processes, for example. In the case of a restriction of processing request, your personal data are not deleted. After all, it must remain possible for the requested restriction to be undone.

Please note

If the UvA requires your personal data on account of a compelling interest, the UvA can and will continue to process your personal data for this purpose and the restriction of processing request will be rejected. If this is the case, you will be notified of the reasons for this.

Right to erasure and ‘right to be forgotten’

You also have a right to erasure and a ‘right to be forgotten’. You can ask the UvA to delete your data. You can also ask the UvA to remove any link to your personal data ('to be forgotten').

Please note

Requests for erasure of personal data and requests to be forgotten can also be rejected. Reasons for this include a statutory processing obligation, a task carried out in the public interest or archiving.

Right to object

Before your personal data are processed, the various interests will be assessed, meaning your right to privacy will be balanced against the interest in processing the data. This assessment is general and abstract.

If a specific situation applies to you, you can inform the UvA of this situation. This will enable the UvA to reconsider the interest in processing the data based on your new or specific situation. 

Please note

If a processing activity is based on your consent, it is not possible to object to it. In that case, you may, however, withdraw your consent.

How can you use your rights at the UvA?

Submitting a request

You can use the rights accorded to you by the GDPR by sending an email to jz-privacy-bb@uva.nl. Please note: personal data that are processed by persons or organisations with an obligation of confidentiality, such as, for example, the student psychologist or occupational physician, can be requested directly from the person or organisation concerned.

Identification

Whenever the UvA receives a request, it must ensure that the person making the request is actually the person to whom the data relate. To this end, the UvA must determine your identity. When in doubt about the identity, the UvA may asked you to provide for additional identification.

Timeframe

The UvA will handle your request with care. You will get an answer as soon as possible. This period may take up to a month. The processing of complex requests may be extended by up to two months. You will be informed of such an extension within a month of your request.

Complaints and the Data Protection Officer

The UvA has a Data Protection Officer (DPO). The DPO is an independent compliance officer who ensures that the UvA processes personal data in accordance with the applicable regulations and gives advice on following the GDPR and othe relevant regulations. The DPO is registered with the Dutch Data Protection Authority and is the link between the UvA and the DDPA.

Employees and students who believe that their personal data have not been properly handled may submit a complaint to the DPO: fg@uva.nl.

The DPO acts independently and can consult or obtain advice from the Dutch Data Protection Authority about your complaint

If you do not agree with the way your complaint has been handled by the DPO, you can submit a complaint directly to the Dutch Data Protection Authority. The Dutch Data Protection Authority handles the complaint or the request and makes a decision about this.