INKOM Privacy Statement

The INKOM is part of Maastricht University. Your privacy is important to Maastricht University (UM) and UM therefore treats your data with care. UM is the controller of your personal data. This privacy statement explains how UM safeguards your privacy.

This privacy statement specifically pertains to the activities for the benefit of the INKOM, the general introductory week of Maastricht University for all its new students. The INKOM processes the data of those participating in the INKOM. This includes – among others – new students, volunteers assisting during the INKOM, but also third parties who wish to participate in the INKOM.

UM also has a general privacy statement, which can be found at www.maastrichtuniversity.nl/about-um/um-general-privacy-statement. This general privacy statement concerns the processing of data not specifically referred to in this INKOM Privacy Statement. The general privacy statement will be referred to from time to time in this document for information purposes.

Contact details

If you have a query about this privacy statement or want to know more about how UM handles personal data, or if you have a complaint, please contact:

Maastricht University

attn. Data Protection Officer

PO Box 616

6200 MD Maastricht

privacy@maastrichtuniversity.nl

You can also contact UM's Data Protection Officer directly by emailing fg@maastrichtuniversity.nl.

What personal data does UM process?

Within the framework of the INKOM, UM can process the following personal data:

Personal data that may be processed for all visitors of the INKOM:

• Name and address details;
• Email address;
• Gender;
• Nationality;
• Telephone number;
• Date of birth and age;
• Bank account number including ascription;
• User name and IP address;
• Image captures and photos;
• Preferred language;
• Information on how you reached the INKOM website.

Personal data that may be processed for participants of the INKOM:

• Study;
• Student ID number;
• Dietary wishes during the BBQ of the INKOM;
• Preferences with regard to the placement into mentor groups;
• Contact details in case of emergency.

Personal data that may be processed for mentors of the INKOM:

• Study;
• Student ID number;
• Dietary wishes during the BBQ of the INKOM;
• Preferences with regard to the placement into mentor groups;
• Preferred partner by partner’s email address;
• Membership of a (student)association.

Personal data that may be processed for volunteers of the INKOM:

• Clothing model and size;
• Preferred partner by partner’s email address;
• Preferred working position;
• Interest in working for the INKOM as a driver and, if so, whether you have a driving licence (incl. the type) or certificate (incl. the type);
• Availability shortly before the INKOM and during the INKOM.

UM receives a large portion of the data directly from you, for example as a result of you creating an account on the INKOM website. UM acquires other data from third parties that have processed your personal data on UM's instruction or that are legally obliged to share your personal data with UM.

Sensitive personal data

Sensitive personal data are data that are sensitive in nature. For example, these can be data that reveal your race or ethnic origin, political opinions, religious or philosophical beliefs, membership of a student association¹ or sexual orientation. The term 'sensitive personal data' also includes data about your health, genetic data or biometric data through which you can be identified (e.g. a fingerprint).

In principle, UM processes no sensitive personal data for the purpose of the INKOM activities. However, it may do so on occasion, for example if you have indicated that you require special facilities, use medication that must be taken into consideration, are on a specific diet or provide these data at your own initiative. The INKOM will handle your data with diligence and care.

Purposes

UM processes the above personal data in order to make it possible for you to participate in the INKOM. This includes creating an account with the INKOM's registration system and online platform of Tactile, make use of Tactile's application, registering contact for emergencies, contacting and maintaining contact with you prior to, during and after the INKOM, and providing the appropriate facilities during the INKOM, such as food according to dietary needs or allergies. Your data may be processed even after the INKOM, for example if there are issues with regard to payment details, but also if you have subscribed for the newsletter.

In addition, the INKOM collects personal data of current and future volunteers, in order to be able to provide the proper clothing, use the correct language for communication, take as much account as possible of the volunteer's preferences in terms of partner and position and register a crew member's availability, among other reasons.

In addition, UM processes personal data (image captures) for promotional purposes.

Lawful basis for processing

Whenever UM processes your personal data, it does so with a lawful basis for processing. A lawful basis for processing is the grounds for processing personal data.

UM primarily processes your personal data for the benefit of performing its agreement with you regarding your participation in the INKOM.

UM may require additional permission from you to process certain personal data. In that case, the lawful basis for processing is 'permission'.

Sometimes, the INKOM is legally obliged to process your personal data, if there is an incident during the INKOM in which the police is involved, for example. In addition, UM may process your data in order to protect your vital interests, such as in the event of a medical emergency.

Finally, UM sometimes has a legitimate interest in processing your personal data. This applies to the pictures taken and videos made during the INKOM. These may be used for promotional purposes. If you wish to object to this (also refer to 'Your rights'), you can make your objections known via inkom@maastrichtuniversity.nl or privacy@maastrichtuniversity.nl.

Retention periods

UM does not keep personal data for longer than is necessary to achieve the purpose of processing or to comply with a legal obligation. After the INKOM, most personal data are deleted within 6 months of the last INKOM activity for which you registered as a participant (new students) or as a mentor, or for which you purchased a ticket. If you are still subscribed to the newsletter at that time, you will be automatically unsubscribed.

This excludes payment details, which must be kept for a period of seven years.

Recipients of personal data

UM has taken steps to ensure that only those individuals who need to process your personal data have access to them. Your personal data will not be used by third parties, with the exception of those parties that enable UM to perform the activities of the INKOM, which may have access to the personal data. INKOM has concluded written agreements with these parties concerning the processing and security of personal data. This includes, for example, Tactile as creator of the registration system and cashless payment system, the payment provider, photographers, video team and the INKOM volunteers.

Your rights

Privacy legislation gives you a number of rights in relation to your personal data. These are outlined below. The general privacy statement at www.maastrichtuniversity.nl contains more information about each of these rights and how to exercise them.

You have the right to inspect, rectify or delete your personal data. In addition, you have the right to restrict processing, to have your data transferred to another party and to object if your data are processed on the basis of a legitimate interest.

If you wish to exercise one of the rights described below, please email privacy@maastrichtuniversity.nl or contact the Data Protection Officer directly at fg@maastrichtuniversity.nl.

If you have a complaint about the way UM processes your personal data, please contact UM using the contact details above. Moreover, you have the right to submit a complaint to the Dutch Data Protection Authority. Details of how to do this can be found on the Data Protection Authority's website.