Version 18 November 2021

(NL) Student Mobility Pilot – Privacy Statement

Thank you for taking the time to read the privacy statement of the Student Mobility Pilot! We have devoted a great deal of attention to the protection of your personal data and the rights you have in relation to student mobility. This privacy statement spells out these rights in more detail. If, after reading this Privacy Statement, you still have any questions, comments or concerns, please do send us an email. Our contact details are set out at the foot of this page.

1 Introduction to the Student Mobility Pilot

Within the framework of the Student Mobility Pilot, educational institutions can participate in and use a technology platform that makes it easier for students to receive education outside the institution where they normally study (the "Home Institution"). This makes it possible for students to enrol for a course or learning module with another institution (the "Host Institution") from a web-based course catalogue (link) by means of a standardised process, and their attainment (such as a grade) will be automatically returned to the Home Institution.

This student mobility platform is made available by SURF to facilitate this exchange of students between institutions in a safe and trusted way. The Platform has been specifically developed to safeguard the protection and security of your personal data.

2 Personal data processing

Personal data relating to you is processed in three ways.

2.1 Visits to the website eduxchange.nl

When you visit the website on https://eduxchange.nl, for instance, to browse the range of available courses, your IP address, session ID and the name of the home institution you have chosen will be processed. The data controller responsible for this processing is SURF and these personal data is processed with the lawful basis of legitimate interest. Any queries may be sent to projectstudentmobiliteit@surf.nl.

2.2 Enrolment at the Host Institution

Once you start the enrolment process, your identity will be established using SURFconext and eduID (both from SURF), and you will be asked to consent to the release of the personal data. Once you have provided your consent, the following data will be transmitted– without any involvement by SURF as an intermediary – to the chosen Host Institution:

Data retention and lawful basis are based on the individual policies of each Host Institution. Both your Home Institution and the Host Institution will independently be identified as the data controller for this processing. Any queries may be sent to:

Important! Sometimes, a Host Institution may require additional information from you to complete the enrolment. The Host Institution will contact you directly about this.

2.3 Return of the attainment (grade)

After following the course or learning module, your attainment (usually a grade) will be automatically and directly returned to the Home Institution. This requires processing of the following personal data:

Data retention and lawful basis are based on the individual policies of each Host Institution. Both your Home Institution and the Host Institution will independently be identified as the data controller for this processing. Any queries may be sent to:

3 Who do we provide the data to?

Officials from your Home Institution and Host Institution require access to your personal data before they can enrol you or provide you with teaching. SURF only has access to the data resulting from your visit to https://eduxchange.nl (see 2.1 Visits to the website). Personal data will not be disclosed to other parties.

4 Security

Security measures, including the following, have been taken to protect your personal data:

• During the development of the Student Mobility Pilot, a great deal of attention has been devoted to personal data protection and security by design. This has helped us create a system in which as little personal data as possible is processed by as few parties as possible at each step in the process. We have also implemented measures to provide assurances of data quality.
• Personal data held by the Home Institution may only be obtained by the Host Institution with a student's personal key generated by SURFconext.
• Communication between systems and between the client (student's browser) and the systems is encrypted in accordance with generally accepted principles and best practices.
• An extensive independent security audit (code review and penetration testing) took place before the systems went live. All audit findings have been successfully addressed and, where relevant, resolved. If there are any significant changes to the code, it will be reaudited.
• Access to servers is restricted and secured in accordance with the state of the art in security technology, standards and best practices.
• https://eduxchange.nl is redundantly hosted on SURF's own servers at data centres in the Netherlands. Back-ups are made daily.
• All operating systems and software are kept up to date.

5 Your personal data rights

You have the following rights with regard to your own personal data:

• You may submit a request to modify, supplement or delete your data if it is incorrect or no longer relevant.
• You may submit a request to access the data about you that we process.
• You may object to the processing of your data if we process your data on the legal basis of a legitimate interest or the performance of a task in the public interest.
• You may submit a request to limit the processing of your data in relation to the processing of data which you have objected to, which you consider to be unlawful, whose accuracy you have disputed, or where we no longer need the personal data, but you need it in the context of legal action.
• You may request an export of the data we process on you, in a structured and common format, and you have the right to portability of this data to another service provider.
• You may withdraw your consent for the processing of your personal data. However, the withdrawal of your consent will not affect the lawfulness of any processing based on your consent prior to its withdrawal.
• If you believe that SURF has not handled your personal data properly, you may submit a complaint to SURF.
• You have the right to submit a complaint about SURF to the Dutch Data Protection Authority. More information on the Dutch Data Protection Authority and the procedure for submitting complaints can be found on the website of the Dutch Data Protection Authority.

If you wish to assert these rights, please contact:

When in doubt, pleae contact projectstudentmobiliteit@surf.nl. SURF will make sure your question, request or complaint will be send to the party it is intended for.

6 Amendments to the privacy statement

We may amend this privacy statement from time to time. We therefore advise you to consult our privacy statement regularly.