eduXchange.nlFAQ

Version 18 November 2021

Student Mobility Pilot – Privacy Statement

Thank you for taking the time to read the privacy statement of the Student Mobility Pilot! We have devoted a great deal of attention to the protection of your personal data and the rights you have in relation to student mobility. This privacy statement spells out these rights in more detail. If, after reading this Privacy Statement, you still have any questions, comments or concerns, please do send us an email. Our contact details are set out at the foot of this page.

1 Introduction to the Student Mobility Pilot

Within the framework of the Student Mobility Pilot, educational institutions can participate in and use a technology platform that makes it easier for students to receive education outside the institution where they normally study (the "Home Institution"). This makes it possible for students to enrol for a course or learning module with another institution (the "Host Institution") from a web-based course catalogue (link) by means of a standardised process, and their attainment (such as a grade) will be automatically returned to the Home Institution.

This student mobility platform is made available by SURF to facilitate this exchange of students between institutions in a safe and trusted way. The Platform has been specifically developed to safeguard the protection and security of your personal data.

2 Personal data processing

Personal data relating to you is processed in three ways.

2.1 Visits to the website eduxchange.nl

When you visit the website on https://eduxchange.nl, for instance, to browse the range of available courses, your IP address, session ID and the name of the home institution you have chosen will be processed. The data controller responsible for this processing is SURF and these personal data is processed with the lawful basis of legitimate interest. Any queries may be sent to projectstudentmobiliteit@surf.nl.

Personal dataPurpose
IP addressNecessary for using the internet/webserver. The IP address will be logged for 7 days to be able to track down abuse and issues.
Session IDNecessary for using the catalogus and the creation of anonymous statistics about success ratio. This personal data is only processed in cache and has a very short retention.
Home institution nameNecessary to show the student a relevant list of courses. This personal data is only processed in cache and has a very short retention.

2.2 Enrolment at the Host Institution

Once you start the enrolment process, your identity will be established using SURFconext and eduID (both from SURF), and you will be asked to consent to the release of the personal data. Once you have provided your consent, the following data will be transmitted– without any involvement by SURF as an intermediary – to the chosen Host Institution:

Personal dataPurpose
IP addressNecessary for using the internet/webservers.
Access keyNecessary to determine scope and whether the student has given consent for that scope.
Home Institution nameThe Host Institution needs to know where it should request the required personal data.
First nameRequired for enrolment.
Last nameRequired for enrolment.
Date of birthRequired for enrolment.
Place of birthRequired for enrolment.
NationalityRequired for enrolment.
That you are a studentRequired for enrolment.
Institution email addressRequired for enrolment.
Private email addressRequired for enrolment.
Phone number(s)Required for enrolment.
SexRequired for enrolment.
AddressRequired for enrolment.
ICE contact informationRequired for enrolment.
Unique identifierRequired for enrolment.
LoggingNecessary for the prevention and tracking down of abuse.

Data retention and lawful basis are based on the individual policies of each Host Institution. Both your Home Institution and the Host Institution will independently be identified as the data controller for this processing. Any queries may be sent to:

InstitutionPrivacy contactData Protection Officer
Technische Universiteit Eindhovenprivacy@tue.nlfunctionarisgegevensbescherming@tue.nl
Universiteit Utrechtprivacy@uu.nlfg@uu.nl
Wageningen Universiteit & Researchprivacy@wur.nlprivacy@wur.nl

Important! Sometimes, a Host Institution may require additional information from you to complete the enrolment. The Host Institution will contact you directly about this.

2.3 Return of the attainment (grade)

After following the course or learning module, your attainment (usually a grade) will be automatically and directly returned to the Home Institution. This requires processing of the following personal data:

Access keyNecessary to determine scope and whether the student has given consent for that scope.
Home Institution nameThe Host Institution needs to know where it should send the attainment to.
First nameDefault field required for sending back the attainment.
Last nameDefault field required for sending back the attainment.
Institution addressDefault field required for sending back the attainment.
Institution country codeDefault field required for sending back the attainment.
Course abbreviationDefault field required for sending back the attainment.
Course nameDefault field required for sending back the attainment.
StatusDefault field required for sending back the attainment.
ResultDefault field required for sending back the attainment.
Result dateDefault field required for sending back the attainment.
ECTSDefault field required for sending back the attainment.
CommentDefault field required for sending back the attainment.
LoggingNecessary for the prevention and tracking down of abuse.

Data retention and lawful basis are based on the individual policies of each Host Institution. Both your Home Institution and the Host Institution will independently be identified as the data controller for this processing. Any queries may be sent to:

InstitutionPrivacy contactData Protection Officer
Technische Universiteit Eindhovenprivacy@tue.nlfunctionarisgegevensbescherming@tue.nl
Universiteit Utrechtprivacy@uu.nlfg@uu.nl
Wageningen Universiteit & Researchprivacy@wur.nlprivacy@wur.nl

3 Who do we provide the data to?

Officials from your Home Institution and Host Institution require access to your personal data before they can enrol you or provide you with teaching. SURF only has access to the data resulting from your visit to https://eduxchange.nl (see 2.1 Visits to the website). Personal data will not be disclosed to other parties.

4 Security

Security measures, including the following, have been taken to protect your personal data:

  • During the development of the Student Mobility Pilot, a great deal of attention has been devoted to personal data protection and security by design. This has helped us create a system in which as little personal data as possible is processed by as few parties as possible at each step in the process. We have also implemented measures to provide assurances of data quality.
  • Personal data held by the Home Institution may only be obtained by the Host Institution with a student's personal key generated by SURFconext.
  • Communication between systems and between the client (student's browser) and the systems is encrypted in accordance with generally accepted principles and best practices.
  • An extensive independent security audit (code review and penetration testing) took place before the systems went live. All audit findings have been successfully addressed and, where relevant, resolved. If there are any significant changes to the code, it will be reaudited.
  • Access to servers is restricted and secured in accordance with the state of the art in security technology, standards and best practices.
  • https://eduxchange.nl is redundantly hosted on SURF's own servers at data centres in the Netherlands. Back-ups are made daily.
  • All operating systems and software are kept up to date.

5 Your personal data rights

You have the following rights with regard to your own personal data:

  • You may submit a request to modify, supplement or delete your data if it is incorrect or no longer relevant.
  • You may submit a request to access the data about you that we process.
  • You may object to the processing of your data if we process your data on the legal basis of a legitimate interest or the performance of a task in the public interest.
  • You may submit a request to limit the processing of your data in relation to the processing of data which you have objected to, which you consider to be unlawful, whose accuracy you have disputed, or where we no longer need the personal data, but you need it in the context of legal action.
  • You may request an export of the data we process on you, in a structured and common format, and you have the right to portability of this data to another service provider.
  • You may withdraw your consent for the processing of your personal data. However, the withdrawal of your consent will not affect the lawfulness of any processing based on your consent prior to its withdrawal.
  • If you believe that SURF has not handled your personal data properly, you may submit a complaint to SURF.
  • You have the right to submit a complaint about SURF to the Dutch Data Protection Authority. More information on the Dutch Data Protection Authority and the procedure for submitting complaints can be found on the website of the Dutch Data Protection Authority.

If you wish to assert these rights, please contact:

OrganisationPrivacy contactData Protection Officer
SURFprojectstudentmobiliteit@surf.nlfg@surf.nl
Technische Universiteit Eindhovenprivacy@tue.nlfunctionarisgegevensbescherming@tue.nl
Universiteit Utrechtprivacy@uu.nlfg@uu.nl
Wageningen Universiteit & Researchprivacy@wur.nlprivacy@wur.nl

When in doubt, pleae contact projectstudentmobiliteit@surf.nl. SURF will make sure your question, request or complaint will be send to the party it is intended for.

6 Amendments to the privacy statement

We may amend this privacy statement from time to time. We therefore advise you to consult our privacy statement regularly.