Privacy statement International Service Desk (ISD)

Utrecht University (UU) is committed to look after the personal data of everyone who visits our website. The privacy rules from the General Data Protection Regulation (GDPR) are crucially important to us, as this legislation is in line with our objective to provide education and do research at the highest level, our ambitions for good employment practices and our guiding principle of sustainability.

In this privacy statement we inform you about the personal data we process as the ISD, about the purposes for which we do this, about your privacy rights and about other matters that are important to you.

Who is responsible for processing my personal data?

UU is the controller within the meaning of the General Data Protection Regulation (GDPR) and is responsible for the processing of the personal data described in this privacy statement.

The UU is a legal entity under public law pursuant to Article 1.8 of the Higher Education and Scientific Research Act and is located at Heidelberglaan 8, (3584 CS) Utrecht. The UU has a legal obligation to process your personal data carefully. The UU believes it is essential that the personal data of its employees is treated and secured with the utmost care. The most important thing is that we strive to comply with the requirements of the GDPR in all cases.

For what purposes are my personal data processed?

Your personal data will only be processed for a specific purpose. In this case, the ISD processes your personal data to be able to help you with the onboarding process. You are not obliged to leave your personal data, but it is necessary if you want our help. The purposes are as follows:

• To start and complete an application procedure at the Immigration and Naturalization Service (IND) for a visa and/or residence permit in order to ultimately employ you as an employee and to comply with the legal retention and administration requirements as a recognized sponsor;
• To contact you about the procedure and follow-up;
• To make an appointment at a Dutch city hall for registration and to obtain a citizen service number;
• Applying for tax beneficials from the Dutch Tax Authorities;
• Applying for work permits for student assistants;
• Offering and providing a partner program and family services;
• Offering assistance with housing; and
• Delivering a food package.

Which personal data are processed?

The following personal data will be collected for the application procedure:

• name and address details (name, address, place of residence);
• bank account number;
• phone number;
• date of birth;
• e-mail address;
• sex;
• nationality;
• marital status;
• personal data stated in the CV that you share with us, such as work experience and completed training;
• data relating to your employment;
• achieved diplomas;
• the file for the application for a tax benefit;
• the file for the application for a work permit for student assistants;
• the file of the application procedure at the IND and all the necessary attached files and, if necessary, of family members traveling with/following along.

For how long will the UU keep my personal data?

Your personal data will not be kept longer than necessary or as long as the law requires it. This varies per personal data:

• Entry and residence procedure

As a recognized sponsor, the UU is legally obliged to keep your file and any of your accompanying family members for up to 5 years after the UU’s sponsorship has ended.

• Short-stay employees

Your file as a short-stay employee will be kept for 1 year after applying for the tax benefit scheme. It may happen that there are still follow-up questions.

• File application for 30% tax beneficial ruling

The file with your personal data for the application for the 30% ruling with the Tax Authorities will be kept for up to 1 year after the application in case follow-up questions arise.

• File application for a work permit

As a recognized sponsor, the UU is legally obliged to keep your personal data for 5 years after the end of the sponsorship.

• Employee portal

Your personal data in the employee portal will be deleted after 1 year of inactivity.

What is the legal basis?

We only process your personal data if there is a basis for this. These are as follows:

• Entry and residence procedure at the IND for foreign, non-EU employees

This processing is based on the legal obligation. As a recognized sponsor, the UU takes care of the entry and residence procedure for foreign employees. The UU has therefor a legal duty of care, information duty and administration duty towards both the IND and the foreign employee.

• Entry and residence procedure at the IND for traveling family members of foreign, non-EU employees

In the context of good employment practices, the UU offers to take care of the entry and residence procedure for family members. The basis for this processing is legitimate interest. This is a service that the UU offers to give you the opportunity to still be with your family members during your employment at the UU. To make this possible, it is necessary to also process the personal data of your family members. We only process necessary personal data. The rights and freedoms of your family members are as much as possible guaranteed.

• Onboarding process of employees with an EU nationality

The basis for this processing is legitimate interest. The UU provides a service to employees with an EU nationality in the context of good employment practices by providing advice on housing, obtaining a citizen service number and, if applicable, applying for the tax benefit scheme. With this service, we try to make it as easy as possible for you. To make this possible, it is necessary to process your personal data. Your rights and freedom are as much as possible guaranteed.

• Employees with a short-stay visa

The basis for this processing is legitimate interest. The UU provides you with the service by advising on housing and obtaining a citizen service number. This will simplify your onboarding process and employment at the UU. Therefore it is necessary to process your personal data. Here too, your rights and freedoms are as much as possible guaranteed.

• Application work permit for student assistants

This processing is based on the legal obligation. As a recognized sponsor, the UU can apply for a work permit on behalf of a student assistant at the Employee Insurance Agency (UWV). The UU has a legal duty to take care of this procedure for student assistants and has a information obligation, retention obligation and administration obligation.

• Offering a housing program

The UU offers advice on housing and helps you to get in contact with the right company. The basis for this processing is legitimate interest. The UU does this as a good employer and so that you can easily settle after arriving in the Netherlands. For this it is necessary to share your contact information. Your rights and freedoms are as much as possible guaranteed.

• Partner program

The UU can offer your partner a so called partner program. The basis for this processing is legitimate interest. If your partner doesn’t feel at home in the Netherlands, it may possibly affects the employee themselves. Therefor the UU offers this service to partners who want to join this program. The UU will appoint a coach to the partner and therefor it is necessary to share the contact information of your partner.

• Family services

For some foreign employees, emigration brings along very complex issues. The UU offers in this case a coach who can help and support you and your family members who travelled along. The basis for this processing is legitimate interest. The UU wants to be a good employer and wants to support you in every possible way. To provide you this service, it is necessary to share your contact information and some background information with our coaches. No more information than needed will be shared.

• Arranging a food package

The UU offers you a food package upon arrival in the Netherlands. The basis for this processing is legitimate interest. The UU offers this to give you a warm welcome. For this it is necessary to share your address with our local supermarket.

With whom will my personal data be shared?

Your personal data will only be shared with third parties if this is necessary. Your personal data will only be shared with the following parties:

• Immigration and Naturalization Service (IND): for starting the Entry and Residence Procedure;
• Tax authority (Belastingdienst): to apply for the fiscal 30% ruling via Sofie;
• Employee Insurance Agency (UWV): to apply for a work permit for student assistants;
• City Hall: for registering and receiving a BSN;
• Housing partners: My Home Relocater, Stadshuijs
• Family Services: Expat Services Utrecht
• Supermarket Plus: for receiving a shopping package.

Will my data be shared outside the EEA?

Your personal data will not be processed outside the European Economic Area (EEA).

Automated decision making

No automated decisions are made in any way without any human intervention.

How does the ISD ensure confidential handling of my personal data?

The ISD handles personal data confidentially and with care. The ISD takes appropriate technical and organizational measures to ensure that personal data is protected. To optimally protect your personal data against unauthorized access or use, the ISD applies appropriate security technology. We report (attempted) abuse to the police. The ISD also takes organizational measures to protect personal data against access by unauthorized persons. The ISD only shares personal data in accordance with this Privacy Statement and only with third parties if this is permitted and if it is done with care.

What rights under the GDPR do I have?

When processing your personal data, you have a number of rights, such as the right of access, the right to rectification, the right to restrict processing and the right to not be subject to a decision based solely on automated processing. You can also request to have your data deleted. However, this is only possible to the extent that UU can still meet its legal obligations. In some cases you have the right to have an entire set of data that we have about you transferred to another organization. This is called the right to portability. For more information about your GDPR rights, please refer to the general privacy statement for employees.

You can submit your request via the following form for those with a working SolisID: Privacy request form (Topdesk). Those without a working SolisID can submit their request via the following form: Privacy request form (uu.nl). When submitting your request, we may ask you a number of questions to determine your identity.

Contact and complaint options

Do you have any specific questions or comments about our Privacy Statement based on this information? Please feel free to contact us. You can use the contact form on the website or send an e-mail to privacy@uu.nl. If you want to file a complaint, you can send an e-mail to our Data Protection Officer (fg@uu.nl). You also have the right to file a complaint at the Dutch Data Protection Authority about the use of your personal data. This can be done via the following link: Tip or Complaint at the Dutch Data Authority.

This Privacy Statement was last changed on the 1^{st of} May, 2024. The UU reserves the right to make changes to this Privacy Statement where necessary.