Privacy statement declaration form for external parties

Version: 22-12-2021

Utrecht University (hereinafter: ‘UU’, ‘our’ or ‘we’) handles your personal data with care. Complying with legislation on the protection of personal data such as the General Data Protection Regulation (‘GDPR’) is crucial in this respect.

This privacy statement is applicable to personal data of external private persons and nonemployees (hereafter: ‘your’ or ‘you’), such as freelancers and guest teachers, who submit their expenses for services provided to the UU by completing our online web form. In this privacy statement we inform you about the purposes for which personal data are processed, how you can exercise your privacy rights and other information that may be of importance to you.

Party responsible and accountable

The UU is the data controller under the GDPR. As a data controller the UU is responsible and accountable for the processing of your personal data. The UU finds it essential that your personal data is handled and protected with the utmost care. We also want to be open about the way in which we process your data. We will therefore explain this below.

1.    What personal data does UU collect?

We collect your personal data when you submit the online declaration form. In order to be able to pay out claims and to meet our administrative obligations, we collect the following categories of personal data from you:

2.    For which purposes does the UU process your personal data and on what grounds does the UU base these processes?

The UU processes personal data for the following purposes:

• Processing claims and paying you the claim amount to which you are entitled;
• Fulfilment of administrative obligations imposed on UU by Dutch tax law;
• Providing access to the online declaration

We collect your aforementioned personal data and provide them to the Dutch Tax and Customs Administration. The legal basis for this data processing is to comply with a legal obligation. By virtue of Section 10.8 of the Income Tax Act 2001 in conjunction with Section 22a of the Income Tax Implementing Decree, UU is obliged, as of 1 January 2022, to declare certain amounts paid to private individuals to the Tax Authorities. The processing of personal data in order to be able to pay the claim amount to you, is done on the basis of the agreement we have concluded with you.

3.    Data sharing with third parties

We only share your personal data with the Tax and Customs Administration. Your data will not be shared with other third parties unless that third party processes personal data on behalf of Utrecht University (for instance software that runs our digital financial administration or our online web form) or pursuant to a legal obligation. UU enters into agreements with these data processors to ensure the confidential and careful handling of personal data. These agreements are contractually laid down in so-called ‘Data Processor Agreements’.

Your personal data will not be rented or sold to third parties.

4.    Transfer of your data outside the EU

The UU does transfer your personal data to countries outside the EU.

5.    How long will your data be stored?

The UU takes appropriate measures to ensure that your personal data are kept for no longer than is necessary for the above-mentioned purposes. The statutory retention period for your personal data that is necessary to comply with Dutch Tax law is 7 years. After that, your personal data will be deleted.

6.    What are your rights?

Right of access, correction or deletion

You are entitled to submit an access or rectification request to the UU. When making this request, please indicate clearly that this relates to an access or rectification request based on the GDPR. You may also request that your data be erased, although this is only possible insofar as this allows UU to continue to fulfil its legal obligations, such as a legal retention period.

Send your request to the email address privacy@uu.nl, clearly stating the type of request in the subject line of your mail.

Please note that the provision of a copy of an identification document may be necessary in order to verify your identity. Making a secure copy of your ID is easy with the government’s ‘KopieID- app’ (Dutch information), which you can download from the app store.

Right to transfer data

You have the right to obtain your personal data processed by the UU in a structured, accessible and digital form and/or to transfer this personal data directly to another data controller. Please submit your request to privacy@uu.nl if you want to transfer your personal data to another data controller.

Right to lodge a complaint

If at any time you are of the opinion that UU is breaching any of your rights relating to the protection of your personal data, you have the right to file a complaint with the Dutch Data Protection Authority (DPA):

Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ DEN HAAG
Tel. Privacy Information and Contact Centre: +31 (0)88 – 1805 250
E-mail: info@autoriteitpersoonsgegevens.nl

Read more (Dutch only) about reporting a complaint to the DPA, the best approach to your complaint and the possibility to fill in the digital ‘reporting form for complaints‘.

7.    How does UU protect your personal data?

UU takes appropriate technical and organisational measures to protect personal data in terms of confidentiality, integrity and availability. We have thus implemented various measures to protect your personal data against loss, modification, accidental or unlawful destruction, unauthorised disclosure of or access to your personal data.

Below you can find a non-exhaustive list of our security measures:

• Your personal data is mainly stored in our Internet Web Form-portal (the ‘IWF-portal’) of the UU;
• The IWF-portal is secured in accordance with the UU system security measures;
• Access to the personal data is limited to UU employees who need the data for the performance of their duties.

8.    Adjustments

UU reserves the right to amend this privacy statement from time to time. This will always be done in accordance with the GDPR and other privacy regulations and legislation. When we make adjustments to the content of this privacy statement, we will adjust the date and version number of this privacy statement.

Questions

Do you have any specific questions or comments about this privacy statement as a result of this information? Please feel free to contact the Accounting Services (ASC) team Accounts Payable (UG). You can send a message to infocrediteuren@uu.nl.

The UU Data Protection Officer (DPO) can be reached via fg@uu.nl.