Privacy statement International Service Desk (ISD)

Utrecht University (UU) is committed to look after the personal data of everyone who visits our website. The privacy rules from the General Data Protection Regulation (GDPR) are crucially important to us, as this legislation is in line with our objective to provide education and do research at the highest level, our ambitions for good employment practices and our guiding principle of sustainability.

In this privacy statement we inform you about the personal data we process as the ISD, about the purposes for which we do this, about your privacy rights and about other matters that are important to you.

Who is responsible for processing my personal data?

UU is the controller within the meaning of the General Data Protection Regulation (GDPR) and is responsible for the processing of the personal data described in this privacy statement.

The UU is a legal entity under public law pursuant to Article 1.8 of the Higher Education and Scientific Research Act and is located at Heidelberglaan 8, (3584 CS) Utrecht. The UU has a legal obligation to process your personal data carefully. The UU believes it is essential that the personal data of its employees is treated and secured with the utmost care. The most important thing is that we strive to comply with the requirements of the GDPR in all cases.

For what purposes are my personal data processed?

Your personal data will only be processed for a specific purpose. In this case, the ISD processes your personal data to be able to help you with the onboarding process. You are not obliged to leave your personal data, but it is necessary if you want our help. The purposes as follows:

• To start and complete an application procedure at the Immigration and Naturalisation Service (IND) for a visa and/or residence permit in order to ultimately employ you as an employee and to comply with the legal retention and retention requirements as a recognized sponsor and administration obligation;
• To contact you about the procedure and follow-up;
• To make an appointment at a Dutch city hall for registration and to obtain a citizen service number;
• Applying for a tax beneficials from the Tax Authorities;
• Applying for work permits for student assistants;
• Offering and providing a partner program;
• Offering assistance with housing; and
• Delivering a food package.

Which personal data are processed?

The following personal data will be collected for the application procedure:

• name and address details (name, address, place of residence);
• bank account number;
• phone number;
• date of birth;
• e-mail address;
• sex;
• nationality;
• marital status;
• personal data stated in the CV that you share with us, such as work experience and completed training;
• data relating to your employment;
• achieved diplomas;
• the file for the application for a tax benefit;
• the file for the application for a work permit for student assistants;
• the file of the application procedure at the IND and, if necessary, of family members traveling with/following along.

For how long will the UU keep my personal data?

Your personal data will not be kept longer than necessary or as long as the law requires it. This varies per personal data:

• Entry and residence procedure

As a recognized sponsor, the UU is legally obliged to keep your file and any of your accompanying family members for up to 5 years after the UU’s sponsorship has ended.

• Short-stay employees

Your file as a short-stay employee will be kept for 1 year after applying for the tax benefit scheme. It may happen that there are still follow-up questions.

• File application for 30% tax beneficial ruling

The file with your personal data for the application for the 30% ruling with the Tax Authorities will be kept for up to 1 year after the application in case follow-up questions arise.

• File application for a work permit

As a recognized sponsor, the UU is legally obliged to keep your personal data for 5 years after the end of the sponsorship.

• Employee portal

Your personal data in the employee portal will be deleted after 1 year of inactivity.

What is the legal basis?

We only process your personal data if there is a basis for this. These are as follows:

• Entry and residence procedure at the IND for foreign, non-EU employees

The UU acts on the basis of legal obligation. . As a recognized sponsor, the UU takes care of the entry and residence procedure for foreign employees. Thet UU has therefor a legal duty of care, information duty and administration duty towards both the IND and the foreign employee.

• Entry and residence procedure at the IND for traveling family members of foreign, non-EU employees

In the context of good employment practices, the UU offers to take care of the entry and residence procedure for family members. The basis for this processing is legitimate interest. This is a service that the UU offers to give you the opportunity to still be with your family members during your employment at the UU. To make this possible, it is necessary to also process the personal data of your family members. We only process necessary personal data. The rights and freedoms of your family members are guaranteed here.

• Onboarding process of employees with an EU nationality

The basis for this processing is legitimate interest. The UU provides a service to employees with an EU nationality in the context of good employment practices by providing advice on housing, obtaining a citizen service number and, if applicable, applying for the tax benefit scheme. With this service, we try to make it as easy as possible for you. To make this possible, it is necessary to process your personal data. Your rights and freedom are as much as possible guaranteed here.

• Employees with a short-stay visa

The basis for this processing is legitimate interest. The UU provides you with the service by advising on housing and obtaining a citizen service number. This will simplify your onboarding process and employment at the UU. For this it is necessary to process your personal data. Here too, your rights and freedoms are as much as possible guaranteed.

• Application work permit for student assistants

This processing is based on legal obligation. As a recognized sponsor, the UU can apply for a work permit on behalf of a student assistant at the Employee Insurance Agency (UWV). The UU has a legal duty of taking care of the procedure, information obligation and retention and administration obligation.

• Offering a housing program

The UU offers advice on housing. The basis for this processing is legitimate interest. The UU does this as a good employer and so that you can easily settle after arriving in the Netherlands. For this it is necessary to process your personal data. Your rights and freedoms are as much as possible guaranteed.

• Arranging a food package

The UU offers you a food package upon arrival in the Netherlands. The basis for this processing is legitimate interest. The UU offers this to give you a warm welcome. For this it is necessary to process your data. As little personal data as possible is processed and your rights and freedoms are not limited.

With whom will my personal data be shared?

Your personal data will only be shared with third parties if this is necessary. Your personal data is therefore shared with the following parties:

• Immigration and Naturalization Service: for starting the Entry and Residence Procedure;
• Tax authority (Belastingdienst): to apply for the fiscal 30% ruling via Sofie;
• Employee Insurance Agency (UWV): to apply for a work permit for student assistants;
• Municipalities: for registering and receiving a BSN;
• Supermarket Plus: for receiving a shopping package.

Will my data be shared outside the EEA?

Your personal data will not be processed outside the European Economic Area (EEA).

Automated decision making

No automated decisions are made in any way without any human intervention.

How does the ISD ensure confidential handling of my personal data?

The ISD handles personal data confidentially and with care. The ISD takes appropriate technical and organizational measures to ensure that personal data is protected. To optimally protect your personal data against unauthorized access or use, the ISD applies appropriate security technology. We report (attempted) abuse to the police. The ISD also takes organizational measures to protect personal data against access by unauthorized persons. The ISD only shares personal data in accordance with this Privacy Statement and only with third parties is this is permitted and if it is done with care.

What rights under the GDPR do I have?

When processing your personal data, you have a number of rights, such as the right of access, the right to rectification, the right to restrict processing and the right to not be subject to a decision based solely on automated processing. You can also request to have your data deleted. However, this is only possible to the extent that UU can still meet its legal obligations. In some cases you have the right to have an entire set of data that we have about you transferred to another organization. This is called the right to portability. For more information about your GDPR rights, please refer to the general privacy statement for employees.

You can submit your request via the following form: Privacy request form (uu.nl). When submitting your request, we may ask you a number of questions to determine your identity.

Contact and complaint options

Do you have any specific questions or comments about our Privacy Statement based on this information? Please feel free to contact us. You can use the contact form on the website or send an e-mail to privacy@uu.nl. If you want to file a complaint, you can send an e-mail to our Data Protection Officer (fg@uu.nl). You also have the right to file a complaint with the Dutch Data Protection Authority about the use of your personal data. This can be done via the following link: https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap.

This Privacy Statement was last changed on March the 1^st, 2024. The UU reserves the right to make changes to this Privacy Statement where necessary.