Privacy Statement User Survey TQS

Version 3-4-2025

In this privacy statement, we explain what happens to your personal data when it is processed they are processed for the user surveys carried out by the user experience team of the Testing & Quality Services department, of the UU IT department.

Who is responsible for data processing?

Utrecht University, located at Heidelberglaan 8, 3584 CS Utrecht, is responsible for the processing described in this Privacy Statement.

For what purposes will my personal data be processed?

Your personal data are processed to improve Utrecht University’s IT products and services.

Which personal data are processed?

We will record the following information if you register as a student panel participant:

• First name,
• E-mail address,
• The faculty you study at,
• Your course year,
• Your enrollment year.

We will record the following information if you register as an employee panel participant:

• First name,
• Your e-mail address,
• Your role as employee,
• The faculty or department you work at,
• The year you started your employment with the university.

When you agree to an interview, we will record visual and audio footage of that interview.

How long are these personal data retained?

Your personal data for this processing will be deleted at the end of your enrollment or studies at the university.

Will my personal data be shared with third parties?

We do not directly share your personal data with third parties. Systems supplied by third parties will be used to process your data, such as Microsoft office.

Will my data be transferred to third countries?

No, there is no transfer of personal data to third countries outside the European Economic Area.

What is the legal basis for this data processing?

The legal basis for this data processing is legitimate interest.

The legitimate interest of Utrecht University here is to improve their IT services. This has to be weighed against the circumstances of the data processing. Considering that this is an “opt-in” process, no data processing will take place against the will of the data subjects. Given that, and the fact that the data processing is very restrained in its scope and nature, this legitimate interest services as ample legal basis.

What rights do I have under the GDPR and how can I exercise them?

As a data subject you have certain rights. Namely the right to access, the right to rectification, the right to erasure, the right to restriction of processing and the right to object.

Should you wish to exercise these rights, please submit your request using this form. We will then have one month to respond to your request. For very complex requests (or if there are a lot of requests coming in at the same time), we sometimes need more time (up to two months extra). We will let you know within that first month.

When exercising your rights, we first need to establish your identity. We do this in a way that suits the situation at hand and the right you want to exercise.

Is there automated decision-making or profiling?

There is no automated decision-making. That is, decisions are never made without human intervention. There is also no profiling.

Questions

If you have any questions about this privacy statement, please send them to privacy@uu.nl. Would you like to file a complaint? If so, please contact Utrecht University’s data protection officer, which can be reached at fg@uu.nl. You are also always free to file a complaint with the Dutch Data Protection Authority here.