Privacy statement

Personal data is processed in the context of the services provided by the UAF Foundation for Refugee Students (hereinafter: “UAF” or “we”) to students and professionals. We also process personal data when you register as a donor or when you visit our website, for example when you register for our newsletter. The term "personal data" means any information about an identified or identifiable natural person. When processing personal data, UAF qualifies on the basis of the applicable legislation (de General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the GDPR Implementation Act) as the controller. Our contact details, including the e-mail address where we can be reached for privacy-related questions, can be found below:

Foundation for Refugee Students UAF
71 Newton Avenue
3584 BP Utrecht
(030) 252 0835
privacy@uaf.nl

In this Privacy Statement we explain:

Which personal data we process
For what purposes and on what basis do we process your personal data
To whom we disclose your personal data
How long we keep your personal data
How your personal data is secured
What your privacy rights are
How to file a privacy complaint
How we deal with changes to this Privacy Statement
For the processing of personal data of applicants, we refer to our specific Applicants Privacy Policy. For the processing of personal data of volunteers and mentors, we refer to our specific Privacy Policy Volunteers & Mentors.

Which personal data do we process?

We process the following (categories of) personal data from students and professionals who register with us:

Name and address details (surname, first names, initials, title, gender, address, postal code, place of residence)
Other (contact) data (date of birth, telephone number, e-mail address and similar data required for communication).
Data with a view to handling the specific application, such as education history and diplomas
Data for the purpose of calculating and recording fees and expenses and making payments, including the bank account number
Other data the processing of which is required by or necessary to comply with applicable laws or regulations, such as in certain cases processing data about an identity document and social security number

We process the following (categories of) personal data from partners and donors:

Name and address details (surname, first names, initials, title, gender, date of birth (optional), address, zip code, place of residence). We only use a date of birth to make a data analysis of the age structure of our supporters.
Other (contact) data: telephone number (optional), e-mail address and similar data required for communication.
Donor or partnership information, including bank account numbers

We process the following (categories of) personal data from persons from whom we purchase products or services or who work for us suppliers (hereinafter: “suppliers”):

Name and address details (surname, first names, initials, title, gender, address, postal code, place of residence)
Other contact details (telephone number, email address and similar data required for communication)
In certain cases, depending in part on the type of service: a statement of conduct and details of proof of identity
Data for the purpose of placing orders or purchasing services
Data for the purpose of calculating and recording fees and expenses and making payments, including the bank account number
Other data the processing of which is required by or necessary to comply with any applicable law or regulation

We process the following (categories of) personal data from third parties (such as website visitors, lawyers and other advisors with whom we have contact):

Name and address details (surname, first names, initials, title, gender, address, postal code, place of residence), insofar as made known to us
Other contact details (telephone number, e-mail address and similar data required for communication), insofar as disclosed to us
Information in connection with a visit to our website, see us Cookie policy
Data relating to electronic messages from or intended for third parties and data that are necessary to maintain contact with these third parties

On what basis and for what purposes do we process your personal data?

We process your personal data based on one or more of the following legal bases:

a) When this is necessary for the performance of an agreement to which you are a party or to perform pre-contractual acts at your request
b) When this is necessary to comply with a legal obligation
c) When this is necessary to protect our legitimate interests or the interests of a third party
d) With your consent

When we process your personal data based on your consent, we will request it from you separately. You may always withdraw your consent. Please note that the withdrawal of your consent does not affect the lawfulness of the processing of your personal data before the withdrawal of your consent.

To whom do we provide your personal data?

We do not provide your personal data to third parties ('recipients' within the meaning of privacy legislation), unless this is necessary for the proper implementation of the purposes described in this Privacy Statement, when this is required by law or when you have given permission for this. The third parties to whom the personal data are made available are obliged to treat your personal data confidentially. If these parties are regarded as 'processors' within the meaning of privacy legislation, we will ensure that a processing agreement is concluded with these parties that meets the requirements set out in the GDPR.

We may collect personal data from students and professionals share with:

Employees of UAF (on a need-to-know basis)
Suppliers (e.g. study-related parties, courier services, bailiffs and our software suppliers, etc.)
Educational institutions, municipalities and employers to be able to execute the agreement with you
Courts and government institutions
Other parties, such as the Kredietbank, NS, supervisory authorities and other authorities if required by law or with your permission

We may collect personal data from partners and donors share with:

Employees of UAF (on a need-to-know basis)
Suppliers (e.g. courier services, bailiffs and our software suppliers) etc.)
Courts and government institutions
Other parties, such as regulators and other authorities if required by law or with your consent

We may collect personal data from suppliers share with:

Employees of UAF (on a need-to-know basis)
Suppliers
Other parties, such as regulators and other authorities if required by law or with your consent

We may collect personal data from third parties share with:

Employees of UAF (on a need-to-know basis)
Suppliers (e.g. courier services, Google LLC. for our website usage statistics)
Courts and government institutions
Other parties, such as regulators and other authorities if required by law or with your consent

In order to provide our services, it may be necessary for us to transfer your personal data to a recipient in a country outside the European Economic Area that offers a lower level of protection of personal data than European law. In that case, UAF will ensure that such transfer of personal data is in accordance with the applicable laws and regulations, for example by concluding a model contract drawn up and approved for that purpose by the European Commission.

How long do we keep your data?

UAF does not store your personal data in an identifiable form for longer than is necessary to achieve the purposes stated in this Privacy Statement. Personal data required to comply with our fiscal retention obligation will be retained for 7 years from the end of the year in which the relevant data no longer forms part of the annual administration.

The specific retention periods mentioned above may become longer if legal retention obligations apply or change. We can also keep the personal data longer if this is necessary for the settlement of legal disputes.

Security

UAF has taken appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing and against loss, destruction, damage, adjustment or disclosure. If you have any questions about the security of your personal data, or if you suspect or have indications of misuse, please contact us at privacy@uaf.nl.

Your privacy rights

You have the following rights with regard to the processing of your personal data by UAF:

the right to request whether we process your personal data and, if so, to inspect your personal data
the right to rectify your personal data if it is inaccurate or incomplete
the right to have your personal data erased ("right to be forgotten")
the right to object to the processing of your personal data or to restrict the processing of your personal data
the right to withdraw consent to the processing of your personal data, if the processing is based on your consent
the right to receive or hand over your personal data to a third party designated by you in a structured, commonly used and machine-readable format (“right to data portability”)

To exercise your rights, you can contact us at privacy@uaf.nl or by mail at:

Foundation for Refugee Students UAF
71 Newton Avenue
3584 BP Utrecht

To prevent us from providing information to the wrong person, we may ask you for additional information to verify your identity. In principle, we will inform you within one month of receipt of your request whether we can comply with your request. This period can be extended by two months in specific cases, e.g. in the case of a complex request. We will inform you about such an extension no later than one month after receipt of your request. Based on privacy legislation, we can refuse your request under certain circumstances. If this is the case, we will explain why. If you object to the processing of your personal data for direct marketing purposes, we will always respect this request. More information about your privacy rights can be found on the website of the Dutch Data Protection Authority.

Complaints

If you have a complaint about the processing of your personal data by UAF, we will try to resolve this together with you. If this does not lead to the desired result, you have the right to submit a complaint to the competent supervisory authority. In the Netherlands this is the Dutch Data Protection Authority. If you live or work in another country of the European Economic Area, you can submit a complaint to the supervisory authority in that country.

modifications

This Privacy Statement was last amended on 25/09/2023. We reserve the right to change this Privacy Statement and will always post the most recent version of this Privacy Statement on our website. If there are substantial changes that could significantly affect one or more data subjects, we aim to inform these data subjects immediately.