Privacy Statement Vrije Universiteit Amsterdam

Privacy statement for websites of Vrije Universiteit Amsterdam

• What does this privacy statement cover?

  All VU Amsterdam websites relating to education and/or research ending in ‘.vu.nl’ and VU Amsterdam websites not ending in ‘.vu.nl’.

  More information on the protection of your personal data by VU Amsterdam can, among others be found hereis guaranteed in accordance with the GDPR and other relevant laws and regulations. This has been further elaborated in specific statements:

  • New and existing students, external students, course participants and alumni
    Rules on the processing of personal data of VU Amsterdam students
    Privacy Statement National Student Survey (NSE) 2025
  • Prospective students
    Privacy statement prospective students
  • Employees and former employees
    Rules on the processing of personal data of VU Amsterdam staff
  • Surveillance cameras
    Rules on surveillance cameras at VU Amsterdam
  • VU Amsterdam Health & Safety department
    Rules on the processing of personal data by the VU Amsterdam Health & Safety department
  • Scientific research
    Scientific research conducted by VU Amsterdam is covered by specific privacy statements about which participants and other data subjects will be informed separately.
  • Job applicants
    Privacy Statement – Recruitment VU Amsterdam
  • VU Amsterdam has a policy on how VU Amsterdam handles its legal obligations in relation to the protection of personal data, see: General privacy policy

• Who is responsible for processing my personal data?

  The VU Foundation is responsible for the data processing described in this privacy statement. VU Amsterdam is maintained by the VU Foundation in its capacity as a special institution within the meaning of the Higher Education and Research Act (WHW).

  The VU Foundation has its registered office at De Boelelaan 1105, 1081 HV Amsterdam and is registered with the Chamber of Commerce under the number 53815211.

• Which (categories of) personal data are processed?

  VU Amsterdam processes the following categories of personal data, depending on the way in which you use the websites and associated applications:

  1. name: first name(s), initials, surname prefix(es), surname, preferred name, title;
  2. contact details: address, postal code, place of residence, country, telephone number, e-mail address;
  3. gender and date of birth;
  4. language and communication preferences;
  5. financial details: bank account number/IBAN, credit card number, VAT number;
  6. application letter and curriculum vitae;
  7. registration of participation at VU Amsterdam events;
  8. electronic data: login details, passwords, log data, web pages visited, IP address, MAC address, VUnetID, VU Amsterdam student number, cookie content, referrer URL, clicking and surfing behaviour and device data.
     

• For what purpose will my personal data be processed and on what legal basis?

  Your personal data will be used only for the following purposes:

  1. creating and managing a VUnet or other web account;
  2. providing information on programmes and activities of VU Amsterdam;
  3. sending newsletters or other electronic messages;
  4. sending brochures, letters or other paper documents;
  5. accepting and processing a job application;
  6. operating, maintaining, analysing, optimizing and securing the websites of VU Amsterdam and the associated applications;
  7. creating links between VU Amsterdam websites and social media networks and displaying relevant advertisements for VU Amsterdam on other websites;
  8. gathering management information for educational and information services;
  9. identifying individual preferences and using them where necessary for the purposes specified in points 1 to 8;
  10. internal control and corporate security;
  11. implementing or applying laws and regulations.
      
      

  We will process your personal data on the following legal bases:

  • The processing is necessary to safeguard a legitimate interest.
  • You have given permission for the processing of your personal data. You have the right to withdraw your permission at any time by e-mailing us at privacy@vu.nl.
  • The processing is necessary to comply with a legal obligation applicable to VU Amsterdam.
    

• Will my personal data be shared with third parties?

  No personal data will be shared with third parties unless 1) it is necessary for services provided by such third parties operating on the instructions and under the responsibility of VU Amsterdam, or 2) if you give us permission to share it or 3) when we are legally obliged to do so.

  Processors
  If we share your personal data with third parties who process the data on behalf of VU Amsterdam, we will enter into a data processing agreement to ensure that your personal data is processed carefully, securely and in accordance with the General Data Protection Regulation (GDPR). As the data controller we remain responsible for the processing of this data.

  Cookies
  If you give your permission, VU Amsterdam and third parties, including social media networks and/or advertising networks, can set cookies on your computer, telephone or tablet. The social media and advertising networks may track your internet behaviour and use it for their own purposes. For more information, see the Cookie statement of VU Amsterdam.

  Legal obligations
  VU Amsterdam may be legally obliged to provide personal data in specific cases, for example during a criminal investigation to law enforcement authorities.

• Will my personal data be transferred to countries outside the European Economic Area?

  Yes, it is possible that your personal data will be transferred to countries outside the European Economic Area (EEA). The EEA comprises of all EU countries, Norway, Liechtenstein and Iceland. Transfers of personal data to organisations other countries are subject to additional rules under the General Data Protection Regulation (GDPR).

  We will only transfer your personal data to an organisations in a non-EEA country if the European Commission has formally decided that the country provides an adequate level of protection to personal data (so-called adequacy decisions), if the transfer is subject to appropriate safeguards under the GDPR or if the GDPR provides specific grounds for the particular transfer.

  Where applicable, a copy of the document setting out appropriate safeguards can be obtained from the Data Protection Officer (DPO). The DPO’s contact details are provided in point 10.

• How long will my personal data be retained?

  Unless the law specifies a specific retention period, we will keep your personal data for as long as necessary to achieve the purposes stated in point 4.

• How will my personal data be secured?

  VU Amsterdam will take appropriate technical and organizational measures to protect your personal data against loss and any kind of unlawful processing.

• Who should I contact if I have questions about the processing of my personal data?

  You can ask questions about the processing of your personal data by emailing: privacy@vu.nl. Alumni and supporters can also ask their questions by contacting relations@vu.nl.

• How do I exercise my privacy rights?

  The General Data Protection Regulation (GDPR) provides you with the right to access your processed personal data and under certain conditions with the right to rectify your personal data if it contains factual errors, the right to erase your personal data, the right to restrict the processing of your personal data, the right to portability of your personal data and the right to object to the processing of your personal data. 

  If you want to request erasure of your personal data, send an e-mail to the IT Servicedesk.

  If you wish to exercise other privacy rights, you can notify the Data Protection Officer (DPO) of VU Amsterdam at the following address:

  Vrije Universiteit Amsterdam
  Data Protection Officer
  De Boelelaan 1105
  1081 HV AMSTERDAM
  functionarisgegevensbescherming@vu.nl

  Please be aware that you will be asked for proof of identity to verify that the request has been submitted by you and to enable your request to be processed.

  You also have the right to submit a complaint to the VU Amsterdam or the Dutch Data Protection Authority (Dutch DPA) concerning the processing of your personal data by VU Amsterdam.

  More information on your rights is available from the Dutch DPA (only in Dutch).