How does Eindhoven University of Technology process personal data in relation to the MyFuture Website?
1. Introduction
This privacy statement provides information about the processing of personal data of students and coaches signing in to MyFuture Website at Eindhoven University of Technology.
We have tried to provide you with all the information in a clear and readable way. If after reading the privacy statement you have any questions about the way we process your personal data, please let us know via privacy@tue.nl. We are happy to help you.
This privacy statement is applicable as of November 14th, 2022. The latest changes to this privacy statement were made on December 6th, 2022.
2. Who is responsible for your personal data?
The TU/e Executive Board is the controller in the sense of the General Data Protection Regulation (GDPR) for the processing operations in this privacy statement. This means that the TU/e Executive Board (hereafter referred to as "TU/e", "we" or "us") is responsible for the careful and proper processing of your personal data.
3. What personal data do we process?
In relation to the use of MyFuture Website we process among other the following personal data:
- Name
- E-mail address
- Study program (for students only)
- Languages spoken (for students only)
- Skill preferences (for students only)
- Future career prospect (for students only)
- Short personal description, availability and department. (For coaches only)
4. For what purposes do we process your personal data?
The personal data is processed in relation to the MyFuture Website and for the following purposes:
|
Processing purpose
|
Personal data used*
|
|
· Account login
|
· Name
· E-mail address
|
|
· Profile set-up
|
· Study program (for students only)
· Languages spoken (for students only)
· Skill preferences (for students only)
· Future career prospect (for students only)
· (For coaches only) short personal description, availability and department.
|
|
· Provide students with recommendations and career and skills activities that match their profile.
· Facilitate the communication of career and skill related interests between coach and student.
|
· Study program (for students only)
· Languages spoken (for students only)
· Skill preferences (for students only)
· Future career prospect (for students only)
· (For coaches only) short personal description, availability and department.
|
*You are not obliged to provide data related to your Study program, Languages spoken, Skill preferences, Future career prospect, short personal description, availability and department. It’s optional.
5. Basis for processing
The processing must be based on one of the legal grounds of the GDPR. The basis depends on the specific personal data and the purpose for which they are processed. In the case of TU/e , those legal basis are outlined below:
|
Processing activity
|
Lawful basis
|
|
1. Account log in
|
Consent – Art. 6(1)(a) GDPR
Signing in to MyFuture and using the website is voluntary.
Legitimate interest – Art. 6(1)(f) GDPR
If you do decide to use the Website and sign in, we will need to process your name and email address, given that you access MyFuture using your TU/e credentials via Single Sign On.
|
|
2. Completing your profile
|
Consent – Art. 6(1)(a) GDPR
You can choose which details to add to your profile in MyFuture.
|
|
3. Matching students’ profiles with suitable MyFuture Activities
|
Legitimate interest – Art. 6(1)(f) GDPR
TU/e has a legitimate interest in contributing to the development of students’ career, by providing recommendations of career and skills activities that match their profile.
|
|
4. Showing students’ career and skills interests to coaches in the website
|
Legitimate interest – Art. 6(1)(f) GDPR
TU/e has a legitimate interest in contributing to the development of students’ career, by allowing their coach to see which interests they have in relation to skills and career.
|
6. Who has access to your personal data?
6.1 Access to your personal data within the TU/e
Only employees who are involved with the MyFuture website will have access to your personal data, but only as far as is required to fulfil their respective tasks. These employees are:
- Coaches: are able to see the personal data of their own students. Students can choose which data or information they wish to share with their coaches.
- Employees MyFuture Website: they are students employees at TU/e with admin organizer roles (organizer (creating content & manage access of student/employees to organizations). These employees have no access to student data.
6.2 Access to your personal data by third parties
The following third parties have access to or will obtain your personal data, where this is relevant for the facilities and services of these parties towards TU/e.
- Verhaegh & Zn: developer of the MyFuture Website.
We will not share the data we process in relation to MyFuture Website with other third parties, unless this is a legal obligation. With the developer, we make legal agreements concerning the processing of your personal data. Such an agreement will in any case stipulate that certain obligations concerning protection of personal data are respected, thus ensuring that data are processed with due regard for the wishes and standards of TU/e.
7. Will my data be processed outside the European Economic Area ('EEA')?
TU/e endeavors to process your data only within the European Economic Area ("EEA") by storing your data on a server in the EEA wherever possible. For the MyFuture Website, no data is processed outside the EEA.
8. How long will your personal data be kept?
TU/e stores your personal data in accordance with the GDPR. Data will not be retained for longer than is necessary to achieve the purposes for which the data was collected. Some data we are required by law to retain for a certain period of time. Data will be deleted after 4 years of account inactivity for Master students, and after 10 years of account inactivity for bachelor students, or earlier if the student requests so via the MyFuture team.
9. How is your personal data secured?
TU/e has implemented appropriate technical and organizational measures to protect the personal data against unintended or unlawful destruction of the data, unintended damage, loss, alteration or unauthorized disclosure or access, and against all other forms of unlawful processing (including, but not limited to, unnecessary collection of data) or further processing. These appropriate technical and organizational measures include the implementation of Single Sign-On for MyFuture Website, privacy training provided to employees who handle your personal data and guidelines related to your privacy rights implemented by TU/e.
10. How can you exercise your privacy rights?
You have a number of rights with respect to your personal data:
- Right of access. This is the right to obtain confirmation from us as to whether or not your personal data are being processed, and, where that is the case, access to the personal data and some additional information.
- Right to erasure.
- Right to rectification and supplementation. This is the right to have personal data that we process amended.
- Right to data portability. The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services.
- Right to restrict processing. This right allows you to limit the way that we use your data.
- Right regarding automated decision making and profiling. This is the right to a human eye in decisions.
- Right to object to data processing.
- Right to clear information about what we do with your personal data.
Would you like to exercise any of these rights? If so, please contact privacy@tue.nl. We may, however, request additional information to verify your identity when invoking these rights.
If you have given permission for the processing of your personal data you can withdraw this permission at any time. Withdrawing your permission does not have retroactive effect. This means that until the moment of revocation, the permission is lawfully given.
11. Whom can you contact?
In case of questions and/or exercise of privacy rights
If you have any questions about how we process your personal data, or if you wish to exercise your privacy rights, please contact the TU/e privacy team at privacy@tue.nl. We will be happy to help you.
In case of complaints
You can submit a complaint about our data processing to the Data Protection Officer (FG) at dataprotectionofficer@tue.nl. The Data Protection Officer is the link between the TU/e and the Personal Data Authority. The Dutch Data Protection Authority is the supervisory authority in the Netherlands. The Data Protection Officer acts independently of the university and can consult and/or obtain advice from the Dutch Data Protection Authority.
If you do not agree with the complaint handling by the FG, you can file a complaint directly with the Dutch Data Protection Authority. The Dutch Data Protection Authority will handle the complaint or request and make a decision on it.