Privacy Regulations

of Volksuniversiteit Amsterdam pursuant to the General Data Protection Regulation

Article 1: Definitions

In these regulations, the following terms are defined as: a. Stichting Volksuniversiteit Amsterdam: the formal statutory name of the organisation. b. the director‑manager or board: the director‑manager/board of Stichting Volksuniversiteit Amsterdam. c. the file: the collection of personal data relating to the categories of persons mentioned in Article 3 of these regulations. d. personal dossier: the entirety of (written) recorded information relating to a person who is part of one of the categories mentioned in Article 3 of these regulations. The dossiers may consist of both a physical and an electronic section. e. the data subject: the person whose personal data are included in the file. f. personal data: data that can be traced back to an individual natural person. g. third party: anyone who does not belong to the organisation of the controller, with the exception of the data subject.

Article 2: Purpose of the file

The file aims to collect all data necessary to register participants for a course at Stichting Volksuniversiteit Amsterdam and to make these data available for use by the administration of Stichting Volksuniversiteit Amsterdam. The file also serves to inform participants about their course/classes and other course‑related activities of Stichting Volksuniversiteit Amsterdam.

Article 3: Categories of persons included in the file

The file contains only data about participants, former participants, and individuals/companies who have indicated that they are interested in the course offerings of Stichting Volksuniversiteit Amsterdam.

Article 4: Data included and method of collection

1. The file includes, for the persons mentioned in Article 3, the data listed in Annex I attached to these regulations.

2. The personal data are obtained through provision by the data subject (or after authorisation by the data subject) when registering for a course, lecture, or other activity of Stichting Volksuniversiteit Amsterdam.

3. The annex referred to in the first paragraph forms part of these regulations.

Article 5: Responsibility

1. The director‑manager is responsible for the management, development, and application of the file, in accordance with these regulations.

2. The director‑manager supervises compliance with the implementation rules.

3. The director‑manager ensures the necessary technical and organisational measures to secure the file against loss or damage to the data and against unauthorised access, modification, or disclosure.

Article 6: Operation of the file

1. The file is used exclusively on behalf of the director‑manager of Stichting Volksuniversiteit Amsterdam and the employees designated by them.

2. The data included in the file are used solely for the purpose described in Article 2 of these regulations.

Article 7: Access to the file

1. Access to the file is granted exclusively, and only within the scope of their assigned duties, to:

• the director‑manager

• staff members

• administrative employees

• caretakers

• the system administrator

1. Access to the file can only be obtained through the personal access codes assigned to the persons listed under paragraph 1 of this article.

2. These access codes are linked to specific rights regarding processing, modifying, deleting, and consulting/viewing the stored data.

3. A teacher receives functional access to certain personal data of the participants in the course they teach, namely: name, address, place of residence, telephone number and/or email address, in order to inform them about matters related to the course activity concerned.

Article 8: Disclosure of data to third parties

No data from the file will be disclosed to third parties unless: • this is required under a statutory provision; • this occurs with the consent of the data subject; • public‑law bodies request it. Disclosure of data will not take place insofar as confidentiality is required by office, profession, or statutory provision.

Article 9: Retention and destruction of data

If no contact has taken place between the data subject and Stichting Volksuniversiteit Amsterdam for seven years, the personal data will be destroyed. Financial registration data are linked to the personal data. Stichting Volksuniversiteit Amsterdam is required under statutory tax regulations to retain financial data for a period of seven years.

Article 10: Right to information on processing, access, and copies

The data subject or their authorised representative may contact Stichting Volksuniversiteit Amsterdam with a request for access to the registered data. Stichting Volksuniversiteit Amsterdam provides access within four weeks after submission of the request. The data subject (or their authorised representative) will be granted access to the file insofar as it concerns data relating to them. If desired, a copy of the requested data will be provided. Access and copies are only granted after a request addressed to the director‑manager. Stichting Volksuniversiteit Amsterdam requires that the identity of the requester and any authorised representative can be unequivocally established by its employees. A negative decision will be substantiated with reasons.

Article 11: Right to correction

The data subject (or their authorised representative, when they can show an explicit request from the data subject) has the right to request correction, supplementation, or restriction of the data recorded about them in the file, if they believe the data are incorrect or incomplete, or irrelevant given the purpose of the file, or recorded in violation of these regulations. A request for deletion can only be carried out in accordance with Article 9. The request for correction, supplementation, deletion, or restriction of personal data must be submitted in writing to the director‑manager of Stichting Volksuniversiteit Amsterdam. The request must specify the changes to be made. The decision of the director‑manager will be communicated to the requester within four weeks of receipt. Stichting Volksuniversiteit Amsterdam ensures that a decision to correct, supplement, delete, or restrict data is implemented as soon as possible. A negative decision will be substantiated with reasons.

Article 12: Appeal

If Stichting Volksuniversiteit Amsterdam refuses to comply with a request for information, access, copies, restriction, or correction, the requester may, under the General Data Protection Regulation, apply to the District Court of Amsterdam with a written request to order Stichting Volksuniversiteit Amsterdam to comply. The request must be submitted within six weeks after receiving the negative decision. If the controller has not responded within the time limits set in Articles 10 and 11, the request must be submitted within six weeks after those deadlines. The requester may also contact the Dutch Data Protection Authority (https://autoriteitpersoonsgegevens.nl) within the same period with a request for mediation or advice in their dispute with the controller. In that case, the court request may still be submitted after the requester has received notice that the Authority has ceased handling the case, but no later than two months after that time.

Article 13: Communication and marketing

Volksuniversiteit Amsterdam uses the collected data to communicate with its participants, former participants, and relations/companies, and to personalise communication where possible. Volksuniversiteit Amsterdam may, for example, contact its participants and other relations via email or other electronic communication methods to inform them about new courses or services or to invite them to participate in a survey. This processing is necessary to serve our legitimate interest. Volksuniversiteit Amsterdam sends weekly newsletters with its latest offerings and sometimes with discount promotions. Newsletter recipients can unsubscribe at any time via a link at the bottom of each mailing. The website of Volksuniversiteit Amsterdam: cookies. Cookies are placed to analyse how the website and advertisements can be made as interesting and relevant as possible for visitors. By using this website, one agrees to the placement of cookies. A cookie is a small file sent with pages of this website and stored by the browser on the hard drive of the computer. The Volksuniversiteit Amsterdam website uses different types of cookies. Functional cookies are placed by default. These cookies are necessary because they ensure the website functions properly. Examples include the shopping cart and language preferences. Analytical cookies are used to analyse which parts of the website are popular and which parts can be improved. Analytical cookies can also measure the effect of advertisements. Analytical cookies are collected only in anonymised form and cannot be traced back to an individual. Tracking cookies are used to record someone’s browsing behaviour, within one domain or across multiple domains. This allows Volksuniversiteit Amsterdam to display targeted content and ensure that its advertisements are tailored to the visitor. Social media cookies are used for the Facebook and Twitter buttons on the Volksuniversiteit Amsterdam website. These cookies may store personal data, such as the IP address, allowing a person’s internet usage to be tracked outside our website. These data may be used for commercial purposes.

More information on enabling/disabling and deleting cookies can be found using the Help function of the browser.

Annex I — Data recorded

The file includes the following data about the persons referred to in Article 3:

• surname, first name

• address, postal code*

• place of residence*

• telephone numbers daytime, evening, mobile**

• gender*

• email address

• date of birth*: registration for activities of Stichting Volksuniversiteit Amsterdam is in principle possible for persons aged 18 and older.

\* Data on place of residence, postal code, age, and gender are processed anonymously for statistical purposes regarding: who our participants are and where they come from.

\** Telephone and/or email details are needed to inform participants in time in case of teacher illness or other schedule changes.