ECIU UNIVERSITY DATABASE
This privacy statement describes how the ECIU University (ECIUU) handles your personal data in the Challenges Database (CHAD) for purposes of registering and applying to ECIU University activities and learning offerings.
The ECIU University is an EU-funded initiative of the alliance of 12 universities in the ECIU that creates a ground-breaking and innovative educational model on a European scale. This ECIU University Challenges website is created as the ECIU University Challenge Platform (CHAD). It frames real life challenges into practical form for learners to work on and to come up with practical solutions for the challenge. The Challenge Platform provides the overview of the ECIU University challenges and micro-modules, allows visitors to explore the challenges and register to them, also introduces the community of challenge facilitators that will help learners through the challenge-solving process.
2 PROCESSING PERSONAL DATA
Within ECIU CHAD, the following personal data is processed:
3 STORAGE OF PERSONAL DATA
The University of Twente maintains a DPA (Data Protection Agreement) with WebHare. Subsequently, the University of Twente is considered as the owner of the (collected) data. Additionally, the University of Twente also bears the financial costs for the hosting (and therefore server) and thus all contracts and ownership reside with the University of Twente (on behalf of ECIU).
All the information stored in the CHAD reside in servers which have contractual relationship and agreements with WebHare. These servers reside in several locations, but always within the EU. The current processors from WebHare can be found in the following link (only in Dutch): https://www.webhare.nl/voorklanten/subverwerkers/
The University of Twente is considered as the primary owner of the data and in extension the ECIU University is the co-owner under the premise that ECIU University project and therefore the CHAD and corresponding website are led and coordinated by the University of Twente. It must be noted that the ECIU CHAD itself runs on different environments for the live website, test and development, back-up locations, which utilise more than one server. In light of this, the University of Twente is considered to be the owner of the data, since it has a contractual relationship with WebHare.
Server Security Measures (via WebHare)
WebHare/processor holds an ISO 27001 certificate therefore all provisions under the ISO hold for the data stored in the servers used by WebHare. The security measures are described in the data processing agreement with the processor.
4 COLLECTING PERSONAL DATA
The collection of data takes place by means of a two-step process and via two different web forms:
a. Registration form is necessary for Learners to create a “profile” or “account” to the ECIU University platform. This is the first step before Learners can proceed with applying to the ECIU University offered activities and it’s performed only one time.
b. Application form is necessary for Learners to apply to the learning offerings provided by the ECIU University, whether these are challenges or micro-modules. This is the second step after the registration to the ECIU University platform is completed and can be repeated for as many times as the Learner wishes to apply to multiple and different learning offerings.
Both web forms have been designed from the point of view of the General data protection regulation (GDPR) and is therefore strictly necessary for recruiting and admitting learners to the ECIU educational activities. All the data is collected directly from the data subjects, namely the Learners. There is room to leave more information, but it is not mandatory unless necessary for processing the application to ECIU learning activities. Should Learners not wish to provide their personal data, this will make it impossible to process an application and thus grant them access to ECIU learning activities.
The following data is collected via the
a. Registration form
Registration date and time
First name and Last Name (mandatory)
Category working / studying (mandatory, choice from dropdown menu, for admission purposes)
Home University (choice from dropdown menu, if applicable)
Country of origin (mandatory, choice from dropdown menu)
Study Programme (mandatory, fill-in field, currently enrolled to)
Highest diploma: Bachelor/BSc, Master/MSc, PhD (mandatory, choice from dropdown menu, for admission purposes)E-mail address (main email address, university email address) (mandatory)
Alternative E-mail address (optional)
Phone number (as alternative contact)
Declaring interest in being informed about other ECIU University offerings and receiving a newsletter (voluntary, checking a box)
Giving consent to processing personal data “By signing up, you agree to our terms and conditions” (mandatory, checking a box to be able to complete the registration).
b. Application form
CV as attachment (mandatory, for admission purposes)
Motivation letter as attachment (mandatory, for admission purposes)
Recommendation letter as attachment (optional, for admission purposes, only applicable to Lifelong Learners)
Transcript of Records as attachment (mandatory, for admission purposes, only applicable to Student Learners)
English language proficiency (mandatory, various options to choose from to determine proficiency)
5 TRANSFER OF PERSONAL DATA
Personal data collected and submitted by the Learners via the Registration and Application forms are subject to further processing by one of the ECIU University partner institutions strictly for the purposes of admission and participation to an ECIU learning activity. ECIU University partner institutions are an integral part of the ECIU University and are not considered to be 3rd parties. All ECIU University partner institutions are located in the EU and are covered and governed by the General data protection regulation (GDPR) within their national and institutional frameworks.
In terms of the process, after the registration and application forms are submitted, the ECIU partner institution offering the learning activity (challenge or micro-module) requires receipt of the applicants’ portfolios (application form to challenge or micro-module, along with personal data collected via the registration form) in order to be able to process them and prepare for the admission process as defined by the ECIU University and/or enroll the student in their local systems. The offering institution in most cases is required by their national and institutional regulations to enroll the ECIU applicants/Learners in their own system, thus it is necessary to receive the application forms and the personal data of the ECIU applicants/Learners.
Each ECIU partner institute has assigned an Institutional Admission Officer, who is the main contact person, who receives and processes the ECIU applicants/Learners data and application forms retrieved from the CHAD. The applicants information and portfolios can be retrieved directly via the CHAD by the Institutional Admission Officers, who have direct access to the CHAD. The applications and portfolios may be shared for admission purposes with the Institutional Admissions Committee, which is compiled by the Institutional Admission Officer, the Teamcher (academic teaching staff leading the ECIU learning offering) and the Challenge Coordinator (institutional contact person coordinating the relationship with external stakeholders). The applications and/or personal data are notshared with the external stakeholders, unless the data subject has been informed and given consent.
6 YOUR RIGHTS
The ECIU University (via the UT) processes your personal data, but as a data subject, you have several rights to keep control over your personal data. You will find more information on these rights below. In case you have any questions or you wish to exercise these rights, please contact the Data Protection Officer (firstname.lastname@example.org).
6.1 Right to access personal data
You have the right to receive, amongst others, a copy of your personal data which is being processed.
6.2 Right to erasure
The right to be forgotten. It is not always possible to erase all personal data.
6.3 Right to rectification
The right to have inaccurate personal data rectified, or completed if it is incomplete.
6.4 right to data portability
This right allows the data subject to obtain and reuse their personal data for their own purposes across different services.
6.5 Right to restrict processing
Under certain circumstances, you have the right to have less personal data being processed.
6.6 Rights in relation to automated decision making and profiling
6.7 Right to object
In certain circumstances, you have the right to object to processing.
You can report a complaint about the processing of personal data by sending an email to email@example.com.
IF YOUR COMPLAINT IS NOT HANDLED SATISFACTORILY, YOU CAN ALSO SUBMIT YOUR COMPLAINT TO THE DATA PROTECTION AUTHORITY (IN DUTCH: AUTORITEIT PERSOONSGEGEVENS). THE ABOVE DOES NOT AFFECT THE FACT THAT YOU CAN ALSO SUBMIT YOUR COMPLAINT TO THE DATA PROTECTION AUTHORITY WITHOUT THE INTERVENTION OF THE DPO.
For questions about the ECIU University Challenges Database (CHAD), you can contact the Data Protection Officer: firstname.lastname@example.org. Your questions will be handled on behalf of ECIU.