The University College collects personal data in the context of its threefold mission – education, research and services – and of course also as a regular employer and contractor. The UC Leuven-Limburg values the protection of privacy. Below we explain which personal data we collect, why we collect them and for how long we store them, what the privacy rights are of those involved and how they can exercise them.
Who is the controller?
The controller responsible for the processing of personal data is:
VZW UC Leuven, with registered offices at Geldenaaksebaan 335, 3001 Heverlee, company number 0455.645.523 and VAT number BE 0455.645.523. Register of legal entities: Leuven.
VZW UC Limburg, with registered offices at Agoralaan, Building B, box 1, 3590 Diepenbeek, company number 0417.195.515 and VAT number BE 0417.195.515. Register of legal entities: Hasselt.
UC Leuven-Limburg, abbreviated as UCLL, is the brand name under which the non-profit UC Leuven and the non-profit UC Limburg operate in the form of a collaboration between two non-profit organisations working as an operational whole.
These non-profit associations are the governing body of professional bachelor programmes and associate degree programmes offered by UCLL.
What personal data do we process?
Data of candidate students
We process personal data of candidate students who register through our website or at an information day or SID-in and include the candidate students' contact data, date of birth and study interests.
We process the following personal data of our students: identification data, financial data, personal characteristics, health data, migration background (nationality), training and education, lifestyle, family structure, leisure activities, living arrangements and profession.
We process personal data of the alumni of the university college. This includes the processing of identification data for which the alumni have given us their consent. In addition, we store the email address of alumni to carry out surveys. The results of these surveys are processed by the former study programme of the alumni and the central service Quality Assurance.
Data of contacts in the professional area of our programmes
We process personal data from our contacts in the professional area. This includes identification data or data required for traineeship evaluations. The data are processed by the programmes and the services involved in the traineeship administration.
Data of participants in lifelong learning programmes
We process personal data of participants in our lifelong learning programmes. These include identification data the participant provides us and are processed by the entity that provides the training.
Supplier and customer data
We process supplier and customer data. This includes identification data and financial data required to keep correct supplier- and customer-administration.
We process the personal data of our staff. This includes identification data, financial data, personal data, data on prior training, absences, information on performance coaching and performance reviews.
Data on the users of our (IT) infrastructure
We process camera footage and electronic identification data (most notably MAC addresses, IP addresses, device names, cookies, connection times) of the users of our IT infrastructure.
Data of persons who participated in practice-oriented research
Personal data in the context of research can take many different forms. They can be information collected directly from subjects (information on health, opinion, lifestyle, etc.) or information obtained from other sources (e.g. information available to the government). The data are collected, managed and updated by researchers.
On what grounds do we process personal data?
In most cases, we process personal data to carry out the contract that exists between the party involved and the UC Leuven-Limburg (e.g. maintaining personnel file, payroll administration).
Additionally, in many cases we process personal data because we have a legal obligation to do so. For instance, we are required to submit student data to the Databank Hoger Onderwijs because of rules about study progress monitoring set out by decree. Another example includes the Dimona employment registration for members of staff.
Furthermore, a number of the processing activities are in the legitimate interest of UC Leuven-Limburg. Examples include fraud prevention and abatement as well as good governance of our infrastructure. In each case, we assess whether the interest of the data subject's privacy doesn’t outweigh that of the UC Leuven-Limburg.
Finally, a number of processing activities are based on consent. This is the case when, for instance, we process data on a student's health when the student applies for adapted facilities because of a functional limitation. Another example relates to information on career counselling for which a staff member provides his or her consent.
The legal basis for processing research data is generally the informed consent of the participant in the research. In some cases, the legal basis lies in a legal obligation (mandatory reporting of the university college to the government) or in the common good (research that coincides with governmental priorities policies or that is carried out in order to optimise the quality of certain education levels/forms and improve participation of disadvantaged groups).
To what end do we use and for how long do we hold on to personal data?
Data of candidate students
We use the data provided to us by candidate students in order to tailor info sessions to their needs as well as possible. Furthermore, it allows us to keep candidate students informed of the info sessions that suit their interests. Third parties may be contracted by the UC Leuven-Limburg to aid us in carrying this out correctly.
The data of candidate students are not kept any longer than necessary.
We use student data to be able to perform our educational mandate effectively, especially in guiding students in their studies; maintaining a student and examination administration; granting special privileges and facilities; organising international exchanges and students facilities.
Student data are furthermore used for research to optimise student support, guidance, flow and evaluation throughout the programme.
Student data are exchanged with the government with a view to university college funding and rules on study progress monitoring (learning account) and administrative burden relief (for instance recognition as a nurse) as set out by decree.
We also share personal data of students with their traineeship provider in the framework of the traineeship (evaluation).
Third parties may be selected by the UC Leuven-Limburg to help us carry out our educational mandate. A processor agreement will be established with these parties to ensure personal data are dealt with diligently.
External exchange with other persons or organisations on an individual basis is only possible in the following cases:
- the student has given prior consent;
- a court order has been issued;
- the student has not paid.
Student data are kept for as long as the law requires. Study results are not erased. In case of a loss of documents by a former student, this will allow the UC Leuven-Limburg to issue another certificate.
Student data are never kept longer than necessary for carrying out above objectives and than is required by law.
Data of participants in lifelong learning programmes
The personal data of participants in lifelong learning programmes are used to allow the registration and the training itself to take place correctly. These data are kept until the end of the programme or for as long as the applicable law requires.
Programme participants may be approached again through the university college newsletter if they have given their consent for this. Participants will always have the option to unsubscribe.
Data required for certification are, in principle, never erased. This allows the UC Leuven-Limburg to issue a new certificate if the document is lost by a former participant.
Supplier and customer data
Supplier and customer data are managed by administrative services with the purpose of keeping a correct administration.
The name and address data of webshop customers are processed to allow us to make the delivery. This data may also be passed on to selected third parties to that same end. Customer data obtained through webshops may be kept with a view to direct marketing. Customers may unsubscribe from this at any moment.
This personal data is kept for as long as the law requires or for as long as the data are needed for the purposes listed above.
Alumni data are processed in the context of research, job vacancies and newsletters. These data are kept until consent is withdrawn.
Based on the legitimate interest of the UC Leuven-Limburg, alumni may be contacted by email after graduation in the context of a survey on the programme they took and the match with the professional area. The objective of these surveys is to improve the quality of training. Alumni may opt out of these surveys.
Data of contacts with the professional area
Data of contacts with the professional area are predominantly used in an educational context, for instance in that of traineeships, programme quality or research.
These data are kept for as long as necessary for these purposes.
The university college maintains an administrative personnel file to meet its legal requirements regarding the employment contract (payment of salaries, legal declarations regarding payroll taxes and social security).
We process staff data with a view to providing appropriate performance coaching and reviews.
Staff data are stored in accordance with statutory record keeping periods so that former staff members can be paid a correct retirement fee.
Data on the users of our (IT) infrastructure
Electronic identification data are processed to be able to manage and secure effectively our IT infrastructure. Camera footage is used to ensure the safety of our facilities. We keep these data for as long as is necessary for these purposes and do so in keeping with legal requirements.
Researchers collect, analyse and manage personal data that is necessary to carry out practice-oriented scientific research. These data are kept for as long as necessary for the research. The retention period may be as long as 20 years, depending on the nature of the research.
How do we deal with footage for educational purposes?
To offer the educational programmes we provide and make them as accessible as possible as well as to allow for competence evaluations to take place, we occasionally make video recordings of educational activities, for instance to allow students who are ill to attend class remotely or to evaluate the competences and skills of students. Students are informed before the start of the educational activity that the activity will be recorded. Within reason, we keep students out of the picture as much as possible. The recordings of educational activities are only stored on secured and shielded platforms and are only accessible to the target audience who needs this footage. These class materials may only be posted on public platforms when all those who appear in it have given their explicit consent.
We may continue to use the footage of students as mentioned above after said students have left the university college when this serves the interest of the education we provide.
How do we secure personal data?
The number of UC Leuven-Limburg staff members who have access to personal data is limited. UC Leuven-Limburg staff only have access to personal data insofar as they require the information to carry out their tasks adequately.
UC Leuven-Limburg has furthermore appointed a Data Protection Officer who advises us on the privacy rules and verifies whether the UC Leuven-Limburg complies with them.
We have taken technical measures to protect personal data against unauthorised access, unauthorised use, against loss or theft. These measures include strong passwords, firewalls, antivirus software, backups, etc.
With a view to practice-oriented scientific research, the researchers rely on the ethical committees of the KU Leuven. These committees carry out a risk analysis prior to the start of a research project. Depending on the results of this risk analysis, the researcher implements appropriate security measures.
What are your privacy rights and how can you exercise them?
To exercise one of the rights below, you can send an email to privacy [at] ucll.be. However, these rights are contingent on certain conditions as a result of which the university college may not always be able to respond to your request.
Right of access
You have the right to be informed definitively by the UC Leuven-Limburg on the use of your personal data and, when there is such data, to have access to it.
Right to rectification
If your personal data is incorrect, you have to right to have it corrected.
Right to erasure
You have the right to have the UC Leuven-Limburg erase your personal data without unreasonable delay in the following cases:
- when your data is no longer necessary for the purposes for which it was collected or processed; or
- when you withdraw consent and there are no other legal grounds for the processing; or
- when you object to the processing and there are no overriding legitimate grounds for the processing; or
- when your personal data were processed unlawfully; or
- when your personal data must be erased to comply with a legal obligation.
Right to withdraw your consent
You have the right to withdraw your consent at any time. It is not possible to withdraw your consent retroactively.
Right to restriction of processing
You have the right to obtain a restriction of the processing of your data by the UC Leuven-Limburg:
- during the period the UC Leuven-Limburg needs to verify the accuracy of your data, in case of dispute; or
- when the processing of your personal data is unlawful and you request a restriction of processing instead of erasure of your personal data; or
- when UC Leuven-Limburg no longer needs your personal data but you require the data for legal claims; or
- during the period the UC Leuven-Limburg requires to assess the grounds for erasing your personal data.
Right to object
You always have the right to object to the processing of your personal data for reasons that relate to your specific situation.
Right to data portability
You have the right to receive the personal data you have provided to the UC Leuven-Limburg in a structured, commonly used and machine-readable format. You have the right to transmit this data to another controller, if the processing relies on your consent or a legal obligation and if it can be carried out through automated procedures.
Right to lodge a complaint
The university college invites you to contact it directly when you have complaints about the use of your personal data. You also have the right to lodge a complaint against the processing of your data with the Belgische Gegevensbeschermingsautoriteit (Belgian Data Protection Authority).
How can I contact the UC Leuven-Limburg?
For more information on this privacy statement or for complaints relating to the processing of your personal data, you can contact the Data Protection Officer of the UC Leuven-Limburg at privacy [at] ucll.be.
UC Leuven-Limburg may amend this privacy statement. We will of course communicate any changes to our privacy statement. Please check our website for the latest version of our privacy statement.
Version number 3 of 19 December 2019: adaptation due to the integration of associate degree programmes and amendment to the Companies and Associations Code.