Privacy statement

Privacy Statement

• What does this privacy statement cover?

  This privacy statement applies to the processing of your personal data that takes place within ACTA.

• Who is responsible for processing my personal data?

  ACTA is a partnership between the faculties of Dentistry of VU Amsterdam and the University of Amsterdam, and is responsible for the data processing described in this privacy statement.

  ACTA is located at Gustav Mahlerlaan 3004 1081 LA Amsterdam.

• Which (categories of) personal data are processed?

  ACTA processes the following categories of personal data, depending on the way in which you use the websites and associated applications:

  • name: first name(s), initials, surname prefix(es), surname, preferred name, title;
  • contact details: address, postal code, place of residence, country, telephone number, e-mail address;
  • gender and date of birth;
  • language preference;
  • financial data: bank account number/IBAN, credit card number, VAT number;
  • motivation letter and curriculum vitae;
  • digital data: login data, passwords, log data, web pages visited, IP address, MAC address, VUnetID, VU student number, UvA student number, cookie content, referrer URL, click and surfing behavior and device data;
  • information regarding your health: BSN number, dental procedures, treatments, treatment history, dental models/impressions, patient number, name of the health insurer, names of other healthcare providers and time of the appointment.

• For what purpose is my personal data processed and on what legal basis?

  The personal data will only be used for the following purposes:

  • informing about courses and activities of ACTA;
  • sending newsletters or other electronic messages;
  • sending brochures, letters or other paper documents;
  • operating, maintaining, analysing, optimising and securing the website of ACTA and the associated applications;
  • creating links between ACTA websites and social media networks and showing relevant ACTA advertisements on other websites;
  • gathering management information for educational and information services;
  • internal control and corporate security;
  • implementing or applying relevant laws and regulations.

  Purposes related to personal data concerning your health:

  • registering with ACTA;
  • keeping your medical record;
  • scheduling an appointment;
  • performing a treatment;
  • sending a newsletter;
  • sending invoices;
  • sending appointment reminders by email and SMS;
  • improving our services;
  • teaching (if you have given explicit permission for this);
  • conducting research (if you have given explicit permission for this).

  Purposes with regard to data concerning (prospective) students and alumni:

  • creating and managing a VU account/UvA student number or other web account;
  • cost-efficient recruitment of students and to this end gain insight into our flow;
  • help with orientation when choosing a study;
  • keeping in touch with our alumni;
  • continuing to share knowledge and network after graduation and informing about relevant news and backgrounds of ACTA;
  • evaluating curriculum, training and providing insight into career prospects and evaluating the current curriculum and training offer.

  Purposes related to employee data:

  • creating and managing a VU account;
  • processing and going through an application procedure.

  We process your personal data on the basis of the following legal bases:

  • The processing is necessary to safeguard a legitimate interest;
  • You have given permission for the processing of your personal data. You have the right to withdraw your permission at any time by e-mailing us at fg@acta.nl;
  • The processing is necessary to comply with a legal obligation that rests on ACTA;
  • The processing is necessary for the performance of the agreement.

• Who has access to my personal data?

  The personal data are only viewed by employees, students and researchers of ACTA who, in the context of their work, study or research, have a role in the processing of your personal data for the above purposes and for whom it is necessary that they have access to the personal data.

• Will my personal data be shared with third parties?

  No personal data will be shared with third parties, unless 1) this is necessary for the services of third parties who work on behalf of and under the responsibility of ACTA, or 2) if you give permission for this or 3) when we are legally obliged to do so.

  Processors

  If we share your personal data with third parties who process the data on behalf of VU Amsterdam, we will enter into a data processing agreement to ensure that your personal data is processed carefully, securely and in accordance with the General Data Protection Regulation (GDPR). As the data controller we remain responsible for the processing of this data.

  Cookies

  If you give your permission, VU Amsterdam and third parties, including social media networks and/or advertising networks, can set cookies on your computer, telephone or tablet. The social media and advertising networks may track your internet behaviour and use it for their own purposes. For more information: see Cookie statement ACTA.

  Legal obligation

  ACTA may be legally obliged to provide personal data in specific cases, for example during a criminal investigation to law enforcement authorities.

• Will my personal data be transferred to countries outside the European Economic Area?

  Yes, it is possible that your personal data will be transferred to countries outside the European Economic Area (EEA). The EEA comprises of all EU countries, Norway, Liechtenstein and Iceland. Transfers of personal data to organisations in other countries are subject to additional rules under the General Data Protection Regulation (GDPR).

  We will only transfer your personal data to organisations in a non-EEA country if the European Commission has formally decided that the country provides an adequate level of protection to personal data (so-called adequacy decisions), if the transfer is subject to appropriate safeguards under the GDPR or if the GDPR provides specific grounds for the particular transfer.

  Where applicable, a copy of the document setting out appropriate safeguards can be obtained from the Data Protection Officer (DPO). The DPO’s contact details are provided under 'how can I exercise my privacy rights'.

• How long will my personal data be retained?

  Unless the law specifies a specific retention period, we will keep your personal data for as long as necessary to achieve the purposes stated in ‘For what purpose is my personal data processed and on what legal basis?’. We use the statutory retention period of 20 years to store your medical data, as set out in the Medical Treatment Contracts Act (WGBO). In addition to this law, we also take into account, if necessary, retention periods arising from other legislation, such as the Education Supervision Act.

• How is my personal data secured?

  ACTA will take appropriate technical and organisational measures to protect your personal data against loss and any kind of unlawful processing.

• Social media

  The ACTA website includes buttons to promote or share pages on the social media networks Facebook, Twitter, Instagram and LinkedIn. The buttons are realised by means of pieces of code. By means of these pieces of code, cookies are placed by the media networks when you click on the button.

  Read the privacy statements of Facebook, Twitter, Instagram and LinkedIn (which can change regularly) to see what they do with your personal data that they process with these pieces of code. In most cases, this information is stored by the social media networks on servers in the United States.

• Who can I contact with questions about the processing of my personal data?

  You can ask your questions about the way in which your personal data are processed to the Data Protection Officer (DPO) of ACTA, via fg@acta.nl.

• How can I exercise my privacy rights?

  The General Data Protection Regulation (GDPR) provides you with the right to access your processed personal data and under certain conditions with the right to rectify your personal data if it contains factual errors, the right to erase your personal data, the right to restrict the processing of your personal data, the right to portability of your personal data and the right to object to the processing of your personal data. If you wish to exercise these privacy rights, you can notify the Data Protection Officer (DPO) of ACTA at the following address:

  Academic Centre for Dentistry Amsterdam (ACTA)
  Data Protection Officer
  Gustav Mahlerlaan 3004
  1081 LA Amsterdam
  fg@acta.nl

  Please be aware that you will be asked for proof of identity to verify that the request has been submitted by you and to enable your request to be processed.

  You also have the right to submit a complaint to the Dutch Data Protection Authority about the way in which ACTA processes your personal data.

  More information on your rights is available from the Dutch DPA (only in Dutch)