Privacy Datasheet

A

Contact details of the institution.

B

Description of the categories of involved parties; participants, employees etc.

C

Processing purposes and reason.

D

Description of the categories of personal data.

E

Process documents like source documents and output.

F

Categories of recipients to whom this data is or will be provided (internal/external).

G

Details of processor(s).

H

Whether or not there is distribution of the data outside the EU.

I

Applicable storage- and delteion-terms of the data

J

General description of the technical and organizational security measures.

A. Contact details of the institution

Processing responsible:
Board of "Studievereniging GEWIS"
GEWIS is not required to have and does not have a data protection officer

Mail address:
Study Association GEWIS
MF 3.155
P.O. Box 513
5600 MB Eindhoven

Contact details:
Board of Study Association GEWIS
board@gewis.nl
www.gewis.nl
+31 40 247 2815

B. Category

C. Processing purposes and reason

Processing purposes

1. Communication with members (including magazine)
   
2. Organizing activities, social drinks, study trips, etc.
3. Offering education related services (e.g. book sales, tutoring)

Processing grounds

1. Legitimate interest
2. Unambiguous consent
3. Legal obligations

D. Categories of personal data

SEPA Direct debit (IBAN)

F1

Phone number

F1

Personal details introduction week (allergies/dietary wishes, phone numbers, sleeping locations, names, student numbers, mail addresses, birth date, gender, language preference)

F1, F3

Name

F1, F3, F6, F8, F9, F11

Mail addresses

F1, F3, F7, F11

Books information (name, mail address, ordered books)

F1

Membership details (name, gender, student number, study, mail address, birthdate, IBAN, address, phone number)

F1, F11

Personal details yearbook (name, photo, committees)

F1

Website analysis (IP-adresses, user-agent strings, screen size, website performance, visited pages, referring website)

F1, F4

SuSOS/SudoSOS information (name, mail addresses, bank transactions, saldo transactions)

F1, F2

Address

F1, F4, F8

Tutor details (name, mail addresses, availability, tutor subjects)

F1

Tutor mail contents

F1, F10

Parent days participation (names, mail addresses, phone numbers, parents)

F1, F6

Photo archive

F1, F2, F12, G3

Building access (names, campus card number)

F1, G3

E.  Process documents

I. Storage period

F. Internal Processors

Internal members/participants that receive data (being sent, requesting themselves, archiving etc.).

G. Details of Processors (external)

H. EU/NON-EU

Processing agreement

Data location

European Economic Area

Date: November 5, 2021
Number: PRIV_2022.02

European Economic Area and the UK
Sometimes data is exported outside of the EU using GDPR-suitable procedures

Date: April 10, 2019
Number: PRIV_2019.01

European Economic Area or a country or territory that is the subject of an adequacy decision by the Commission under Article 45(1) of the EU GDPR

The Netherlands

Date: April 11, 2022
Number: PRIV_2022.03

European Union, the EEA, Switzerland and the United Kingdom

Date: April 11, 2022
Number: PRIV_2022.04

European Economic Area
Sometimes data is exported outside of the EU using GDPR-suitable procedures

J. General description of the technical and organisational security measures

To ensure the confidentiality and security of personal data, appropriate physical, technical and organisational measures have been taken.

Non-digital data is stored in lockable rooms and will be securely discarded of when no longer needed. Digital data will be stored on encrypted disks or in lockable rooms.

Data in GEWIS systems can only be accessed by those who, based on their function, need it. Technical measures have been taken to make sure changes in access levels will be logged. Additionally, users are required to use a secure password for all services.