Nikhef General Privacy Statement

Nikhef may process your personal data because:

• We need it to provide you with a service you have requested; or
• You have entered into, or are about to enter into, a contract with us.

If you do not provide us with the required personal data, we can try to provide the service, but it may be impossible or irresponsible to do so. Some personal data is also shared automatically when you communicate with us, such as your IP address.

We will keep your personal data for as long as necessary to provide the service and/or perform the (implicit) contract, and for an additional period of up to thirteen months to handle follow-up questions, respond to security incidents, or resolve disputes (our legitimate interests), or for longer if required by law.

For services whose usage is accounted for on an annual basis, such as the compute and storage resources for our data processing facility and the Worldwide LHC Computing Grid (WLCG), accounting records are retained for up to eighteen months. This allows accounting data to be recalculated if necessary after anonymised aggregation.

If another organisation helps us provide a service, we may share your personal data with that organisation. If this involves transferring personal data to a country that is not recognised as providing an equivalent level of data protection, we will implement appropriate safeguards to ensure that your information receives the same level of protection.

We need your personal data to identify problems, improve our services and keep them secure.

We retain your personal data for up to thirteen months after you have used the service. After that, we delete it unless we need it for a specific investigation or for accounting purposes.

If our services are subject to attacks or other criminal activity, we may share information for security purposes only with trusted partners, infrastructure peers operating under common security policies, or law enforcement authorities.

Improving our services and ensuring their security are legitimate interests. We assess all processing activities to ensure they provide benefits that outweigh any risks to individuals. If you believe your particular circumstances require additional consideration, you may contact our security team (see below) to request a review.

We process your personal data when you ask us to do so, for example when you:

• join one of our collaborations;
• create a user profile; or
• subscribe to a newsletter.

We retain your personal data until you ask us to change or delete it, or for at least three years after you last use the service in order to fulfil the (implicit) agreement.

If you participate in collaborations and contribute comments or pages, some of your personal data—typically your name as provided during submission—will remain associated with your contribution.

This enables us to maintain a trustworthy collaboration environment, preserve the provenance of research information and results, and support good research practices.

You may request a review of this at any time by contacting the service owner or the Nikhef security team.

Some Nikhef services and processes have their own privacy statements that provide more specific information about how personal data is processed.

These include policies relating to:

• job applications;
• visitors and staff (employees, students, interns and emeriti), particularly in relation to NWO-I business support processes;
• site access management;
• the RCauth.eu authentication service;
• the DutchGrid CA authentication service.

For the Worldwide LHC Computing Grid, the WLCG Privacy Notice supplements this Privacy Statement.

We do not use automated decision-making that produces legal or similarly significant effects for individuals.

Where automated notifications are used for operational or security purposes, a human always reviews the results. In some cases, that reviewer may be you—for example, if you access our services from a location that you have not used before.

When we receive some of your personal data from federation partners, we process that data in accordance with the GÉANT Data Protection Code of Conduct.

Under data protection legislation, you may have several rights regarding the personal data we hold about you. These include the right to:

• receive a copy of your personal data;
• request that inaccurate personal data be corrected; and
• request deletion of your personal data once we no longer need it.

If you have questions about these rights or about this Privacy Statement, please contact our security team by email at privacy@nikhef.nl or write to:

Science Park 105
1098 XG Amsterdam
The Netherlands

If you believe that we have not handled your request appropriately, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).