In this privacy statement, we explain what happens to your personal data when it is processed in our Learning Management System (LMS) Brightspace.
Who is responsible for data processing?
Utrecht University is responsible for the data processing described in this privacy statement.
For what purposes are my personal data processed?
Your personal data is processed in order to provide a platform on which we organise education and on which students and teachers can share learning materials, collaborate, submit assignments, and conduct formative assessments.
What personal data is processed?
– Name
– SolisID
– Faculty
– Email address
– Profile picture (optional)
– Logging data, such as IP address and latest log in moment
– Course data, such as the courses for which you are registered
– Learning data, such as your quiz scores, submitted work, and how often or how long you have visited certain content
– Non-definitive exam data, such as grades
– The information you share on the forum of your course(s).
How long is this personal data kept?
Data linked to your Brightspace account will be deleted after two years of inactivity. Your official learning data (such as course results) will be stored for longer in Osiris – see the Student Privacy Statement for more information.
Will my data be shared with third parties?
Your data will be shared with the supplier of Brightspace, D2L.
Will my data be transferred to third countries?
D2L has offices in the United Kingdom, Canada, and Australia. Utrecht University has taken appropriate (contractual) measures to protect your data outside the EU.
What is the legal basis for this data processing?
The legal basis for this processing activity is art. 6(1)(e) GDPR: providing higher education is a task in the public interest.
What rights do I have under the GDPR and how can I exercise them?
The GDPR gives you a number of rights with regard to your personal data. You have the right to access your data and to have it corrected or deleted. In this processing, you also have the right to temporarily freeze (‘restrict’) the processing of your data, and the right to object to the processing.
How can I exercise these rights?
If you want to exercise one or more of the above rights, you can submit a request using the privacy request form. We will then have one month to respond to your request. For very complex requests (or if a lot of requests come in at the same time), we sometimes need more time (up to two months extra). We will let you know within that first month.
Is there automated decision-making or profiling?
There is no automated decision-making. This means that decisions are never made without human intervention. There is also no profiling.
Questions? Complaints?
Do you have any specific questions regarding the above information or do you have any comments regarding this privacy statement? Feel free to contact us. You can send a message to privacy@uu.nl.
The UU has appointed a Data Protection Officer (DPO). This is an internal advisor and supervisor who may also be important to you, namely if you want information about our processing of personal data or if you want to file a complaint about it. You can contact our DPO via fg@uu.nl.
We would like to point out that you also have the right to file a complaint with the supervisory authority, the Dutch Data Protection Authority.
Contact details Utrecht University
Heidelberglaan 8
3584 CS Utrecht
Tel. (030) 253 35 50
Privacy Statement: Version and Policy Document
This Privacy Statement was last modified on 19 June 2025. From time to time, we will make changes to this Privacy Statement.