Privacy statement

December, 2025

The employee network U-AccessAbility is a community for employees with a visible or invisible disability, including neurodiversity and mental health issues who work at the Utrecht Science Park (USP). The network processes the personal data of its members. This may include personal data of employees of the participating organizations (Utrecht University of Applied Sciences (HU), the University Medical Center Utrecht (UMC Utrecht), and Utrecht University (UU)). The employee network handles personal data with care and acts within the limits of the General Data Protection Regulation (GDPR). With this privacy statement, we are providing information about the purposes for which personal data is processed, how individuals can exercise their privacy rights, and other information that may be of interest.

 

The privacy statement applies to all participants and activities of U-AccessAbility. Personal data is collected directly from participants when they register. This can be done via any of the channels that are available, including: the website, email, LinkedIn, specific event registration forms or via the network’s Team Channel.

Who is responsible for processing personal data?

HU University of Applied Sciences Utrecht is responsible for the personal data of members who work at HU University of Applied Sciences Utrecht. The University Medical Center Utrecht is responsible for the personal data of members who work at the University Medical Center Utrecht. Utrecht University is responsible for the personal data of members who work at Utrecht University. Below you will find the contact details of each participating organization.

HU University of Applied
Sciences Utrecht
Heidelberglaan 7
3583 CS Utrecht
088 481 81 81

UMC Utrecht
Heidelberglaan 100
3584 CX Utrecht
088 75 555 55

Utrecht University
Heidelberglaan 8
3584 CS Utrecht
030 253 35 50

For what purposes do we process personal data?

Personal data will only be processed for specific purposes:

  • To form a community and participate in U-AccessAbility
  • To maintain the membership records
  • For membership of our Teams community
  • For sending newsletters
  • For sending invitations, registering for activities, and processing accessibility and dietary requirements
  • For creating promotional material
  • For sharing photos of meetings (e.g. in Teams or on the website)
  • For direct communication, for example, in response to the contact form on the website

What personal data does U-AccessAbility collect?

Depending on the purpose, the following personal data is collected:

  • First and last name
  • Email address (business or private)
  • Organization where a member works
  • In exceptional cases, address details (e.g., when sending a drinks package)
  • Registration forms and attendance at activities
  • Accessibility requirements (e.g., whether someone needs an induction loop or wants to sit at the front due to their disability)
  • Photos and/or video recordings for promotional material
  • Communication on Teams
  • Health data (i.e., data about their workdisability that members voluntarily share in conversations on Teams about these topics)

Initially, no sensitive or special personal data will be processed. Because this network has been set up specifically for employees with a visible or invisible disability, health is discussed on a regular basis, which is special personal data. Members are free to share their own experiences or accessibility needs.

Retention period for personal data

Members’ personal data will not be retained for longer than necessary. The retention periods for processing are as follows:

  • Membership administration: for as long as someone is a member
  • Registrations for activities via Teams: this data is deleted on a monthly basis
  • Data in registration forms for the network and activities via Formdesk. This data is deleted monthly.
  • Data in the Teams environment: messages are deleted annually from the Teams environment
  • Photos of activities: for as long as the network exists and consent has not been withdrawn
  • Newsletter registrations: for as long as a member is registered for the newsletter or is employed by one of the organizations. After leaving employment, individuals also have the option to re-register for the newsletter with a private email address.

What are the grounds for processing data?

  • For registering with the network: we use the basis of ‘consent’ for this. When registering, members give their explicit consent for the processing of personal data.
  • For maintaining the membership records: we use the basis of ‘legitimate interest’ for this. The interest here is to be able to build a network together. Contact details are necessary to be a member of the network and to participate in activities. No more personal data is processed than is necessary to be a member of the network.
  • For membership of our Teams community: for this, we use the basis of ‘consent’ because members must explicitly register for the Teams community. Consent can be withdrawn at any time unsubscribing from the Teams community.
  • For sending invitations to activities by email: for this, we use the basis of ‘legitimate interest’. The interest here is to inform members of upcoming activities so that you can participate in them. We send invitations to our activities by email, so it is necessary to process your email address (business or private).
  • To register for activities and keep track of members’ accessibility or dietary requirements, we use the basis of ‘consent’. When registering for an activity, this gives permission for data to be processed. Some members require additional or modified facilities in order to participate in activities, or dietary requirements need to be taken into account. It may be necessary to process this data so that we can accommodate those needs. You can withdraw your consent at any time. Your accessibility and/or dietary requirements will then be removed.
  • For sending newsletters: we use the basis of ‘consent’ for this. This is done via an explicit subscription basis. Consent can be revoked at any time by unsubscribing.
  • For creating promotional material and possibly sharing photos of meetings (e.g., in Teams or on the website): we use the basis of “consent” for this. Where possible, we will indicate in advance that photos and/or videos will be taken and create a place where people can remain out of the picture. Consent for the use of personal photos can be withdrawn at any time. If applicable, once published photos that have been printed on paper cannot be removed, but will no longer be printed in a new version of the printed matter.

Who are the stakeholders?

The U-AccessAbility employee network is a public network. The stakeholders may include the following individuals:

  • Members who work at (or study at) HU University of Applied Sciences Utrecht, UMC Utrecht, and Utrecht University, with or without a visible or invisible disability
  • People who do not work at (or study at) HU University of Applied Sciences Utrecht, UMC Utrecht, and Utrecht University, with or without a visible or invisible disability.
  • Administrators (members of the core team and system administrators).

How does U-AccessAbility ensure confidential handling of personal data?

Personal data is stored on secure servers with restricted access. The participating organizations apply technical and organizational measures to ensure that personal data is optimally protected. For example, the participating organizations use appropriate security technology to optimally protect personal data against unauthorized access or unauthorized use. If you have any further questions about this, please feel free to contact info@u-accessability.nl.

Will data be shared with third parties?

U-AccessAbility is an employee network of multiple organizations. As a result, various technical support tools are used by Utrecht University of Applied Sciences, UMC Utrecht, and Utrecht University, such as Microsoft Teams (Teamskanaal), Formdesk (for registration/enrollment), and Maileon (for sending the newsletter). No data is shared with third parties.

Will data be shared outside the European Union?

Data will not be processed outside the European Union.

Automated decision-making

No use is made of automated decision-making without human intervention.

What are privacy rights?

When personal data is processed, individuals have a number of rights with regard to their own personal data:

  • The right to be informed in a timely, clear, and complete manner about how personal data is processed.
  • The right to access, modify, and restrict data.
  • The right to request a copy of personal data that is held.
  • The right to have personal data deleted.
  • The right to object to the processing of data. To do so, email info@u-accessability.nl. This will then be assessed on a case-by-case basis.
  • The right to withdraw consent to the processing of data at any time. This will result in personal data being deleted.

When an individual is no longer employed at one of the participating organizations their data will also be deleted. They will have the option to re-register with a private email address.

Contact and complaint options

The UU is the general point of contact for exercising privacy rights as a participant in U-accessibility: https://www.uu.nl/en/organisation/practical-matters/privacy. To ask  specific questions or comment about this privacy statement or to make a complaint contact the following:

  • The core team of our network: info@u-accessability.nl
  • Utrecht University Data Protection Officer (DPO) via fg@uu.nl
  • It is also possible to complain to the Dutch Data Protection Authority

This Privacy Statement was last amended on December 3, 2025 (English language version) . The network reserves the right to make changes to this privacy statement where necessary. If there are differences between the Dutch and English privacy statements, the Dutch language version takes precedence.