Privacy Policy

1. Identity and contact details of the data controller

StudentApp is the subject of a collaboration agreement between the student services of Hogeschool West-Vlaanderen (Howest) and Katholieke Hogeschool VIVES Noord (VIVES), and falls within the decree concerning student services in Flanders.

This privacy policy applies to all personal data processed by Howest and VIVES, which are jointly the "Controller" of this website.

The Controller attaches great importance to your privacy and therefore processes your personal data in accordance with European Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter "GDPR"), as well as any future or supplementary legislation implementing it, as applicable.

2. What does "processing personal data" mean?

Processing personal data (hereinafter "data") includes any processing of data that can identify you as a natural person. This Privacy Policy describes which data we are talking about. The term "processing" is very broad and covers, among other things, the collection, storage, use of your data, or sharing it with third parties.

3. What data do we process?

Depending on the situation, your preferences, and how you contact us, we may process the following data:

Upon registration on app.studentapp.be:

• Language (NL or EN)
• First and last name
• University/college email address
• Profile photo
• Gender (Male, Female, Other, Prefer not to say)
• Educational institution
• Study program
• Commuter or resident student (checkbox)
• Personal interests (activity selection)

Technical and functional data:

• Role (student, editor, campus admin, administrator)
• Email verified (yes/no)
• Date and time of account creation
• Date and time of registration

When checking in to an activity:

• User name
• Email address
• Activity
• Program linked to the activity
• School
• Language (NL or EN)

Technical and functional data:

• Date and time of check-in creation
• Date and time of check-in modification

When unlocking (e.g. payment):

• User name
• Email address
• School
• Language (NL or EN)
• Activity name
• Name of the account paid to

Source of data

The data we process from students is provided by the student during registration on app.studentapp.be. The technical and functional data are also stored according to the user's behavior.

4. For what purposes do we process your data?

Personal data is processed solely for the following purposes:

• General operational functioning of StudentApp (for example but not limited to looking up the number of participants of an activity, checking user payments, ...);
• Informing students about relevant updates
• Managing administration such as check-in verification and invoicing with partners
• Statistical and anonymized reporting (e.g., annual reports)

5. On what legal grounds do we process your data?

We process your data for the purposes described below and do not collect or process any more or other types of data than those necessary for these purposes.

We process your data only to the extent based on one of the processing grounds listed in the GDPR, as shown below.

Legal grounds

• Your consent upon registration
• Legitimate interest of the campus admin to offer, improve, and evaluate activities
• Execution of a contract (e.g., participation in paid activities)

6. With whom do we share your data?

Where necessary, we engage an external service provider (processor) to support our operational purposes, such as managing our website and app. This processor will perform certain data processing operations on our behalf. We will only share your data with this processor to the extent necessary for the relevant purpose. The processor may not use the data for any other purposes. Furthermore, the processor is contractually bound to guarantee the confidentiality of your data through a "data processing agreement" concluded with these parties.

In concrete terms, this means that we share your data with one of the third parties listed below, in accordance with the location of your study. They act as our processors and only for the stated purposes (point 4).

• Howest campus Brugge
• Howest campus Kortrijk (for students Howest and UGent Campus Kortrijk)
• VIVES campus Brugge (for students VIVES and KU Leuven campus Brugge)
• VIVES campus Kortrijk
• VIVES campus Roeselare
• VIVES campus Torhout
• VIVES campus Oostende
• College of Europe
• KU Leuven Kulak
• Thomas More Antwerpen
• Thomas More Geel
• Thomas More Lier
• Thomas More Mechelen
• Thomas More Sint-Katelijne-Waver
• Thomas More Turnhout
• Thomas More Vorselaar

Their access is limited to personal and user data of their own campus.

• Brugge Studentenstad
• Kortrijk Studentenstad
• Student clubs

Access is limited to data of their assigned program.

Partners (e.g., sports centers, cultural venues) only access data related to their specific activity.

7. How long do we retain your data?

We do not retain your data longer than necessary for the purpose for which it was collected.

Personal data is structurally removed from servers during the annual cleanup (typically in August).

At the start of each academic year (September), students must re-register.

8. Where do we store your data and how is it protected?

We implement appropriate technical and organizational security measures to prevent the destruction, loss, falsification, alteration, unauthorized access, or unlawful disclosure to third parties, as well as any other unauthorized processing of this data, within the scope of our activities. Your password is stored encrypted.

All data is stored on servers within the European Economic Area (EEA). No transfer takes place to countries outside the EU.

9. What rights do you have as a user?

You have various rights regarding the data we process about you. If you wish to exercise any of the following rights, please contact us using the contact details listed under the first heading of this Privacy Policy.

Right of access and copy

You have the right to access your data and receive a copy. This right also includes the right to request further information about the processing of your data, including the categories of data processed about you and the purposes for which this is done.

Right of rectification or correction

You have the right to have your data rectified if you believe we hold inaccurate data.

Right to erasure (right to be forgotten)

You have the right to request that we erase your data without undue delay. However, we may not always be able to comply with such a request, for example, if we still need the data for the performance of an ongoing agreement, or if retaining certain of your data for a certain period is legally required.

Right to Restrict Processing

You have the right to restrict the processing of your data. This means processing will be temporarily halted until, for example, its accuracy has been verified.

Right to Withdraw Consent

If processing is based on your consent, you have the right to withdraw this consent at any time by contacting us. For marketing emails you receive from us based on your consent, you can easily withdraw this consent by clicking the unsubscribe link at the bottom of each message.

Right to Object

You have the right to object to the processing of your data based on legitimate interest. This must be done on grounds specific to your situation.

Right to data portability

You have the right to receive your data, which you have provided to us with your consent or in fulfillment of a contract, in electronic form. This allows for easy transfer to another organization. You also have the right to request us to transfer your data directly to another organization, if technically feasible.

Right to lodge a complaint with your supervisory authority

If you believe we are processing your data incorrectly, you always have the right to lodge a complaint with your supervisory authority for data protection.

Belgian Data Protection Authority (GBA)
Drukpersstraat 35
1000 Brussels
contact@apd-gba.be

10. How can you exercise your rights?

You can exercise your rights by contacting us by email at privacy@vives.be or privacy@howest.be, provided you include a copy of the front of your identity card or another document that can be used to identify you. This copy will only be used to identify you in accordance with the GDPR.

11. Changes

We reserve the right to amend this Privacy Policy. The most recent version is always available on our websites. The date this Privacy Policy was last amended can be found at the top of this page. In the event of a substantial change to the Privacy Policy, we will, where possible, inform those affected directly.

12. Contact

For further questions or comments regarding your personal data, contact:

• Hogeschool West-Vlaanderen (Howest): privacy@howest.be
• Hogeschool VIVES: privacy@vives.be
• Thomas More: privacy@thomasmore.be