Privacy statement

Practice-based research provides valuable knowledge and products for professional practice and education. This knowledge and products can reach even further than they do now if all information is made more visible and findable. To make this possible, a platform has been developed where everything comes together: Publinova.

Publinova was developed for and by colleges. On Publinova you can search, find, share and connect. Take a look at the platform as a visitor or log in as a user. As a visitor, you can search for information about research results, research projects, parties involved and researchers. You can contact researchers, respond to products and share information from Publinova on social media or another website. If you are logged in as a user, you have more opportunities to contribute to Publinova. Log in via SURFconext or eduID. As a researcher, and in some cases as a supporter, you can manage, modify, add and display your own research results from Publinova on other websites. You can comment on the work of other researchers, look for connections with collaboration partners, and showcase your own expertise, collaborations and products.

To make the above possible, personal data are processed within Publinova. Several parties are involved in this processing: SURF B.V. and its partners as administrator of the platform Publinova and the eduID accounts. And universities of applied sciences and Regieorgaan SIA that publish content related to applied research or make it available via Publinova, such as publications, projects, and profiles. This privacy statement is intended to inform you as accurately as possible about who processes your personal data, what these processes entail, and who you can contact if you have questions or requests.

If you have any questions, please contact info@publinova.nl

About SURF

We are SURF B.V. (hereinafter SURF), located at Moreelsepark 48, 3511 EP Utrecht. SURF is the ICT cooperation organization of education and research in the Netherlands. Within the SURF cooperative, the Dutch universities, universities of applied sciences, university medical centers, research institutes and mbo institutions collaborate on ICT innovation. More about the SURF cooperative.

We are administrator of the platform Publinova and data controller for the processing operations that take place around the management of the platform. And for accounts linked to an eduID. We are also the first point of contact for questions and can help you get in touch with the right college, should you have questions or requests that relate to content around practice-based research, for example. Below you will find the general details of SURF. For questions or requests regarding Publinova, please send an e-mail to info@publinova.nl

Contact details SURF:
SURF B.V.
Moreelsepark 48
3511 EP, Utrecht
info@surf.nl
+31 88 787 30 00

The contact details of our Data Protection Officer are:
fg@surf.nl

About the 14 participating universities of applied sciences

Publinova was developed on behalf of Regieorgaan SIA and the following universities of applied sciences:

• ArtEZ
• Breda University of Applied Sciences
• Codarts
• Fontys Universities of Applied Sciences
• The Hague University of Applied Sciences
• Groningen University of Applied Sciences
• Amsterdam University of Applied Sciences
• Arnhem and Nijmegen University of Applied Sciences
• University of the Arts Utrecht
• Rotterdam University of Applied Sciences
• Utrecht University of Applied Sciences
• Saxion University of Applied Sciences
• Van Hall Larenstein
• Zuyd University of Applied Sciences

These universities of applied sciences and SIA share their knowledge and products through Publinova. And enable their staff and researchers to create an account. Each college (where it says college, it can also read SIA) is independently responsible for all their products, projects, publications, profiles, comments and other content around practice-based research that they share. And for all accounts linked to their own college. Information about your college and how to exercise your rights can be found via the college page on Publinova (see above).

Why is your personal data processed within Publinova?

Publinova is a means for colleges to realize their open science ambitions. Moreover, it supports the mission for applied research to make the greatest possible societal impact. The goal of Publinova is, among other things, to make it easy for researchers and professors to share information about and knowledge from Dutch applied research on this central national platform. In this way, this material will become available to professional colleagues at other universities of applied sciences, but also to a wider audience, such as journalists and anyone who is interested. This information and knowledge should then also be easily shared on other, existing platforms.

To achieve these goals, it is necessary to process personal data.

• When sharing and structuring knowledge, personal data can be displayed with research projects or products, for example: the author of a publication is listed. This is necessary to provide meaningful information and is part of Publinova's goal: to make practice-based research widely accessible.
• Publinova also provides functions for user interaction: posting comments on products and projects, for example. Personal data must also be processed to post and display these comments.
• In order to post comments, it is necessary to have an account. You can also use the account to follow publications or people, for example, or be assigned rights to modify publications. For an account, it is necessary to process personal data. Logging into Publinova can be done through eduID or an Institution account of a participating college.
• It is necessary to process personal data in order to adequately fulfill the role as platform administrator. For example, to be able to admit visitors to the website and to adequately manage and secure the platform and guarantee the availability of the platform. In some cases (functional) cookies are placed to enable this, more information can be found in the cookie statement.
• It is necessary to process personal data in order to gain insight into the use of Publinova. For example, to be able to generate anonymous statistics on the use of Publinova and produce reports for colleges. In some cases (analytical) cookies are placed to make this possible, more information can be found in the cookie statement.

Why may your personal data be processed?

Personal data may only be processed if there is a legal basis for doing so. The basis in this case differs depending on the purpose and who is responsible for processing.

Legal bases from SURF:

• Personal data in the context of platform security and management are processed by SURF on the grounds of legitimate interest. SURF has a legitimate interest to process a limited set of personal data of visitors and users, which are necessary to provide, manage, and secure the platform. The impact on individuals is small and the set of personal data is minimized as much as possible. It concerns IP addresses and log data.
• Personal data in the context of accounts that log in via eduID are processed by SURF pursuant to execution of the agreement. This is the agreement between SURF and a user who logs in via eduID and creates an account. When logging in for the first time, the terms of use for the use of the platform are displayed, and by agreeing to these terms, the account is created. In doing so, it is necessary to process some personal data, for example, regarding the user profile. And it is optional to enrich the profile itself with some additional data and set up notifications. More information about eduID can be found here: eduID » PrivacyStatement

Legal bases from participating colleges:

• Participating universities of applied sciences are and remain responsible for content related to practice-based research that they make available through Publinova. And therefore also for the collection, provision and compilation of personal data that may be part of this content. For example, within publications, products and profiles of researchers and authors with an institutional account. This personal data may relate to researchers at the own university of applied sciences, but also, for example, to researchers or co-authors outside the own university of applied sciences. The college that posts or shares the content on the platform is always responsible for having a lawful basis for processing personal data within this content. In some cases a college invokes legitimate interest, in other cases this will be consent of the researcher or author. Each college's privacy statement further explains the bases (see above for contact information).
• Personal data in the context of accounts logging in through the institution account are processed by the college on the basis of legitimate interest, performance of an agreement such as an employment contract or on the basis of consent. It is necessary to process some personal data, for example, with respect to the profile. And it is optional to enrich the profile itself with some additional data and set up notifications. The privacy statement of each college further explains the bases (see above for contact details)

From whom are personal data processed?

Personal data of visitors to the website (see also the cookie statement) and of logged-in users of the platform are processed. In addition, personal data of researchers and authors are processed when these personal data are part of the content around practice-oriented research shared by a university of applied sciences on the platform. For example, researchers and authors may be named in projects, products and publications. A profile can also be created about these researchers or authors based on this data.

How does Publinova receive personal data?

There are several ways in which personal data may end up on the platform.

• Colleges share content around practice-based research (which may contain personal data of researchers and authors) on Publinova.They provide this content via a link to one or more source systems, such as PURE or SURFsharekit. Or is uploaded directly to the platform by the college.
• Employees (and sometimes students) can log in to Publinova through their college's account; this link is made through SURFconext.An account is then created on Publinova with personal data originating from the college.
• Anyone can log into Publinova through eduID.An account will then be created on Publinova with personal data provided by eduID.
• Anyone with an account on Publinova can enrich this account with additional data and comment on various content. These personal data come from the user.
• Personal data is collected and generated by means of cookies to enable visits to the platform and to manage the platform.

What personal data are processed?

Personal data are processed from the different purposes and functionalities:

• Visit, management and security platform:
  • IP address
  • Internal identifier
• Knowledge sharing through content on practice-based research, including profiles of authors and researchers:
  • Required::
    • First and last name, middle name
    • Email address
    • Employee or not
    • Institution
    • Internal identifier
  • Optional:
    • Job title
    • Description (about)
    • Skills
    • Themes
    • Parties
    • ORCID/ISNI/DAI
    • Email address
    • Phone number
    • Photo
• Accounts linked to a college:
  • Required:
    • First name, last name, middle name
    • Email address
    • Employee or not
    • Institution
    • Internal identifier
  • Optional:
    • Job title
    • Description (about)
    • Skills
    • Themes
    • Parties
    • ORCID/ISNI/DAI
    • Email address
    • Phone number
    • Photo
    • Linked profiles
• Accounts linked to eduID:
  • Required:
    • First name, last name, middle name
    • Email address
    • Employee or not
    • Institution
    • Internal identifier
  • Optional:
    • Job title
    • Description (about)
    • Skills
    • Themes
    • Parties
    • ORCID/ISNI/DAI
    • Email address
    • Phone number
    • Photo
    • Linked profiles
• Comments
  • First name, last name, middle name
  • Email address
  • Institution
  • Internal identifier
  • Comments
• Handling questions and complaints
  • First name, last name, middle name
  • Email address
  • Institution
  • Communication
• Reports and statistical analyses
  • IP address (automatically stripped to first part/octet only)
  • Browser user agent
• Processing for reports and statistical analyses
  • IP address
  • Browser user agent

Backups:

To ensure the continuity and availability of the Publinova platform, backups are made on a daily basis, including of all the (personal) data described. Both SURF and the universities of applied sciences have their own responsibility in this.

Who receives your personal data?

All content about applied research, including personal data of researchers and authors, is public and can be viewed by every visitor and user of Publinova. Users' profiles are also public. When you create an account on Publinova, you can choose to make your account/profile public or protected. There are also options to shield e-mail addresses and phone numbers.

Various parties are also involved in providing the platform. The following parties process personal data by order and instruction:

• Zooma B.V. as hosting and management party.
• Amazon AWS for enabling search and making (meta)data consistent and uniform. Contractual in location Germany, transfer cannot be excluded.

Furthermore, your data will only be provided to other parties with your consent, unless it is required or permitted by law to provide your data.

Data retention periods

• Logging in the context of platform administration will be kept for one month.
• Accounts are deleted if no logging in for more than one year + 6 months due to backups.- Profiles imported by the educational institution are kept as long as they are delivered from the source system + 6 months due to backups.
• Profile pages belonging to an account are retained until the user deletes the profile page/account + 6 months due to backups.
• Profielpagina’s behorende bij een account blijven bewaard totdat de gebruiker de profielpagina/account verwijderd + 6 maanden vanwege backups.
• Anonymized reports and statistical analyses are kept indefinitely.
• Inquiries and complaints are kept for 1 year.
• Backups are kept for 6 months.

Automated decision making

The processing described in this privacy statement does not use automated decision making and profiling.

What rights do you have?

You have the right to have your personal data processed on the platform changed, completed or deleted. You can also request access to the personal data processed about you.

If it involves the processing of data provided by you on the basis of your consent or the performance of an agreement with you and the processing is automated (not on paper), you can request an overview in a structured and common form of the personal data we process about you. You also have the right to transfer this data to another party.

You can also submit a request to restrict the processing of your personal data, as a result of which the controller temporarily stops processing your data, if:

• you object (see further explanation below), or
• you contest the accuracy of personal data being processed, or
• you consider that the processing of data is unlawful, or
• you consider that the controller no longer needs your personal data, but you need them in the context of a legal claim.

Right of objection:

You can object to the processing of your personal data if your data is processed on the basis of a legitimate interest or on the basis of the performance of a task of public interest. If the controller has no compelling legitimate grounds to continue the processing, the processing will cease.

You can also object if your personal data is used for profiling or automated decision-making.

If you object, you can also submit a request to limit the processing of your personal data during this objection.

To file a complaint:

If you believe that Publinova is not handling your personal data properly, you can submit a complaint to the Data Protection Officer of SURF or of a university of applied sciences.You also have the right to file a complaint with the Personal Data Authority. More information about the Personal Data Authority and filing complaints can be found at www.autoriteitpersoonsgegevens.nl.

Where can you go to exercise your rights?

A request to exercise your rights can be submitted to the organization responsible for processing your personal data. Within Publinova, however, this may be different organizations: SURF or one of the participating universities of applied sciences. To make things easier for you, SURF coordinates the questions and requests that come up, and where necessary we can put you in touch with the right person at the right university of applied sciences. To do so, contact us at: info@publinova.nl. Of course, you may also contact a college directly, see the contact information for your college above.

This privacy statement was last updated on October 13, 2023.