“STAR, Studievereniging verbonden aan de RSM Erasmus University” (hereafter: STAR) operates multiple websites. These include but are not limited to rsmstar.nl; secresearch.nl; smw.rsmstar.nl; consultancycastle.nl. This Privacy Statement is applicable to all the websites STAR operates. STAR processes personal data for its websites. In this Privacy Statement, we inform you of the purposes for which personal data are processed and how you can exercise your privacy rights, and provide other information that could be important for you. This Privacy Statement applies to all activities of STAR, including the activities via the website. This Privacy Statement provides the most relevant information on each subject.

STAR treats personal data with care and acts within the limits of the General Data Protection Regulation (GDPR).

Controller and responsibility

For most of the purposes described below, STAR is ‘controller’ according to the definition in the EU’s General Data Protection Regulation (GDPR). This means STAR determines the goals and means for the processing of personal data of all categories of data subjects. We consider it to be essential that everyone’s personal data is handled and secured with the greatest care. We also want to be transparent about the way in which we process your data.

For which purposes does STAR process your personal data?

STAR uses your personal data that we gather for its operations The main purposes for which STAR processes personal data are:

1. Administration and support: membership administration, internal information provision, recording participation in events, recording participation in committees, organizational analysis, handling disputes.
2. Business operations and finance: financial administration, management of the purchasing systems and payment systems, implementation and management of procedures for IT, legal affairs and other business operations. Recruitment & selection of new active members, internal and external information provision, the issue of certificates.
3. Facilities: access and management systems, camera surveillance.
4. General processes: web content management, physical and digital archiving, participation in decision-making, complaints procedure and objections and appeals.
5. Events: when participating in an activity with a selection based on (anonymous) Curriculum Vitae during our events (including but not limited to the STAR Management Week), the participating company will receive the (non-anonymized) Curriculum Vitae of the registered participants of the attended event two days before the event.

STAR processes personal data via its various websites, such as personal data acquired via contact forms. This takes place on the basis of permission or on the grounds of the justified interests of STAR. All processes in which personal data are processed are recorded in a register of processing activities. This gives STAR a complete and up-to-date overview of all data processing processes.

Whose personal data does STAR gather?

In the processes referred to above, STAR gathers data from different categories of data subjects. These are:

• RSM Students
• Prospective RSM students
• Members
• (RSM) Alumni members
• Visitors to the website(s)
• Event visitors
• Companies and their employees

Which personal data does STAR gather?

Different personal data are gathered in each process. The most common data are:

STAR gathers (personal) data directly from you, and where applicable, STAR also receives personal data from third parties, in as far as this is in compliance with the law.

Granting and withdrawal of permission

STAR offers various activities that can only be performed by making use of your personal data. These could include your e-mail address, in order to send newsletters and/or promotional e-mails. If you grant STAR permission to use personal data, you can always withdraw this permission at a later date.

How does STAR ensure confidential handling of personal data?

STAR treats personal data as confidential. STAR takes appropriate technical and organizational measures to protect personal data. STAR shares personal data only in accordance with this Privacy Statement and with third parties only if this is warranted and takes place with care.

Sharing data with third parties

On the instructions of STAR, third parties may provide certain parts of the services for the execution of an agreement. STAR contracts agreements with these processors in order to ensure that personal data are handled confidentially and with due care. These agreements are contracted in ‘processor’s agreements’.

Your personal data will not be leased, sold or shared in any other way with or provided to third parties. STAR may share your (personal) data with third parties if, for example, you have personally granted permission for this or if this is necessary for the execution of the agreement.

STAR provides personal data to enforcement authorities or fraud control organizations if this is necessary in order to comply with a statutory obligation.

STAR retains the right to share your personal data with the following third parties:

• The Rotterdam School of Management, Erasmus University and RSM B.V.. Data is shared with various departments within RSM. Data is shared in cases where STAR members might benefit from the offerings of RSM.
• Other study associations at the Erasmus University Rotterdam. Memberships data might be shared in case a student is following a dual-degree program. This is only done after explicit approval.

Passing on your data outside the EU

In some cases, third parties may be located outside of the European Union. In these cases, STAR will take appropriate measures to protect personal data. For example, in the following situations: in case of a trip abroad where STAR has to share your data to arrange accommodation or flights.

For how long are data stored?

STAR stores your personal data in compliance with the GDPR. The data are not stored for longer than is strictly necessary in order to realize the objectives for which the data are gathered. Please contact us for more information on our Data Retention Policy.

How can you view, correct or delete your data?

You can send a viewing or correction request to STAR. Clearly state that this concerns a viewing or correction request pursuant to the GDPR. You can also request the deletion of your data, but this is only possible in as far as STAR can still comply with its statutory obligations, such as the statutory term for storage. Bear in mind that you may be required to provide a copy of an identity document in order to verify your identity. You can make a secure copy of your proof of identity quite simply with the government ‘Kopie Id’ app which you can download in the app store.

You also have the right to submit a complaint concerning the use of your data to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies and clicking behaviour

General visitor data, such as the most commonly requested pages, are recorded on our website. The purpose of collecting this general information on visits to the website is to optimise the design of the website for you. STAR uses different tools for the optimal functioning of the website and to improve its user-friendliness, and in order to retrieve active feedback from users. Read more about the cookies that STAR uses here.

Third party privacy policies

STAR website contains links to other websites that do not belong to STAR. We cannot accept any responsibility concerning the way in which these parties treat personal data. We therefore advise you to always inform yourself of the privacy policy of these parties or to contact them for a more detailed explanation of their policies relating to the use of personal data.

Questions

Do you still have any specific questions or comments regarding our privacy statement after reading this information? Then please feel free to contact us by sending an email to compliance@rsmstar.nl.

This privacy statement is based upon versions by the Erasmus University Rotterdam and Rotterdam School of Management. Exctracted from https://www.eur.nl/en/disclaimer/privacy-statement on 10 February 2020; and https://www.rsm.nl/about-rsm/privacy-statement/ on 9 March 2020.

Last updated: 29 May 2020