Privacy Notice: Electronic Access Control

About Saxion

Saxion's Executive Board is the data controller as defined in the General Data Protection Regulation (GDPR) and is therefore ultimately responsible for the lawful and careful processing of personal data within Saxion. The Executive Board establishes the policy, measures and procedures relating to the processing of personal data.

Saxion is located at M.H. Tromplaan 28, 7513 AB in Enschede. Saxion's postal address is PO Box 70000, 7500 KB Enschede. For questions about this privacy notice or other questions regarding the processing of personal data, please send an email to [email protected].

For what purposes does Saxion process my personal data?

Saxion uses an electronic access control system. People requiring access to restricted areas within Saxion’s buildings can open them using a digital key fob. Saxion processes personal data for this purpose.

What personal data does Saxion collect about me?

If you have access to restricted areas at Saxion and hold a digital key fob, the following personal data may be processed, depending on your user type:

• Employee username
• Employee’s organisational unit
• Employee’s start date
• Employee emergency response (BHV) registration
• Employee parking permit registration
• Student number
• First name/surname
• Name of the supplier or leasing party
• Email addresses of employees of suppliers and leasing parties
• Telephone numbers of employees of suppliers and leasing parties

On what legal basis is Saxion permitted to process my data?

To process personal data, Saxion must have a legal basis under the GDPR. In the case of Electronic Access Control, processing is based on the legal ground of legitimate interest.

Sensitive personal data

No sensitive personal data is processed in the context of electronic access control.

How long does Saxion retain my personal data?

Saxion retains your personal data only as long as necessary for the purposes for which it was collected, or as long as required by applicable laws or regulations. For example, retention periods under the Public Records Act (as set out in the Universities of Applied Sciences Retention Schedule) or under tax and employment laws. The retention period is determined by Saxion per processing activity. If you want to know the retention period of a specific processing activity, you can contact Saxion at [email protected].

What are my rights under the GDPR?

When Saxion processes your personal data, you have the following rights under the GDPR:

• Right of access: you have the right to view the personal data that Saxion processes about you.
• Right to rectification: you have the right to correct or complete the personal data that Saxion processes about you if it is incorrect or incomplete.
• Right of objection: you can object to the processing of your personal data. You can also object to personally targeted ads.
• Right to erasure: you may request Saxion to delete your personal data.
• Right to withdraw your consent: if you have given Saxion permission to process your personal data, you can withdraw this consent at any time.
• Right to data portability: if it is technically possible, you have the right to have the personal data that Saxion processes about you transferred to a third party.
• Right to restriction of processing: in some cases, you can request Saxion to restrict the processing of your personal data. This may also be a temporary restriction.

How can I exercise these rights?

Do you have an active Saxion account? Submit your request through the Service Portal (Information Security & Privacy – GDPR – Exercising your rights under the GDPR).

If you do not have a Saxion account you can submit your request through: [email protected].  Saxion will review and assess each case individually to determine whether a specific request can be granted. Exercising your rights is free of charge, except in cases of abuse. To process your request, Saxion will need to determine your identity to ensure that personal data is not shared with unauthorised parties or modified without authorisation. Once your identity has been determined, Saxion will respond to your request within four weeks.

How does Saxion protect my personal data?

Saxion takes appropriate technical and organisational measures to protect your personal data against misuse, loss, unauthorised access, unwanted disclosure and unauthorised modifications.

With whom does Saxion share my personal data?

Saxion only shares personal data with third parties if this is in accordance with the applicable laws and regulations. This mainly occurs as a result of Saxion’s legal obligations. This involves sharing personal data with, for example, the Tax and Customs Administration, municipalities, the Ministry of Education, Culture and Science, DUO, the Higher Education Inspectorate and the Immigration and Naturalisation Service.

In addition, Saxion engages third parties to provide its services. Saxion will then only provide the personal data that is necessary for the task to be performed. Where necessary, terms are set out in a contract (such as a processor agreement).

Transfer to foreign countries

Most parties to which the Saxion provides personal data are located within the European Economic Area (EEA). A provision can only take place if, among other things, there is a valid legal basis for it and the receiving party complies with the legal requirements of the GDPR.

If personal data is provided to a party outside the EEA, measures will be taken and arrangements made to ensure that the processing is done securely and in line with the GDPR.

Questions? Complaints?

At Saxion, the Data Protection Officer (DPO) supervises and advises on the application of and compliance with the GDPR and Saxion’s privacy policy, as well as the allocation of responsibilities. The statutory tasks and responsibilities of the DPO give this officer an independent position in the establishment and performance of their duties. The DPO will also contribute to raising privacy awareness. The DPO works in collaboration with and acts as the point of contact for the supervisory authority (the Dutch Data Protection Authority). If you believe that your personal data is being processed by Saxion in breach of the GDPR, you can file a complaint with the DPO via: [email protected]. The DPO acts independently and may consult or seek advice from the Dutch Data Protection Authority regarding your complaint.

Questions?

If you have any questions about this privacy notice, please contact us at [email protected].

Modifications

This privacy notice was last updated in June 2026