Being the data controller Leiden University is responsible for the data processing described in this privacy statement.

In addition to classroom education, we also provide tools for remote teaching, like video conferencing application Zoom. Regarding regular education the processing of your personal data is “necessary for the performance of a task carried out in the public interest”; for other forms of (contract) education, the processing is based as “necessary for the performance of a contract”.

Personal data is used for:

• organizing, attending and participating in meetings and lectures;
• motivating and guiding students during the course;
• improving education, including the (further) development of teaching methods and materials.

Personal data can be processed to facilitate students who are enrolled in the same course to view recordings of the meeting afterwards.

If you use Zoom to provide a lecture, attend a lecture, meeting, or other activity on the initiative of Leiden University, the following data will be processed:

• contact information: first name, initials and/or surname, e-mail address, IP address, device/hardware information
• meeting information: topic, description
• video and audio recordings of you and the room you are in while participating in a Zoom meeting/ lecture
• on-screen activities while you are sharing your screen during a Zoom meeting/ lecture
• chat messages sent through the in-meeting chat functionality during a Zoom meeting/ lecture

It is expressly forbidden to use Zoom to discuss confidential documents or topics.

The personal data processed during online lectures and meetings with Zoom are viewed by Leiden University employees, such as meeting organizers, lecturers and support staff, and by participating Leiden University students. Staff and students only have access to the personal data if this is necessary for the (online) preparation of the education, student support, answering questions and other course or meeting related activities.

Zoom lectures can be recorded by the lecturer and made available to students who are registered for the course to which the lecture belongs. Only Leiden University staff (instructor, teaching assistant, support staff) can make recordings of Zoom lectures or meetings. Students are not allowed to make recordings of Zoom lectures.

Leiden University holds the intellectual property rights to lectures (both recorded live stream lectures and recorded lectures), readers and other material. Students of Leiden University are not permitted to provide this material to third parties or to distribute educational material (including online material) in any form whatsoever without Leiden University's express prior consent.

The personal data collected in the context of Zoom lectures or meetings are stored on a secure Zoom company server. Leiden University has concluded a processing agreement with Zoom to ensure that your personal data is processed carefully, securely and in accordance with GDPR. This agreement also stipulates that Zoom and its subcontractors (sub-processors) may never process personal data for their own purposes and may only act in accordance with Leiden University's instructions.

Universiteit Leiden has chosen for a Zoom EU deployment. This means that no servers outside the EU will be used for meeting data in transit. This is the data (audio, video, files, screensharing) that is actually being moved during meetings.

Recordings, or data in rest, will temporarily be stored in the EU Zoom cloud, but will be automatically removed after 60 days. Recordings will automatically be stored in Kaltura after the meeting has ended.

Your profile data will be stored outside the European Union. This data is used in your Zoom account and with it you can use the Zoom services. Zoom has implemented appropriate safeguards to protect your personal information. Leiden University has entered into a data processing agreement with Zoom. On this basis Zoom is prohibited from using your personal information for purposes other than those agreed upon. The transfer of personal information is governed by standard contractual clauses that are also part of the agreement between Leiden University and Zoom.

In addition, Zoom uses subprocessors, which are also located outside the European Union. Zoom has entered into standard model contracts with these subprocessors, which determine the measures to be taken in order to adequately protect your personal data.

Zoom stores personal data for as long as necessary. Users themselves have the option of deleting their data in Zoom via the dashboard.

Zoom lecture recordings are stored in Zoom cloud, within the European Union, where they can only be accessed by employees or students.

Leiden University determines how long the data of recorded Zoom lectures will be stored. For lectures where students are part of the recording, a maximum retention period of one year is applicable. For lectures in which only lecturers are included in the recording, this period may be longer, provided the lecturer gives his/her permission.

Zoom uses adequate security according to the requirements of today's time. For example, Zoom applies encryption to all traffic that takes place between the client and Zoom's server.

If you prefer not to use Zoom because of concerns regarding the use of your personal data, you can ask the teacher to use an alternative service such as Kaltura. When the teacher is unable to find a workable solution you can contact a Study Advisor or a Confidential Counsellor. If they can't resolve the issue please do contact the Data Protection Officer of Leiden University. For contact information and more information on your rights under GDPR see this link. Or copy paste https://www.organisatiegids.universiteitleiden.nl/en/regulations/general/privacy-notice-student

https://www.organisatiegids.universiteitleiden.nl/en/regulations/general/privacy-notice-student