Privacy Policy

Privacy statement for the online shop of the University of Amsterdam

To process your order, the University of Amsterdam ("we" or "we") needs your personal data. We respect your privacy and ensure that the personal data you provide is treated confidentially. We would like to tell you what we do with your personal data and why we need it in this privacy statement. We are responsible for the processing of your personal data, as described in this privacy statement. If you have any questions after reading this privacy statement, please feel free to Contact us.

1. When does this privacy statement apply?

This privacy statement applies to all personal data that we process for the actions under 2.

2. Which personal data do we process and why?

When you order something, we need certain personal data from you to be able to deliver your order and to keep you informed about your order. These personal data are also required for any returns or repairs.

For this we collect: name, address, place of residence, zip code, bank and payment details.

In addition, we want to offer you a pleasant shopping experience in our online shop. In this context, we collect personal data from you as a visitor to our online shop. We process this personal data to compile user statistics; securing and improving our websites; and improving our services.

For this we collect: your website visit and click behavior; IP address; duration and time of the visit to the website and use of social media.

We continue to develop and optimize our services. As a result, our Privacy Statement may be amended from time to time. We therefore advise you to consult the privacy statement regularly.

3. Who do we share personal data with?

We share your personal data with external service providers to help us with the actions under 2. For example, we share your personal data with Shopify Inc ("Shopify") for the management of our online shop. Shopify supports us in checkout, payment processing, store and customer management and product organization. We conclude agreements with all external service providers in which we agree what they can do with your personal data.

4. Where do we store your data?

We store your data within the European Economic Area ("EEA"). However, it may happen that certain data that we collect is transferred to or stored at a destination outside the EEA, for example because an external service provider is located there. If this is the case, we contractually agree that this will be done in a secure manner and in accordance with the General Data Protection Regulation.

5. How are your data secured?

We have taken measures to protect your personal data, both organisationally and technically. We use the personal data storage within Shopify and the University of Amsterdam does not store the data.

When we share your personal data with external service providers, we contractually agree that they will handle your personal data just as carefully as we do. If you feel that this is not happening, please contact us.

6. What are your rights?

You may request access to your personal data at any time. You can also request us to change your personal data if, for example, it is incorrect, incomplete or irrelevant. You also have the right to request us to delete your personal data. This does not apply to the data that we must or may keep on the basis of the law.

7. Questions or complaints?

If you have any questions about the way we process your personal data, you can let us know via merchandise@uva.nl . We are happy to help you.

If you believe that your personal data is being processed in violation of the GDPR, you can go to fg@uva.nl submit a complaint to the Data Protection Officer ("DPO"). The DPO is the link between the UvA and the external supervisor (de Dutch Data Protection Authority). The DPO acts independently and can consult or obtain advice from the Dutch Data Protection Authority about your complaint.

If you do not agree with the complaints handling by the DPO, you can submit a complaint directly to the Dutch Data Protection Authority. The Dutch Data Protection Authority handles the complaint or request and takes a decision on this.