Introduction

This is the privacy document of Informatie- en Communicatietechnologische Studievereniging Inter-Actief. This document details which (personal) data is stored or processed by Inter-Actief, why this is done, which rights people have regarding this data, and which processing activities Inter-Actief executes on this data. We also explain with which third parties we are allowed to share this data and why, and we explain how long we store this data.

This document exists in accordance with the Dutch “Algemene Verordening Gegevensbescherming” (AVG²) and the European General Data Protection Regulation (GDPR¹).

0. Preamble

The English version of this document serves only as a reading guide to the original Dutch document for people who prefer to read the document in English. This text is not legally effective. In case of conflicts in meaning between this version and the Dutch version, or in legal conflicts, the Dutch version is always leading.

1.1. Contact details and Identity I.C.T.S.V. Inter-Actief

Informatie- en Communicatietechnologische Studievereniging Inter-Actief is the study association for Technical Computer Science and Business & IT at the University of Twente. Inter-Actief is registered at the Chamber of Commerce under number 40074947. Inter-Actief can be visited at Drienerlolaan 5, 7522 NB in Enschede. Inter-Actief is reachable by phone on +31 (0)53 489 3756 and via mail on board@inter-actief.net.

1.2. Storage period of data

Inter-Actief keeps the details of the membership until the membership is terminated, with the exception of the instances specified in the next chapters. After termination of the membership the personal details of a member are kept in backups for up to a year.

1.3. Rights of the involved

Every European citizen has the following rights:

Right of inspection (GDPR¹ Article 15)

Everyone has the right to inspect the personal details that Inter-Actief processes about them. Next to that, every person whose personal details are processed by Inter-Actief has the right to inspect the following information:

• the processing purposes of the processing activities performed on their personal details;
• the categories of personal details that are involved in each processing;
• the people who and/or organizations which might have access to the personal details;
• the storage period of the personal details;
• their rights concerning the processing of their personal details;
• all available information about instances where Inter-Actief collects personal details about them where the personal details are not provided by the person directly;
• (if applicable) useful information about the underlying logic of profiling performed by Inter-Actief, and the importance and consequences of this profiling for the member.

Right of rectification (GDPR Article 16)

If Inter-Actief possesses incorrect or incomplete personal details about someone, this person has the right to let these details be corrected and/or completed as quickly as possible.

Right to be forgotten (GDPR Article 17)

Everyone has the right to request Inter-Actief to delete all personal details concerning them. It is mandatory for Inter-Actief to comply to this request within reasonable time. Besides that, it is mandatory for Inter-Actief to remove personal details within a reasonable time in the following situations:

• The personal details are no longer necessary for the purposes for which they were initially collected and/or stored.
• Someone revokes their given permission for the processing of the personal details. (The deletion is only mandatory if the processing of the personal details is solely based on this permission).
• Someone successfully objects to the processing of their personal details (see “Right to objection”).
• The personal details were processed in an unlawful manner.
• There is a law that obligates Inter-Actief to delete the personal details.

Right to restriction of processing (GDPR Article 18)

Everyone has the right to restrict the processing activities in the situations listed below. ‘Restriction of processing’ means that the concerning personal details can be stored, but that permission from the person is necessary for all further processing of the details.

• Somebody doubts the correctness of their personal details; the restriction applies as long as Inter-Actief needs to verify the correctness of these personal details and (if necessary) correct them.
• Someone’s personal details are processed unlawfully, but this person would rather restrict the processing instead of deleting the details.
• Someone has objected to the processing of their personal details; the restriction applies until the objection is either marked as successful or is rejected.

Right to transfer data (GDPR Article 20)

Everyone has the right to receive the personal details that they provided to Inter-Actief in the context of processing under legal basis a or b (see below), in a structured manner. This only applies if the processing activities occur (partly) automatically. They have the right to (without interference of Inter-Actief) transfer these details to others. If technically possible, Inter-Actief needs to transfer these details directly to the other party if requested by the person. NB: The right to be forgotten weighs heavier than the right to transfer data.

Right to objection (GDPR Article 21)

Everyone has the right to, with arguments specific to them, object to the processing under legal basis f (see below). If this is the case Inter-Actief has to either stop the concerning processing for this person, or present arguments that outweigh the arguments of the person. Furthermore, everyone has the right to object against the processing of their personal details for direct marketing. If this is the case Inter-Actief may no longer use these personal details for direct marketing.

Right to withdraw consent (GDPR Article 7 lid 3)

If someone has given consent to process their personal details, they have the right to withdraw this consent at all times. This withdrawal of the consent has no effect on processing that has occurred before the consent was withdrawn. Furthermore, the withdrawal of consent has to be as easy as giving the consent.

Right of objection with AP (AVG² Chapter 2)

Every person has the right to submit a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), if they think that Inter-Actief is handling their personal details in an unjust manner.

1.4. Profiling at I.C.T.S.V. Inter-Actief

At Inter-Actief profiling happens sometimes while sending mailings. A company mailing for example is sometimes only sent to members that have been studying for an amount of years. Inter-Actief does this only to avoid their members getting flooded with mails that are not applicable to them.

1.5. Anonymous Statistics

Inter-Actief uses various statistics to steer its policy where necessary. For this, personal details could be used. In all cases the personal details are anonymized before display to guarantee the privacy of every person.

1.6. Access to personal details

Within Inter-Actief only the board and people appointed by the board have access to personal data. The people that have access to the personal details have signed a non-disclosure agreement with Inter-Actief for this purpose.

1.7. Explanation of Legal Grounds

The next chapters will give a full overview of all data processing activities of Inter-Actief. A (short) description will be given for each processing activity, as well as one (or more) legal grounds (a, b, c, d, e of f) on which the data processing activity is grounded. These legal grounds originate from the GDPR, Article 6¹. Below follows a short overview of these legal grounds.

a. the person concerned has given permission for the processing of their personal details for one or more specific purposes;
It is allowed to process personal details if the person concerned has given permission for it. This legal ground is used by Inter-Actief to account for the processing if the other legal grounds do not apply.

b. the processing is necessary for the execution of an agreement in which the person concerned is a party, or to take measures on request of the person concerned before the agreement is completed;
This legal ground means that Inter-Actief is allowed to process personal details if this is necessary for an agreement. This can for example be the membership agreement or the direct debit agreement.

c. the processing is necessary to comply with a legal obligation of the processing party.
It is forbidden to break the law. Because of this Inter-Actief will process personal details if this is demanded by the law.

d. the processing is necessary to protect the vital interests of the person concerned or of another natural person;
If the life of a member or other persons are at risk, it is allowed to process personal details for the benefit of help. This legal ground is not used by Inter-Actief.

e. –
(This legal ground is meant for government agencies, therefore it can never be used by Inter-Actief.)

f. the processing is necessary for the representation of legitimate interests of the processing party or of a third party, except for when the interests or the fundamental rights and freedoms of the person concerned that relate to the protection of personal data, outweigh those interests, especially when the person concerned is a child.
This is the most complicated legal ground and also the legal ground that Inter-Actief uses the most to justify the processing. This legal ground means that Inter-Actief can process personal details if the interests of Inter-Actief outweigh the interest of the person concerned. If for example a member is not disadvantaged by the use of their student number, and Inter-Actief for example gets a large financial benefit from the use, then Inter-Actief is allowed to process the personal details. Inter-Actief has to stop the processing if the person concerned can demonstrate that the interests of the person outweigh those of Inter-Actief.

2.1 Membership administration

2.1.1 Full name, including initials

Legal Ground b, minimal execution membership agreement
To be able to successfully correspond with our members, as well as to avoid misunderstandings and mishaps, Inter-Actief saves the full name of her members. The name of a member is not removed when their membership ends, because it is linked to data that we have to preserve legally, or to data that describes the activism of the member. We keep the activism data for the reasons named in 2.4.2 Committees and functions.

2.1.2 Gender

Legal Ground a, voluntary participation gender participation
Within Inter-Actief the gender of a member is saved to anonymously monitor the participation of different genders in the association, and where necessary, to improve it by specific policies. Participation to this monitoring of gender participation is voluntary.

2.1.3 E-mail address

Legal Ground b, minimal execution membership agreement
The primary means of communication with members that Inter-Actief uses is e-mail. Invitations to General Member Meetings are, and membership information is shared using this channel.

Legal Ground a, information mailings and side activities
Furthermore, this means of communication is used for communication to members that they have explicitly given permission for.

Legal Ground f, important communication
Lastly, this means of communication is used for communication for which the interest of the association is so big that communication to the members is necessary.

2.1.4 Address, postal code, city and country of residence

Legal Ground b, minimal execution membership agreement
In the case that the primary correspondence mail address is unavailable, Inter-Actief uses the mailing address of the members. The mailing address is therefore saved by Inter-Actief.

Legal Ground a, receive association magazine
The postal address is also used to send the association magazine to, if a person has given explicit permission for this.

2.1.5 Telephone Number

Legal Ground a, voluntary registration contact details
Phone numbers can be used within the association to quickly make contact between persons. Committee members have access to the telephone numbers of their fellow committee members, if these are registered. Registration of a telephone number is voluntary.

2.1.6 Date of Birth

Legal Ground c, compliance with minimum age requirements for online services
Every person that wishes to use the online services of Inter-Actief has to be at least sixteen years old, in accordance with the legal requirements. Inter-Actief uses the date of birth of a person to determine if they have reached the minimum required age.

Legal Ground f, compliance with alcohol regulations
At activities of Inter-Actief where alcoholic consumptions are being sold to its members, it is forbidden to sell these consumptions to members that are under 18 years old. To clarify which members are underage, Inter-Actief maintains a list of birthdays of these members.

Legal ground a, birthday-related activities Inter-Actief also sends a birthday message to her members if the member has given permission for this. The birthday of the member is also published on the website of Inter-Actief for other logged in members and around the association room, if the member has given permission to do so.

2.1.7 Photograph

Legal Ground a, underage-list, profile pictures on website and publication in year books
As a tool for organizers and supporting members, a list with names and pictures of underage members is maintained. Furthermore, the pictures of our members are used by the board as a tool to identify people. Pictures of members can also be published in yearbooks, if the member has given permission for this.

2.1.8 Preferred Language

Legal Ground f, communication with registered people
For communication with people, Inter-Actief makes use of various means, under which her website and e-mails. This communication is preferably done in the preferred language of the person, to avoid having to send each communication in two languages. The preferred language is therefore saved by the association.

2.1.9 Internationality

Legal Ground a, voluntary registration internationality
Inter-Actief saves if a member has an international background, to anonymously monitor the participation of international members in the association, and where necessary, improve it by specific policies. Registration of the internationality is voluntary.

2.1.10 E-mail address parent(s)/guardian(s)

Legal Ground a, invitation to parents’ day
The e-mail address of the parent(s)/guardian(s) is used to invite them to the yearly parents’ day that Inter-Actief organizes for the first-year students and their parents. After filling in the details the parent(s)/guardian(s) are contacted to ask for their permission to process these details further. The details are removed if the parents’ day has occurred or if the parent(s)/guardian(s) object to the storage of their personal details.

2.1.11 Address, postal code, city and country of residence of parent(s)/guardian(s)

Legal Ground a, invitation to parents’ day
The address details of the parent(s)/guardian(s) are used to invite them to the yearly parents’ day that Inter-Actief organizes for the first-year students and their parents. After filling in the details the parent(s)/guardian(s) are contacted to ask for their permission to process these details further. The details are removed if the parents’ day has occurred or if the parent(s)/guardian(s) object to the storage of their personal details.

2.1.12 Shell

Legal Ground a, personalization of computer systems
It is possible for members to (remotely or not) log in to one or multiple computer systems belonging to the association. With this preference the members can indicate which command line interface they want to use on these systems.

2.1.13 Webmaster

Legal Ground a, responsibility for committee website(s)
Some committees of Inter-Actief have their own website that is managed by the committee. This preference is used to mark specific persons as the webmaster of a committee website, so that the association knows who is responsible for these websites.

2.1.14 Memberships

Legal Ground b, minimal execution membership agreement
Membership details of a specific member are necessary to keep track of by Inter-Actief for the correct general and financial handling of the membership agreement.

2.1.15 Notes

Legal Ground f, track special data
In some cases it is convenient that extra comments are saved about members. For example, the comment that someone’s e-mail address is not working or that a donor contribution is established.

2.2 Student Administration

2.2.1 Student number

Legal Ground f, minimal operation of the website of Inter-Actief
On the website of Inter-Actief a student number can be used to log in to the website. Inter-Actief also uses the student number to acquire grants from the university (see 3.1.1 Transfer to Faculty) and to prolong the study long memberships.

2.2.2 Study Periods

Legal Ground f, profiling based on studies
Inter-Actief sends various mails to her members and uses profiling based on, among other things, your study/studies. For this, Inter-Actief saves your study periods. A study period concerns one study, starting a master means starting a new study period.

2.2.3 Do-group

Legal Ground f, profiling based on do-group
Inter-Actief sends various mails to her members and uses profiling based on, among other things, your do-group, if the member has given permission for it. For this, Inter-Actief saves your do-group. These messages are for example invitations to a do-group lunch.

2.3 Employee Administration

2.3.1 Employee Number

Legal Ground f, minimal operation of the website of Inter-Actief
On the website of Inter-Actief an employee number can be used to log in to the website.

2.4 Active Members Administration

2.4.1 Account Name

Legal Ground a, explicit permission active members
This account name is based on the full name of the active member and can be used to log in to the website and other services of Inter-Actief. Explicit permission for the establishment of the account name is granted in accordance with paragraph 3.2.

2.4.2 Committees and Functions

Legal Ground a, explicit permission when joining committee
Active members are a member of one or more committees within Inter-Actief in which functions are assigned to members. Seeing that a number of these functions correspond with a certain responsibility with regard to other members of the association, it is of importance that these are registered in the active members administration. The member grants permission for the processing of these details when they join a committee in accordance with paragraph 3.2. The committees and functions of a member are also saved if the membership of the member ends. This is done to thank the members for their work in the committee, and to keep a record of the old members of ongoing or yearly committees.

2.5 Payment Administration

2.5.1 IBAN and BIC

Legal Ground b, minimal execution debt collection agreement
When a member gives Inter-Actief permission to perform automatic debt collections, Inter-Actief will save the IBAN and BIC of that member.

2.5.2 Authorization(s) and Amendment(s)

Legal Ground b, minimal execution debt collection agreement
Next to the physical signed authorization in the binder, Inter-Actief saves a reference to this authorization digitally. The starting date and possibly the end date of the authorization is also saved. Amendments (changes to the authorizations) are also saved. These are corrections to an authorization (like a change in bank account number or correction of a name). These are saved because amendments need to be sent to the bank with the next debt collection. Authorizations and amendments are saved for up to 14 months after the last use, or after the termination of the membership, for the self-interest of the association. This is because objections to debt collections can be made up to 14 months after the collection has taken place.

2.5.3 Debt Collection(s), Debt Collection Instruction(s) and Reversals

Legal Ground b, minimal execution debt collection agreement
To execute debt collections and keep track of our financial administration, Inter-Actief saves all debt collections, debt collection instruction(s) (entries in a debt collection), and reversals of transactions, in our database. These details are necessary for the correct financial settlement of our debt collection agreement. The executed debt collections, their instructions and the reversals are saved in our database for 7 years after execution, because this is required by the Dutch law³. See also 3.3.5 Storage of Purchase Data of (Former) Members.

2.5.4 Members’ Preferences

Legal Ground a, application of members’ preferences
For applying and performing actions based on members’ preferences, the preferences of members are saved. Based on these preferences, it is determined whether, for example, e-mails are sent to members or the association magazine is sent to members. Also see 2.1.3 E-mail address, 2.1.4 Address, postal code, city and country of residence and 2.1.6 Date of Birth.

3.1 Financial interests Inter-Actief

3.1.1 Transfer to Faculty

Legal Ground f, obtaining grants
Every year Inter-Actief receives a grant from the faculty EEMCS per member that follows one of our primary studies. To determine for how many members Inter-Actief will receive this grant, the faculty requests a list of our members and their student numbers. For this, the student numbers of our members are transferred to the faculty every year.

3.1.2 Sending/Executing Debt Collections

Legal Ground b, execution debt collection agreement
For members that have given permission to collect their incurred costs at Inter-Actief with a direct debit, Inter-Actief will send direct debit e-mails to these members. The last name, the direct debit reference, the IBAN, the BIC, and the date of signing are sent to the bank that Inter-Actief does business with.

3.1.3 Sending Invoices

Legal Ground b, sending invoices
If a purchase is made at Inter-Actief, and the member has not given permission to collect the incurred costs via a direct debit, Inter-Actief will send the member an invoice with the name and address of the member on it.

3.1.4 Transfer to Overleg Studieverenigingen

Legal Ground f, obtaining grants and scholarships
Inter-Actief sometimes qualifies for grants and scholarships that are issued through the Overleg Studieverenigingen (Organisation of Study associations / OS). These are, for example, grants for participants of the study tour, or scholarships for committee members. For this, the OS sometimes requires personal details of the members that are involved with these activities, to verify that we are actually qualified. In most cases this concerns the names and student numbers of the participants or members. These details will therefore be shared with the Overleg Studieverenigingen.

3.1.5 Transfer to Exact

Legal Ground f, keeping digital financial accounts
Inter-Actief keeps its accounts in Exact Online. In case members make declarations or receive invoices, the first and last names and bank account numbers of these members will be stored in Exact Online. The declarations and invoices themselves will also be stored, including the personal data stated therein. For the benefit of the financial administration, the names of the committees on whose behalf the declarants declare their expenses are recorded in the declarations.

3.2 Board and Committee Work

Every member that voluntarily decides to join a committee grants permission to process their personal details for the purposes of that committee, described in paragraphs 2.1, 2.4, 3.2, 3.3, 3.5, 3.6, 3.7 and 3.9.

3.2.1 Publication of Name and Function of Committee Members

Legal Ground f, announcing committee members
To thank the committee members and increase their recognizability, the names and corresponding functions are published on the website.

3.2.2 Transfer of E-mail Addresses to Google

Legal Ground f, e-mail (alias) administration
Inter-Actief has outsourced the management of the e-mail addresses and aliases of active members, committees and other groups to Google. Inter-Actief shares the e-mail addresses and names of members of these groups with Google via GSuite.

3.2.3 Transfer of Details for the Purpose of Building Passes for the Zilverling

Legal Ground a, requesting a building pass
If a member needs a building pass for the Zilverling, then Inter-Actief will request this with the security of the UT. For this request the e-mail address, name, student number and initials of the member are required. These details will be shared with the UT.

3.2.4 Publication of Name and Picture of (Former) Board Members

Legal Ground f, recognizing (former) board members
Over the years a lot of members have taken place in the board of Inter-Actief. Inter-Actief is grateful to her former boards and current board. For this reason, in combination with the preservation of the history of the association, the former boards are published on the website.

3.3 Processing of Purchases and Activities

3.3.1 Enrollment Forms for Activities

Legal Ground a, execution of activities
For some activities it is necessary to collect extra information to make sure the activity runs smoothly. This information is only used for the execution and settlement of that activity and is removed afterwards.

3.3.2 Transfer of Personal Details to Third Parties Due to the Nature of Activities

Legal Ground a and b, corresponding obligations after explicit consent of person
Because of the nature of some activities, which may or may not be based in part on the processing of personal details by third parties, in some cases personal details are shared with external parties. The personal details are only shared after explicit permission from the person concerned at the time of enrollment for the activity. The shared information is limited to the parts that are found to be strictly necessary for the concluded agreement.

3.3.3 Request participants of activities by other members

Legal Ground f, internal promotion of activities
A member of Inter-Actief can, on request at the board, see the list of names of participants that have enrolled for an activity. This is done so that the member can see if friends will be present at the activity, to better make their choice of going to the activity. This improves the promotion of activities within Inter-Actief. The information will only be shared after permission by the board, the shared information is limited to the names of the participants. The information is only available for direct inspection.

3.3.4 Publication of Pictures of Activities

Legal Ground f, internal and external promotion of activities
Pictures are made at almost all activities of Inter-Actief. The photographed people are not explicitly mentioned by name. The name of the photographer is shown with the pictures. The pictures are filtered by Inter-Actief and published publicly on the website. Pictures that contain contents that Inter-Actief does not want to show to external parties are only published internally (for logged in users) on the website. At the request of a person with a reasonable interest, a picture will be deleted from the website.

3.3.5 Storage of Purchase Data of (Former) Members

Legal Ground c, retention of financial records
The tax authorities requires associations to keep their financial administration for 7 years according to the fiscal retention³. At Inter-Actief this includes, among other things, the membership fees, purchases in the cookie corner, purchases during drinks, enrollment costs for activities and debt collections that were issued.

3.3.6 Transfer of RFID-codes and Student and/or Employee Numbers to Alexia

Legal Ground f, postpay on drinks
If a member of Inter-Actief has signed a consumption authorization with regard to collecting expenses at drinks, then these purchases need to be registered so that the incurred costs can be collected at a later date. For this purpose we use an internally developed system called Alexia. To register the purchases in this system we share the RFID-codes and student or employee numbers of the member with this application. The details of the data processing of this system are handled further in the privacy document of this application.

3.4 The Goals of Inter-Actief

3.4.1 Acquisition and Storage of a Name When Filing Complaint

Legal Ground f, complaints database
The members of Inter-Actief that have a complaint about the education can submit it via the website of Inter-Actief. To respond to the complaint later it is necessary that the name of the complainant is saved.

3.5 Meetings

3.5.1 Acquisition and Storage of Name in the Context of GMM and BM Authorizations and Absence

Legal Ground c, keeping of authorizations
If a member submits a notice of absence for a meeting within Inter-Actief, or authorizes someone else for that meeting, then Inter-Actief is legally required to save these absences and authorizations.

3.5.2 Storage and Publication of Names in GMM, BM, and Committee Minutes

Legal Ground c and f, keeping of minutes
Minutes are kept of important meetings at Inter-Actief. At some meetings this is legally required (the General Members Meeting and Board Meetings), and at other meetings this is desirable. These minutes are shared with all or a part of the members of Inter-Actief. The names of the attendees of these meetings will be published in these minutes.

3.6 Collection of Personal Details by Committees

3.6.1 Acquisition, Storage and Publication of Name and Picture of People who Write for Association Publications

Legal Ground a, explicit permission of authors of association publications
The name and picture of people who write for the various association publications are registered and, in some cases, published. Inter-Actief does this to both acknowledge the authors of the written pieces publicly, as well as to create a nice graphic layout.

3.7 Legal Requirements

3.7.1 Transfer of Details to the Municipality of Enschede in the Context of the Catering Permit

Legal Ground c, maintaining catering permit
The sale of (alcoholic) consumptions during drinks of Inter-Actief falls under the catering permit of the UT. For this permit the name and date of birth of all of the active bartenders that tend in our catering facilities need to be known to the Municipality of Enschede. The date of birth, first and last name of the bartenders are shared with the Overleg Studieverenigingen (OS). The OS subsequently shares this data with the Municipality of Enschede.

3.8 Honorary Members and Members of Merit

3.8.1 Publication of Names of Honorary Members and Reasons of Honorary Memberships

Legal Ground f, ‘honoring’ honorary members
The names of the honorary members of Inter-Actief are publicly published on the website in combination with a description why the member became an honorary member. Inter-Actief does this to remember her honorary members.

3.8.2 Publication of Names of Members of Merit and Description of Merits

Legal Ground f, ‘honoring’ members of merit
The names of the members of merit of Inter-Actief are publicly published on the website in combination with a description why the member became a member of merit. Inter-Actief does this to remember her members of merit.

3.9 Other

3.9.1 Storage of personal details that were stored before the original date that this document came into effect (31-10-2019) in committee and/or association documents

Legal Ground f, existing archives
(Far) before the AVG went into effect Inter-Actief stored all personal details that are used by committees. These personal details are (digitally) present on the committee drives of the corresponding committees. These documents were created before the AVG came into effect and are only used as reference documents. Because of the legality principle it is allowed to keep these documents unchanged. Next to that, it is a huge amount of work to anonymize all of these documents, so Inter-Actief will keep these documents as they are. Examples of this are secretarial yearly reports, documents for study trips and old almanacs.

3.9.2 Sending Members Database Checkup E-mails

Legal Ground f, yearly checkup of personal details
When the memberships are prolonged, members are sent a membership database checkup e-mail. In these e-mails members are requested to check the personal details that are known to Inter-Actief for mistakes. These mistakes might be caused by becoming out-of-date or by mistakes in the database. To guarantee correctness of the personal details of all members, and to facilitate the right to rectification, this yearly procedure is desired.

3.10 Digital Facilities, Inter-Actief Website and Applications

3.10.1 Inter-Actief API

Legal Ground a, decentralized processing of personal details
Inter-Actief offers an application programming interface. Using this interface, applications can gain access to the personal details of a person saved in the systems of the association. Permission for the processing of these personal details by the applications is given explicitly by the person, by using the application. This permission can always be immediately revoked via the website of the association.

3.10.2 Inter-Actief Wiki

Legal Ground f, association documentation
Documentation about the processes within the association is saved on the wiki of Inter-Actief. The names of the authors of pages and changes to these pages are saved in the change logs of each page on the wiki.

3.10.3 Processing Logs

Legal Ground f, error recovery and privacy assurance
A log is kept for various events that occur in the systems of Inter-Actief. These logs might contain personal details. These logs are used to retrieve previous versions of, among other things, pages, documents or other fields in the case of erroneous or incorrect data. The logs are also used as a documentation of the operations on, or processing of a certain object.

3.10.4 Error Logs

Legal Ground f, error recovery and fixing bugs in software
Many of our computer systems and applications keep error logs, in which details about error messages or problems is saved. These logs might contain personal details. The logs are used to track down errors or problems in our systems and repair them.

3.10.5 Repositories of Programming Code and Documentation

Legal Ground a, explicit permission of person
It is possible for active members to upload code repositories to the version control system of Inter-Actief. These repositories could be a part of a committee, or belong to a personal account. By uploading a repository, explicit permission is given to process the data stored in this repository.

3.10.6 Backups of Personal Files and Association Files

Legal Ground f, (emergency) recovery of computer systems and data
Inter-Actief makes regular backups of all files, databases, and other data stored on our computer systems. These backups might contain personal details. The backups are made to retrieve and revert the data in the event of an emergency. These backups are shared encrypted with Backblaze (https://www.backblaze.com), and are stored in Europe. Inter-Actief has concluded a processing agreement with Backblaze for this processing of data. Backups of files are kept for up to one year.

3.10.7 Committee Application(s)

Legal Ground a, explicit permission of person
Some committees of Inter-Actief manage their own application or website that processes member details for the execution of their purpose. One example of this is the “SymposIA” application managed by the Symposium Committee, which helps the committee with the organization of the symposium. While doing this, personal details might be processed. A person gives these application(s) explicit permission to process their personal details when the person logs into the application(s) for the first time, or when the person uses the application(s) for the first time.

1 General Data Protection Regulation, REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. - last visited on 10-10-2018 - https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN

2 Uitvoeringswet Algemene verordening gegevensbescherming - last visited on 10-10-2018 - http://wetten.overheid.nl/BWBR0040940/2018-05-25

3 Fiscale Bewaarplicht Belastingdienst - last visited on 10-10-2018 - https://www.belastingdienst.nl/wps/wcm/connect/bldcontentnl/belastingdienst/zakelijk/ondernemen/administratie/administratie_opzetten/hoe_lang_moet_u_uw_administratie_bewaren