Privacy Statement

(Zie hier voor de Nederlandse versie van dit document)

Great that you are looking at the privacy statement for the XR Innovation Forum (XRIF)! In this privacy statement, we explain in detail that we will handle your personal data with care and in full compliance with the law. SURF is the ICT cooperation organisation of education and research in the Netherlands, a non-profit organisation. We will therefore not use your data for advertising, reselling them to third parties or other unpleasant practices that could invade your privacy.

If you would like to know more, please read this privacy statement on how SURF handles your personal data in the context of using the XR Innovation Forum, a pilot of SURF. This privacy statement only applies to the Discourse instance at xrif.surf.nl.

About SURF

We are SURF B.V. (“SURF”), located at Moreelsepark 48, 3511 EP Utrecht. We can be reached at +31-887873000. In the SURF cooperative, the Dutch universities, universities of applied sciences, university medical centres, research institutes and mbo institutes work together on ICT innovation. More about the cooperative. SURF is the data controller for the processing operations we describe in this privacy statement.

What is the XR Innovation Forum?

The XR Innovation Forum is an online discussion platform around (technical) developments and innovation related to eXtended Reality (XR) for education and research. It is a place where anyone from the SURF community with an interest in XR, or expertise in that area, can interact with others in terms of content.

The primary purpose of the XR Innovation Forum is to facilitate knowledge exchange and discussions in the field of XR innovation, particularly in the technical field. The forum is publicly available for everyone to read, even if you as do not have an account or are not logged in. If you want to contribute to the forum, you need an account and must log in.

The forum is based on the Discourse forum software. The forum is hosted by Communiteq, a Dutch company. The hosting of the forum is done entirely in The Netherlands, including all necessary sub-processing and storing backups.

What is Discourse?

Discourse is forum software developed by the company CDCK. Discourse is widely used for online (tech-focused) communities. It is available as open-source and this is also the version used by SURF for the XR Innovation Forum.

What data do we process and for what purpose?

The XR Innovation Forum provides users with a platform to interact in the field of XR innovation as a community. For this, SURF processes, among other things, the user’s e-mail address (as passed on from SURFconext). Below we describe the different types of data processed and for what purpose.

Basic account information

If you want to use the XR Innovation Forum, you first need to log in with your own institutional account, via SURFconext. When you log in for the first time, we ask you to enter a username of your choice, which is used to create your account.

Then, each time you log in, the following data are shared from your institution with the XR Innovation Forum:

  • Your e-mail address. This is used to create the link between the XR Innovation Forum and SURFconext.
  • Your full name. This is used during account creation for deriving your username, plus for setting your name in your profile information.

In addition, other data are processed while using the XR Innovation Forum:

  • Pseudonymous identifier (username). This unique identifier serves to recognise each user next time, and to refer to a user in posts on the forum. When you create your account, you can choose your own user name. This can then only be changed for a limited time (7 days).
  • Your e-mail address is used to send notifications about interaction with other users, interaction with your posts and to respond to requests and questions. You can decide whether, and which, notifications you wish to receive by e-mail. Your e-mail address is not visible to others on the forum, but is visible to the administrators of the XR Innovation Forum.
  • Statistics about your visits and reading and posting behaviour. These are used by Discourse’s built-in Trust Level system to give you more permissions the more you interact with the forum. Aggregated statistics are also used to understand forum activity.

Your e-mail address and pseudonymous identifier (username) may be used to trace it back to the responsible person only in case of abuse, and only in consultation with the educational or research institution.

Additional profile information

The following data are optional and are intended to enrich your profile. You can complete this information yourself, it is not mandatory. You can also decide whether this information is publicly visible or not.

  • Display name (this is different from the chosen-once username).
  • Profile picture.
  • Biography.

A small number of statistics about your interaction with the forum are shown when you make your profile public.

Messages, media, following

On the XR Innovation Forum, you can post messages, media (such as photos) or other files that are publicly visible; you can respond to and/or like others’ posts; you can send private messages to other users (direct messages). To do this, we need to process the following data.

  • A message (a post).
  • The date and time of a message.
  • Media attachments to a message such as photos, or other types of documents.
  • Messages are optionally delivered via email, if a receiving user has set up to receive summaries of forum activity by email. This means that these messages can be delivered to servers outside SURF and copies are stored there.

Direct messages and messages for followers

  • Direct messages are messages that are shared only with the direct recipient(s). Direct messages are not completely private communications, but are non-publicly visible posts. They are therefore not end-to-end encrypted and are potentially readable by administrators of the server(s) involved.
  • Messages are optionally delivered via e-mail, if a receiving user has set up to receive summaries of forum activity by e-mail. This means that these messages may be delivered to servers outside SURF and copies are stored there.

IP addresses and other metadata

  • When you log into the XR Innovation Forum, we record the IP address from which you log in and the name of the web browser used. The data is then kept in log files for a period of 11 days, for use in case of technical failures or security tasks.
  • Of visitors to the XR Innovation Forum, including those who do not log in, the IP address is processed in the web server log files.

What do we use your data for?

Legal basis

Personal data is processed on the basis of agreement with the user. Users themselves choose to participate in the conversation on the XR Innovation Forum via this server. Users are free not to use this server, or to delete their account at any time. With the exception of the pseudonymous identifier and institutional e-mail address, users of all content at any time decide for themselves what they make available and share.
Retention period

  • Pseudonymous identifier and chosen username: as long as an account exists. An account does not disappear automatically, only when you delete it yourself.

  • Other account information that you assign to your account yourself, such as a display name, profile picture and biography: as long as an account exists and you do not modify or delete this information.

  • Messages and media you share yourself: until you delete them yourself. Posts can be indexed by search engines.

  • The last IP address from which a registered user had an existing session is retained until that session is renewed, or until you delete your account. The IP address you used during registration is also retained until you delete your account.

  • The IP address via web server logging of all requests to this server, to the extent these are kept in logs, no longer than 11 days. These are used in case of security and/or management issues.

To whom do we provide the data?

The pseudonym (immutable identity), e-mail address and IP addresses are not provided to third parties. However, these data are visible to the forum provider we use which is also the ICT supplier, and any sub-processors, to the extent necessary to provide the service.

The content you post yourself on the XR Innovation Forum is shared with the world and is publicly visible, i.e. also outside the SURF community.

Cookie use

Discourse stores cookies and other data in your browser to remember your logged-in session and to keep track of whether you have already received certain push notifications (if enabled). These are functional cookies necessary for the application to function. They are not shared with other sites. The XR Innovation Forum does not use analytical or tracking cookies.

See the cookie statement for more details.

Your rights in relation to your data

You have the following rights regarding your personal data:

  • You can request and download an archive of all your posted content, including your messages and preferences, via self-service

  • You can request that your data be amended, supplemented or deleted if it is incorrect or no longer relevant. In many cases, you can already change some of this yourself in your profile or account settings.

  • You can submit a request to inspect the data we process about you.

  • You can request the restriction of the processing of your data in respect of the processing of data to which you have objected, which you consider to be unlawful, the accuracy of which you have disputed, or when we no longer need the personal data, but you need them in the context of legal proceedings.

  • You can request an overview, in a structured and common form, of the data we process about you and you have the right to transfer this data to another service provider.

  • If you believe that SURF is not handling your personal data properly, you can submit a complaint to SURF. This can be done with the data protection officer, who can be reached by email at fg@surf.nl. However, if you and SURF cannot work things out together and SURF’s response to your complaint does not lead to an acceptable outcome, you have the right to submit a complaint about SURF to the Netherlands Authority for Personal Data (Autoriteit Persoonsgegevens). More information on the Personal Data Authority and how to file complaints can be found at https://www.autoriteitpersoonsgegevens.nl.

To exercise these rights, please contact SURF at avg@surf.nl.

Amendments to the privacy statement

SURF may make amendments to this privacy statement. You are therefore advised to consult this privacy statement regularly.

Contact details

SURF B.V.
Moreelsepark 48
3511 EP Utrecht
+31-887873000
xr@surf.nl

This privacy statement was last updated 26 februari 2024