EHRI Data and Privacy Policy

EHRI is committed to the privacy of the users of our websites and we make every effort to safeguard the information collected on this website. EHRI is aware of its responsibility when processing personal data. EHRI wants every person whose personal data it processes to be confident that this is done in a careful and lawful manner. EHRI only processes your personal data if there is a legitimate basis for doing so. EHRI processes personal data in accordance with the General Data Protection Regulation (GDPR) and the privacy rules arising from it. This Policy explains which personal data are collected by EHRI, how these data are processed and for what purpose.

Please read the following information carefully before using this website. By accessing or using this website, you agree to accept this EHRI Privacy and Data Policy. If you do not agree with any of the terms below, do not access or otherwise use this website.

EHRI Privacy Policy

Data from users of this website and its services

In order to use a number of the features of the EHRI websites, EHRI requires certain personal data from you such as your name, address, email and professional affiliation. These personal data are provided by you voluntarily and will be treated with care. EHRI only processes personal data if this is necessary for a specific purpose. The purpose determines which personal data have to be processed and no more data will be asked for than is essential for that purpose.

For certain categories of website users, a set of personal data is kept, including pages consulted, address data for mailing lists and contact databases. This is necessary to enable the website to operate properly. Certain data are required for statistical purposes and are anonymized. The use of individual personal data is restricted to the purpose for which they were collected and of which the provider thereof is aware). Such data will not be communicated to third parties unless EHRI has a legal obligation or basis to do so as referred to in article 6 GDPR.

When EHRI discloses your data to a third party, it will safeguard your rights to privacy, among other things if applicable by concluding a processing agreement in which arrangements are made as to how your personal data must be dealt with.

Users who register on the EHRI Portal and create a profile agree that the personal information they provide about themselves can be made available to other registered portal users and that their name will be published on the portal if they author public content. Registered users are contactable by other registered users and they may receive communications from such users to the email address provided. However, the email address of the recipient of such a communication will not be disclosed to the initiator of the contact and vice versa. Registered users may further opt-out from being contactable by updating their personal profile preferences.

EHRI can furthermore process one or more of your personal details for the following purposes (depending on the activities that apply to you):

Except for the cases listed above, EHRI will not pass on any data of registered users to third parties unless required to by law. If EHRI processes personal data on the basis of your consent, you have the opportunity to withdraw your consent at any time. From that moment on, EHRI will no longer process any of your personal data.

EHRI Data Policy

Data on the research portal

This database might contain special categories of Personal Data and Personal Data regarding to criminal convictions or offences which according to European and Dutch data protection regulations can be used for research purposes only (article 9, 10 GDPR).

Special categories of Personal Data is any data related to an identified or identifiable person related to a persons religion or belief, race, political opinion, health, sexual life, and trade union membership.

The research portal contains descriptions of Holocaust-related collections and sources kept in collection-holding institutions (archives, documentation centers) in Europe, the USA and Israel. These collection descriptions may include special categories of Personal Data and Personal Data regarding to criminal convictions or offences. Since the processing and publication of these data may have implications from the perspective of data protection, EHRI has conducted a risk assessment to determine whether these data can be accessed via the research portal and the websites of EHRI. EHRI decided that, taking into account European (GDPR) and national personal data protection regulations, the nature of the collection descriptions, archival practice and the privacy policies of the collection-holding institutions, publishing these collection descriptions (and not the collections itself) does not constitute a major data protection risk. As a consequence, access to the collection descriptions and all the other information on the research portal is open to users.

Under article 9 and 10 GDPR, special categories of Personal Data and Personal Data regarding to criminal convictions or offences can only be used for research purposes. Responsibility for compliance with the European and Dutch personal data protection regulations lies with the person ultimately publishing the data. When research results are published in a country other than the Netherlands, the personal data protection act of that country must be complied with. Where research results are published in a country other than bound by the GDPR, the personal data protection act of that country must be complied with. Since the data on the research portal only involve descriptions of collections (and not the collections itself), a visit to the archive storing the records is necessary to actually access the documents. It is quite likely that this institution will have its own data protection policy regarding access to the sources and privacy protection: this is explained in the detailed version of the country reports. Users have to comply with these specific procedures and cannot invoke the fact that they found a collection description on the EHRI research portal to gain access to the archived document itself.

If you consider you have well-founded grounds - based on the GDPR and/or Dutch personal data protection regulation - against the publication of a specific set of personal data on the research portal, you may send a letter or an email, indicating your interest and explaining your reasons for objecting to publication, to the party responsible for processing the personal data. This party will examine your complaint and provide you with an answer within a reasonable space of time.

Cookies

EHRI does not use cookies for tracking purposes but to enable website functionality the following cookies are used:

On the EHRI portal (https://portal.ehri-project-stage.eu/):

On the EHRI Document Blog (https://blog.ehri-project.eu):

On the EHRI Digital Edition sites:

Exercising Rights

Exercising your privacy rights and complaints procedure

You can submit a request to EHRI to exercise the following rights:

The party responsible for processing the personal data in the sense of the GDPR and Dutch personal data protection regulation is NIOD. Duly justified and substantiated complaints should be sent to privacy@ehri-project.eu or to NIODs postal address (addressed to its Director).

Should you have any questions and/or complaints about the safeguarding of your privacy within EHRI, please contact our Data Protection Officer (DPO):

Name: Joëlle Versluis

Telephone/email: +31 (0)20 551 0736 / +31 6 1565 7366 / fg@knaw.nl

Personal Data Authority

EHRI will work with you to find a solution if you have a complaint regarding the processing of your personal data. If this does not lead to a satisfactory result, you have the right under the GDPR to submit a complaint to the Personal Data Authority.

Changes to this privacy statement

EHRI may change this privacy statement. Any changes will be published on EHRIs website. Changes made to this privacy statement will never be in violation of the GDPR and the privacy rules arising from it.

Entry into force

This privacy statement entered into force on 12-12-2018.