EHRI-ERIC Data and Privacy Policy Statement 

EHRI-ERIC is committed to the privacy of the users of our websites and we make every effort to safeguard the information collected on our websites. EHRI-ERIC is aware of its responsibility when processing personal data. EHRI-ERIC wants every person whose personal data it processes to be confident that this is done in a careful and lawful manner. EHRI-ERIC only processes your personal data if there is a legitimate basis for doing so. EHRI-ERIC processes personal data in accordance with the General Data Protection Regulation (GDPR) and the privacy rules arising from it. This Data and Privacy Policy Statement explains which personal data are collected by EHRI-ERIC, how these data are processed and for what purpose.

Please read the following information carefully before using this website. By accessing or using this website, you agree to accept this Data and Privacy Policy Statement. If you do not agree with any of the terms below, do not access or otherwise use this website.

EHRI-ERIC Privacy Policy Statement 

Data from users of this website and its services 

In order to use a number of the features of our websites, EHRI-ERIC requires certain personal data from you such as your name, address, email and professional affiliation. These personal data are provided by you voluntarily and will be treated with care. EHRI-ERIC only processes personal data if this is necessary for a specific purpose. The purpose determines which personal data may be processed and no more data will be asked for than is essential for that purpose.

For certain categories of website users, a set of personal data is kept, including pages consulted, address data for mailing lists and contact databases. This is necessary to enable the website to operate properly. Certain data are required for statistical purposes and are anonymized. The use of individual personal data is restricted to the purpose for which they were collected and of which the provider thereof is aware. Such data will not be communicated to third parties unless EHRI-ERIC has a legal obligation or basis to do so as referred to in Article 6 of the GDPR.

When EHRI-ERIC discloses your data to a third party, it will safeguard your rights to privacy, among other things if applicable, by concluding a processing agreement in which arrangements are made as to how your personal data can be processed.

Users who register on the EHRI Portal and create a profile agree that the personal information they provide about themselves can be made available to other registered EHRI Portal users and that their name will be published on the EHRI Portal if they author public content. Registered users are contactable by other registered users and they may receive communications from such users at the email address provided. However, the email address of the recipient of such a communication will not be disclosed to the initiator of the contact and vice versa. Registered users may opt out from being contactable by updating their personal profile preferences.

EHRI-ERIC may furthermore process one or more of your personal details for the following purposes (depending on the activities that apply to you):

  • to help you and inform you regarding specific research and/or collection issues;
  • to communicate with you via email;
  • to improve our website.

Except for the cases listed above, EHRI-ERIC will not pass on any data of registered users to third parties unless required to by law. If EHRI-ERIC processes personal data on the basis of your consent, you have the opportunity to withdraw your consent at any time. From that moment on, EHRI-ERIC will no longer process any of your personal data.

EHRI-ERIC Data Policy Statement 

Data on the EHRI Portal 

This database may contain special categories of Personal Data and Personal Data regarding criminal convictions or offences which, according to European and Dutch data protection regulations, can be processed for research purposes only (Articles 9 and 10 of the GDPR).

Special categories of Personal Data are any data related to an identified or identifiable person related to a person’s religion or belief, race, political opinion, health, sexual life, and trade union membership.

The EHRI Portal contains descriptions of Holocaust-related collections and sources kept in collection holding institutions (archives, documentation centres). These collection descriptions may include special categories of Personal Data and Personal Data pertaining to criminal convictions or offences. Since the processing and publication of these data may have implications from the perspective of data protection, EHRI has conducted a risk assessment to determine whether these data can be accessed via the EHRI Portal and the websites of EHRI. EHRI has decided that, taking into account European (GDPR) and national personal data protection regulations, the nature of the collection descriptions, archival practice and the privacy policies of the collection holding institutions, publishing these collection descriptions (and not the collections themselves) does not constitute a major data protection risk. As a consequence, access to collection descriptions and related information on the EHRI Portal is open to all users.

Under Articles 9 and 10 of the GDPR, special categories of Personal Data and Personal Data regarding criminal convictions or offences can only be processed for research purposes. Responsibility for compliance with the European and Dutch personal data protection regulations lies with the person ultimately publishing the data. When research results are published in a country other than the Netherlands, the personal data protection act of that country must be complied with. Where research results are published in a country other than those bound by the GDPR, the personal data protection act of that country must be complied with. Since the data on the EHRI Portal only concerns collection descriptions (and not the collections themselves), it is necessary to visit the collection holding institution that holds the records to access them. It is quite likely that this institution will have its own data protection policy regarding access to the sources and privacy protection. Users must comply with these specific procedures and cannot invoke the fact that they found a collection description on the EHRI Portal to gain access to the archived document itself.

If you consider you have well-founded grounds - based on the GDPR and/or Dutch personal data protection regulation - against the publication of a specific set of personal data on the EHRI Portal, you may send a letter or an email, indicating your interest and explaining your reasons for objecting to publication to the party responsible for processing the personal data. This party will examine your complaint and provide you with an answer within a reasonable space of time.

Cookies 

EHRI-ERIC does not use cookies for tracking purposes but to enable website functionality. The following cookies are used:

On the EHRI Portal (https://portal.ehri-project.eu/):

  • a session cookie
  • a cookie preserving user preferences between visits
  • a cookie recording the user's acceptance of the EHRI data policy where applicable

On the EHRI Document Blog (https://blog.ehri-project.eu/):

  • a cookie preserving language preferences

On the EHRI Digital Edition sites:

  • a session cookie

On the EHRI Geospatial Repository (https://geodata.ehri-project.eu/):

  • a session cookie
  • two cookies for managing the appropriate expiry of a user’s session
  • a cookie for validating cross-site requests against forgery

Exercising Rights 

Exercising your privacy rights and complaints procedure 

You can submit a request to EHRI to exercise the following rights:

  • right to access your personal data
  • right to rectify and/or add to your personal data
  • right to erasure of your personal data
  • right to restrict the processing of your personal data
  • right to object
  • right not to be subjected to a decision based exclusively on automated processing, including profiling

The party responsible for processing personal data as defined by the GDPR and the Dutch personal data protection regulation is EHRI-ERIC. Duly justified and substantiated complaints should be sent to privacy@ehri-project.eu or to EHRI-ERIC’s postal address (addressed to its Director).

Personal Data Authority 

EHRI-ERIC will work with you to find a solution if you have a complaint regarding the processing of your personal data. If this does not lead to a satisfactory result, you have the right under the GDPR to submit a complaint to the Dutch Personal Data Authority.

Changes to this Data and Privacy Statement 

EHRI-ERIC may change this Data and Privacy Statement. Any changes will be published on EHRI-ERIC website(s). Changes made to this Data and Privacy Statement will never be in violation of the GDPR and the data and privacy rules arising from it.

Entry into force 

This Data and Privacy Statement entered into force on 20/02/2025.