Within IAPC a file of all its cooperants is kept for administration. In this file personal details are stored of cooperants and other contacts.
For cooperants these details consist of: name, initials, last name prefix, last name, address, postal code, place, province, and country of residence, phone number, email address and login tokens. For contacts these details consist of: name, initials, last name prefix, name, address, postal code, place of residence, province, country, phone number, email address and website. Cooperants and contacts can both be part of committees, which is also stored in the same system.
IAPC keeps track of the following data in the copro-file:
The aim of keeping track of this data is for the fulfilment of the following goals:
For the data in the cooperant file a storage term of two years (after last activity) is used. Exceptions due to historical reasons are:
With login credentials cooperants are able to login at the webservices of IAPC. The board of IAPC is responsible for the processing of personal data in the cooperant file, they are supported by the authorised members of the committee “Beheer / Syscom”.
Every cooperant can get insight to the data kept on them by logging in with their login credentials on the website. Contacts can ask for insight from the board of IAPC.
Both contacts as cooperants can ask for removal of their personal data from the cooperant file at the board of IAPC. All data which has to kept stored due to legal reasons, will only be removed after this legal term
Personal information is stored and processed at the IAPC. In the first place, the board is tasked with the correct handling of said personal information.
Beside the IAPC board, the IAPC also has cooperants. The board expects of cooperants to act accordingly to the personal information stored and processed at the IAPC. If they do not, they damage the person that owns or is described by the data, and by extension, the IAPC. If a cooperant is found to handle information without care, the board reserves the right to impose sanctions, within reason.
The IAPC processes different kinds of personal data and saves these in different places. More information can be found in four different privacy policies. The privacy policies are about the processing of personal information:
Active cooperants are assumed to have read these privacy policies. Before joining IAPC, potential cooperants are pointed to said privacy policies by the board. Correct handling of personal information means that cooperants follow these privacy policies when they are active within IAPC.
Some committees within the IAPC have significantly easier access to a large amount of personal information. This means the risk of not following the privacy policies is higher than for a cooperant outside of these committees. Also the impact when privacy policies are not followed can be higher than normal. The board is aware of these heightened risks and tells this clearly to committee members. Committees with a heightened risk are:
If a cooperant finds out about a data leak, or suspects one, they should mention this to the board immediately. The board can decide to forward this information to the department of Library, ICT-services & Archive (LISA) of the University of Twente, and/or the Dutch data protection authority (Autoriteit Persoonsgegevens, AP).
