CAIT Privacy Statement
Effective date: 8 August 2026
1. Introduction and Scope
The Community Archive for Integrated Teaching, referred to in the present document as "CAIT", "the Platform", or "the Service", is an academic web service that allows educators to share, browse, adapt, and collaborate on Open Educational Resources, including lecture notes, slides, assignments, exam questions, and similar teaching materials. The present Privacy Statement explains which categories of personal data are processed in connection with the Platform, the purposes and legal bases of such processing, the parties with whom data may be shared, the periods for which data is retained, and the rights available to you as a data subject. Processing of personal data through the Platform is governed by Regulation (EU) 2016/679, the General Data Protection Regulation, hereinafter the "GDPR", and by the Dutch implementing legislation, the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG). By using the Platform, you accept the conditions relating to the processing of personal data set out on this page.
2. Identity and Contact Details of the Controller
Responsibility for the processing described herein rests with Technische Universiteit Delft, a legal person governed by public law (publiekrechtelijke rechtspersoon) established at Stevinweg 1, 2628 CN Delft, the Netherlands, entered in the Commercial Register of the Netherlands Chamber of Commerce under KVK number 27364265, contactable by telephone at +31 15 278 9111 and by electronic mail at info@tudelft.nl. Within that institution, the CAIT team, supported by the partner institutions associated with the project, operates the Platform and carries out the processing operations set out below; the institution accordingly acts as the data controller within the meaning of Article 4(7) of the GDPR and determines the purposes and means of that processing.
General enquiries concerning the Platform and the processing of your personal data may be addressed to the CAIT team at cait-ewi@tudelft.nl. The Data Protection Officer (Functionaris voor Gegevensbescherming) of TU Delft is reachable at fg@tudelft.nl, and the institutional privacy team may be contacted at privacy-tud@tudelft.nl. Correspondence regarding the exercise of your rights, as described in Section 11, may be directed to any of the foregoing addresses.
3. Categories of Personal Data Processed
The Platform processes several categories of personal data, depending on the manner in which you interact with the Service.
Technical and connection data: When you browse the Platform, we process your IP address and your browser agent, together with information concerning the version of your browser and the version of your operating system. Such data is recorded exclusively in the logs generated on the server side, namely by the reverse proxy, by the API gateway, and by the other backend components, and no script placed in your browser participates in its collection.
Registration and profile data: When you create an account through the SURFconext authentication procedure, we process your first name, your last name, your email address, your platform affiliation, and your institutional affiliation, together with the preference that you express as to the public display of your email address.
Content and contribution data: When you publish materials, organise them into circuits, comment, rate, save, or otherwise contribute, we process the personal data contained in or associated with those contributions, including the username under which they appear.
Usage and activity data: In order to support the operation and improvement of the Service, we process data concerning how the Platform is used, including which pages are visited and at what time, and which features are employed, such as the uploading, combining, browsing, downloading, sharing, and liking of materials. Records of that kind likewise originate from server-side logging alone, since the Platform runs no analytics script in the browser.
Authentication and session data: In order to keep you signed in, we process the signed access token and the associated refresh token that are stored on your device, the technical characteristics of which are described in Section 10 and in the Cookie Policy.
We do not deliberately collect special categories of personal data within the meaning of Article 9 of the GDPR, and you are requested to refrain from including such data within the materials or comments that you publish.
4. Purposes of Processing and Legal Bases
Each processing operation rests upon a legal basis identified in Article 6(1) of the GDPR, and is carried out solely for the purposes set out below.
Provision of the Service and account management: Processing of your registration and profile data is necessary for the performance of the agreement between you and the Provider, namely the CAIT Terms and Conditions, and rests upon Article 6(1)(b) of the GDPR. Such processing allows us to establish your account, to grant access to the Platform, to make private and unpublished materials available to authorised users, and to assign editing rights.
Attribution of authorship: In order to record the ownership of materials and to credit each resource clearly to its author or authors, your first name, your last name, and your affiliation are associated with the materials that you publish, on the basis of Article 6(1)(b) of the GDPR and, so far as the interest of the academic community in a reliable attribution is concerned, of Article 6(1)(f).
Display of your email address: Publication of your email address alongside your contributions, which serves to allow members of the community to contact one another directly, rests upon your consent within the meaning of Article 6(1)(a) of the GDPR. Consent is requested before the account is created and, for accounts opened before the introduction of that mechanism, at the next login of their holder, in the manner and with the transitional consequences described in Section 6; withdrawal is possible at any time.
Security, integrity, and debugging: Processing of your IP address and browser agent serves the safety, the security, and the technical maintenance of the Platform, including the detection and prevention of misuse and the resolution of technical faults, and rests upon Article 6(1)(f) of the GDPR.
Development and improvement: Usage and activity data is processed in order to understand how the Platform is used and to improve its features and performance, on the basis of the legitimate interest of the Provider under Article 6(1)(f) of the GDPR.
Compliance with legal obligations: Where the law requires it, your personal data may be processed in order to comply with statutory obligations to which the Provider is subject, pursuant to Article 6(1)(c) of the GDPR.
Where processing rests upon legitimate interests, a balancing assessment has been carried out to ensure that such interests are not overridden by your interests or fundamental rights, and you retain the right to object as described in Section 11.
5. Authentication through SURFconext
Access to a registered account is obtained by means of SURFconext, the federated identity service operated by SURF for Dutch educational and research organisations, through the institutional credentials issued to you by your home institution. During authentication, a limited set of attributes, namely your name, your email address, and your affiliation, is transmitted to the Platform by your institution through SURFconext. The Provider does not receive or store your institutional password. Once authentication has succeeded, a signed token of limited validity maintains your session, so that the credentials themselves need not be presented again at each request. The processing of personal data by SURF and by your home institution in the context of the federated authentication is governed by their respective privacy notices, which operate alongside the present Privacy Statement.
6. Public Visibility of Certain Personal Data
Part of the personal data associated with your account is public and may be viewed by any visitor to the Platform. Your first name, your last name, and your platform and institutional affiliation appear in connection with the materials that you publish, on your personal user page where your contributions are collected, and, in the case of your username, within discussions. Attribution of that kind is inherent in the purpose of the archive, which is to credit the authors of Open Educational Resources and to permit their work to be identified as theirs.
Your email address, by contrast, is displayed only where you have asked for it to be displayed. The choice is presented to every new user before the account is created, and it must be answered in order for registration to be completed. Users whose accounts existed before that mechanism was introduced are asked the same question at their next login; pending their answer, the configuration previously in force continues to apply, with the consequence that their email address remains visible until they indicate otherwise. Irrespective of the answer given, and irrespective of whether the question has yet been answered, the setting may be changed at any moment from the settings page of your profile.
A change of setting operates for the future and does not affect the lawfulness of the display carried out before it, in accordance with Article 7(3) of the GDPR. You should bear in mind that information which has been publicly accessible may have been consulted, copied, or indexed by third parties during the period of its visibility, and that the Provider cannot recall copies held outside the Platform. Further rights of objection and erasure remain available to you under Section 11.
7. Recipients and Processors
Personal data processed through the Platform is accessible to the members of the CAIT team who are responsible for its operation and administration, and is handled on a confidential basis. In order to deliver the Service, the Provider relies upon a limited number of third parties acting as processors within the meaning of Article 28 of the GDPR, each of which acts solely upon the documented instructions of the Provider and is bound by a data processing agreement imposing appropriate obligations of confidentiality and security.
Hosting and database infrastructure: The Platform, in its production environment as well as in its staging environment, runs on cloud servers rented from Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, and physically located in Nuremberg, Germany. The servers are of the shared-resource type, the environments and the data of the Provider being logically separated from those of other tenants of the same infrastructure. Processing by that supplier is governed by a data processing agreement concluded pursuant to Article 28 of the GDPR, to which technical and organisational measures within the meaning of Article 32 are annexed.
Federated authentication: SURF, which operates the SURFconext identity federation described in Section 5, together with your home institution, participates in the authentication process and receives the data strictly necessary for that purpose.
Outside the relationships described above, requests for new features are collected through a form made available by Google Forms, which opens in a separate window by means of a link and is not embedded within the pages of the Platform. Data that you choose to submit through that form is transmitted to the provider of the form service and is subject to the terms and the privacy notice applicable to it; the CAIT team receives the responses in order to evaluate the suggestions. Personal data is not sold, rented, or otherwise disclosed to third parties for commercial purposes. Disclosure to public authorities occurs only where required by a legal obligation or by a lawful order.
8. International Transfers of Personal Data
Personal data processed in connection with the Platform is stored and processed within the European Economic Area. The servers on which the Service operates are situated in Germany, and the data processing agreement concluded with the hosting supplier provides that the agreed processing takes place exclusively in a member state of the European Union or in another state party to the Agreement on the European Economic Area, any transfer to a third country being subject to the prior authorisation of the Provider. No transfer of that kind is presently carried out.
Should a future processing operation entail a transfer outside the European Economic Area, the transfer will be effected only where an adequate level of protection is ensured, whether by virtue of an adequacy decision adopted under Article 45 of the GDPR or by means of appropriate safeguards under Article 46 of the GDPR, including the Standard Contractual Clauses approved by the European Commission. A reservation applies to the external form mentioned in Section 7, whose provider operates under its own arrangements and may process the data submitted to it outside the European Economic Area; use of that form is voluntary and is not required in order to access the Service. Further information concerning any transfer, and a copy of the relevant safeguards, may be obtained by contacting the CAIT team at the address indicated in Section 2.
9. Retention of Personal Data
Personal data is retained for no longer than is necessary for the purposes for which it was collected, taking into account the requirements of the Service and any applicable legal obligation. The periods applied are the following.
Published materials: Materials that you have published, together with the personal data associated with them for the purpose of attribution, remain on the Platform until you delete them or until your account is deleted. Where an account is closed, its holder may elect to transfer the ownership of the published materials to another registered user, in which case the materials remain available under the responsibility of the new owner; failing such an election, they are removed together with the account.
Registration and profile data: Personal data relating to a registered user is kept for as long as the account subsists, and is erased or anonymised once the user requests the deletion of that account.
Visitor data: Data relating to visitors, comprising the technical and connection data and the usage records generated by server-side logging, is stored for one year from its collection, at the expiry of which it is deleted.
Where personal data must be retained in order to comply with a statutory obligation, or in order to establish, exercise, or defend a legal claim, the applicable statutory period governs its retention and prevails over the periods stated above.
10. Security of Personal Data
The Provider implements appropriate technical and organisational measures, in accordance with Article 32 of the GDPR, in order to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. Data is stored within a protected database, and access to data that is not publicly displayed, such as records of activity on the Platform, is restricted to authorised persons and systems. Sessions are maintained by means of a signed access token whose validity is limited to one hour, renewed thereafter through a refresh token that is itself replaced upon each renewal, so that the compromise of a single token affords only a narrow window of exposure.
At the level of the infrastructure, the hosting supplier applies the technical and organisational measures annexed to the data processing agreement, which cover, among other matters, physical access control to the data centres by electronic access systems with logging, comprehensive video surveillance, perimeter protection of the data centre park, control of access to systems and to data, separation of processing environments, and the availability and resilience of the installations. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, the Provider will notify the competent supervisory authority, and, where required, the affected data subjects, in accordance with Articles 33 and 34 of the GDPR.
11. Your Rights as a Data Subject
Under the GDPR, you are entitled to exercise a number of rights in respect of your personal data, which are summarised below.
Right of access: You may obtain confirmation as to whether your personal data is being processed and, where that is the case, access to that data and to the information specified in Article 15 of the GDPR.
Right to rectification: You may request the correction of inaccurate personal data and the completion of incomplete personal data, pursuant to Article 16 of the GDPR.
Right to erasure: You may request the deletion of your personal data in the circumstances set out in Article 17 of the GDPR, subject to the retention requirements described in Section 9.
Right to restriction: You may request the restriction of processing in the circumstances set out in Article 18 of the GDPR.
Right to data portability: You may request to receive the personal data that you have provided in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller, pursuant to Article 20 of the GDPR.
Right to object: You may object, on grounds relating to your particular situation, to processing carried out on the basis of legitimate interests, pursuant to Article 21 of the GDPR.
Right to withdraw consent: Where processing rests upon your consent, including the display of your email address, you may withdraw that consent at any time, pursuant to Article 7(3) of the GDPR, without affecting the lawfulness of processing carried out before the withdrawal.
Requests relating to the exercise of these rights may be submitted to the contact addresses set out in Section 2, and will be handled within the time limits prescribed by Article 12 of the GDPR.
12. Automated Decision-Making and the Reputation System
The Platform operates a reputation mechanism that reflects the quantity and the perceived quality of your contributions, calculated by reference to the number of publications and comments you make and to the ratings and indications of use received from other members. The reputation score serves to recognise community activity, and it does not produce legal effects concerning you, nor does it similarly significantly affect you within the meaning of Article 22 of the GDPR. The Provider does not engage in automated decision-making that produces such effects.
13. Minors
The Platform is intended for educators, researchers, and affiliated staff of institutions of higher education, and it is not directed at children. The Provider does not knowingly process the personal data of minors through the Service. Where it comes to the attention of the Provider that data relating to a minor has been processed without an appropriate legal basis, that data will be deleted without undue delay.
14. Complaints to the Supervisory Authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. In the Netherlands, the competent supervisory authority is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, whose website is available at https://www.autoriteitpersoonsgegevens.nl. You may also address a complaint to the Data Protection Officer of TU Delft at fg@tudelft.nl before, or in addition to, contacting the supervisory authority.
15. Amendments to this Privacy Statement
The present Privacy Statement may be revised from time to time in order to reflect changes in the Service, in the applicable legal framework, or in the manner in which personal data is processed. The version published on the Platform, bearing the effective date indicated above, is the version in force. Where a revision is of material significance, registered users will be informed by an appropriate notice published on the Platform or transmitted to the email address associated with their account. You are encouraged to consult this page periodically in order to remain informed of the conditions under which your personal data is processed.
16. Contact
Any question, request, or concern relating to this Privacy Statement or to the processing of your personal data may be addressed to the CAIT team at cait-ewi@tudelft.nl, to the Data Protection Officer of TU Delft at fg@tudelft.nl, or to the institutional privacy team at privacy-tud@tudelft.nl.