Privacy

Who is responsible and how to contact us

The responsible organisation is Delft University of Technology (TU Delft). Contact your course coordinator for questions about course access or learning records. The service privacy contact is b.filtjens@tudelft.nl. You can contact TU Delft's privacy team and Data Protection Officer at privacy-tud@tudelft.nl. See the TU Delft privacy statement for institutional information.

What we collect and where it comes from

• Account details: name, email address, verification and approval status, enrollment and course role. These come from your registration, authorized staff provisioning, an import or invitation, or the institutional identity provider when NetID sign-in is enabled.
• Learning records: lecture progress and last playback position, submissions, feedback, group membership, quiz attempts and peer-review activity, generated when you use course activities.
• Access and security records: login times, session identifiers, and the time, IP address and browser information associated with sensitive account actions. The hosting service may also record request and error logs.

Local passwords are stored as one-way Argon2id hashes. We do not receive your NetID password. Account details are needed for the relevant sign-in route; without them we cannot provide that account access. Course instructions identify which activities are required.

Email registration, invitations and password resets may be unavailable during a pilot. A staff account can be provisioned directly by the service owner without email verification. The privacy contacts on this page remain available independently of the portal's outgoing email service.

Pilot profiles and progress

The shared pilot name and password open the pilot entry gate. Choosing Start new creates a separate student profile with a generated name and identifier; you do not need to provide your real name or email address. Progress and submissions are stored against that profile on the server.

A browser cookie connects you to that profile for 180 days, renewed when you continue it. These records are treated as personal data: a generated identifier does not guarantee anonymity, especially when submissions or security records can identify someone.

Signing out preserves the profile cookie. Anyone with the shared pilot login and access to this browser may be able to continue your saved profile. Clearing the cookie or choosing Start new prevents recovery of the previous profile through this browser flow; it does not delete the previous profile's server records. Contact the course team for data requests while you can still identify your profile. Do not send your cookie value or password by email.

Purposes and legal basis

We use account and course records to control access, deliver teaching activities, record progress, provide feedback and support course administration. Access and security records help protect the service and investigate misuse. Educational records are not automatically repurposed for research.

Contact the course coordinator or TU Delft privacy team for the legal basis applicable to your course or pilot. It must be established for the activity; a sign-in or cookie choice does not itself provide a legal basis for all educational processing.

Who can see your data

Authorized course staff and platform administrators can access records within their assigned responsibilities. Group activities and allocated peer reviews share the relevant work and feedback with participating students. Course staff can export course records for administration, including transfer to Brightspace, which remains the official gradebook. Avoid putting sensitive personal information in work shared with classmates.

Hosting, backup, email delivery and enabled institutional sign-in services support the portal. The course coordinator or privacy team can provide the service-provider details for this deployment.

DelftBlue and course JupyterHub links open separate services with their own sign-in and privacy information. This portal does not forward your login credentials to those services. Files you upload there are handled by those services.

Contact the course coordinator or privacy team for the hosting locations and any transfers outside the European Economic Area, including the safeguards that apply. A TU Delft web address alone does not establish where all providers process data.

How long records are kept

The registration cleanup removes unverified registration-only records after 48 hours and rejected registration-only records after 30 days. Rejected applicants' password hashes are removed immediately. Cleanup runs through the service's scheduled maintenance.

The application does not automatically delete approved accounts, pilot profiles or their learning records after a fixed period. Contact the course coordinator or privacy team for the applicable retention periods and deletion arrangements, including security logs and backups.

The pilot cookie's lifetime is separate from record retention: cookie expiry does not automatically delete your profile or coursework.

Your rights and requests

You can request access to your data and correction of inaccurate records. Depending on the processing and its legal basis, you may also request erasure, restriction or a portable copy, or object to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Some records may need to be retained to meet legal obligations.

Use the contacts above to make a request. We may need proportionate information to verify that records belong to you; for pilot accounts, tell us your generated profile name and course. You can also complain to the Dutch Autoriteit Persoonsgegevens.

Automated feedback and security

Some activities use automatic completion checks, quiz scoring or notebook checks to provide progress and formative feedback. Ask teaching staff to review a result you believe is incorrect. Brightspace remains the official gradebook.

Verification and password-reset links are time-limited bearer links; keep them private. HTTPS, access checks, protected cookies, rate limits and audit records help protect the application. For healthcare exercises, use only approved teaching datasets and do not upload identifiable patient information.