Version 1.3 of 15 December 2025
Thank you for taking the time to read the privacy statement of the SURF edubadges service! We have devoted a great deal of attention to the protection of your personal data and you can read all about this in this privacy statement. If you have any questions, comments or concerns after reading this privacy statement, please feel free to send an e-mail to support@edubadges.nl or contact your own educational institution.
We are SURF B.V. (“SURF”), located at 48 Moreelsepark, 3511 EP Utrecht, the Netherlands. You can call us on 31-887873000. SURFnet is part of the SURF cooperative, the collaborative organisation for ICT in Dutch education and research. More than 100 education and research institutions in the Netherlands work together within the SURF cooperative to fully utilise the opportunities of digital transformation. More about the SURF cooperative.
An edubadge is a digital badge (image) which shows that the holder has certain knowledge or skills. The recipient of an edubadge can share it with others, for example on social media, on a digital CV, or with an educational institution or (potential) employer.
A technical infrastructure is required in order to create and award edubadges. SURF has developed the infrastructure for issuing edubadges; the edubadges are stored securely and can be validated within SURF’s systems. More information about edubadges can be found on SURF’s website.
Can’t find what you’re looking for? Take a look at Getting started with edubadges.
The edubadges service is divided into two parts:
SURF is the data controller for the processing of data in the user account, storing edubadges and validating edubadges (1). This privacy statement primarily relates to this data processing. If you have any questions about this data processing, please contact support@edubadges.nl. De edubadge ‘Edubadge account complete’ will be awarded automatically after user account creation. With this edubadge, the functionality of edubadges.nl can be explored. This edubadge can be rejected by clicking ‘Reject this edubadge’ inside the edubadge’s page.
For the issuing of edubadges (2), your educational institution is the data controller and SURF is the data processor. When applying for an edubadge, the educational institution in question will present you its privacy policy. If you have any questions about this processing, please contact your own educational institution. Contact information can be found in the table below.
| Institution | Privacy contact |
|---|---|
| Aeres Groep | fg@aeres.nl |
| Albeda | fg@albeda.nl |
| Alfa-college | info@alfa-college.nl |
| Avans Hogeschool | privacy@avans.nl |
| Aventus | privacy@aventus.nl |
| Breda University of Applied Sciences | fg@buas.nl |
| Christelijke Hogeschool Ede | fg@che.nl |
| Cibap Vakschool | n.dutij@cibap.nl |
| Curio | j.vandenhazelkamp@curio.nl |
| DDCTerra | privacy@dcterra.nl |
| De Haagse Hogeschool | privacy@hhs.nl |
| Deltion | 3333@deltion.nl |
| Erasmus Universiteit Rotterdam | edubadges@eur.nl |
| Fontys | isp-office@fontys.nl |
| Firda | privacy@fcroc.nl |
| Graafschap College | c.uitterhoeve@graafschapcollege.nl |
| Grafisch Lyceum Rotterdam | dlinden@glr.nl |
| HAN University of Applied Sciences | privacy@han.nl |
| Hanzehogeschool Groningen | ict-security@org.hanze.nl |
| HAS Hogeschool | privacy@has.nl |
| Hogeschool Inholland | functionarisgegevensbescherming@inholland.nl |
| Hogeschool IPABO | f.kool@ipabo.nl |
| Hogeschool Leiden | loket.privacy@hsleiden.nl |
| Hogeschool Rotterdam | privacy@hr.nl |
| Hogeschool Saxion | privacy@saxion.nl |
| Hogeschool Utrecht | askprivacy@hu.nl |
| Hogeschool van Amsterdam | functionarisgegevensbescherming@hva.nl |
| Hogeschool Van Hall Larenstein | privacy@hvhl.nl |
| Hotelschool The Hague | l.m.bal@hotelschool.nl |
| Koning Willem I College | fg@kw1c.nl |
| Landstede MBO | privacy@landstedegroep.nl |
| Maastricht University | privacy@maastrichtuniversity.nl |
| Marnix Academie | fg@hsmarnix.nl |
| mboRijnland | privacy@mborijnland.nl |
| MBO Utrecht | privacy@mboutrecht.nl |
| NHL Stenden Hogeschool | privacy-and-security@nhlstenden.com |
| Noorderpoort | servicecentrum@noorderpoort.nl |
| Nova College | ffeen@novacollege.nl |
| Radboud Universiteit | mijnprivacy@ru.nl |
| ROC A12 | fg@cog.nl |
| ROC Midden Nederland | privacy@rocmn.nl |
| ROC Nijmegen | n.dutij@roc-nijmegen.nl |
| ROC van Amsterdam | privacy@rocva.nl |
| ROC van Twente | privacy@rocmn.nl |
| Rijksuniversiteit Groningen | privacy@rug.nl |
| Rijn IJssel | privacy@rijnijssel.nl |
| Scalda | info@scalda.nl |
| SintLucas | privacy@sintlucas.nl |
| Stichting Gilde Opleidingen | privacy@rocgilde.nl |
| Summa College | ibp-team@summacollege.nl |
| SURF | privacy@surf.nl |
| Talland College | privacy@talland.nl |
| Technische Universiteit Delft | privacy-tud@tudelft.nl |
| Technische Universiteit Eindhoven | privacy@tue.nl |
| Thomas More Hogeschool | ibp@thomasmorehs.nl |
| Tilburg University | privacy@tilburguniversity.edu |
| Universiteit Leiden | privacy@bb.leidenuniv.nl |
| Universiteit Twente | dpo@utwente.nl |
| Universiteit Utrecht | privacy@uu.nl |
| Universiteit van Amsterdam | avg@uva.nl |
| VISTA college | ibp@vistacollege.nl |
| Vonk | privacy@vonknh.nl |
| Vrije Universiteit Amsterdam | functionarisgegevensbescherming@vu.nl |
| Wageningen University & Research | privacy@wur.nl |
| Windesheim | fg@windesheim.nl |
| Yonder | privacy@yonder.nl |
| Yuverta | ibploket@yuverta.nl |
| Zadkine | fg@zadkine.nl |
| Zuyd Hogeschool | functionarisgegevensbescherming@zuyd.nl |
Below is the privacy statement for the data processing operations associated with ‘Account/backpack’ (1).
In order for the edubadges platform to function, it is necessary to process personal data. The legal basis for the creation of the user account is the ‘performance of an agreement’. The applicable Terms of Use will be displayed when an user account is created.
Two groups of users are distinguished during data processing operations:
The table below shows the personal data processed for edubadge recipients (along with the purpose and the legal basis). This personal data is obtained by means of a link to the user’s eduID account.
| Personal data | Purpose | Legal basis |
|---|---|---|
| Given name(s) | User identification | Performance of an agreement |
| Surname | User identification | Performance of an agreement |
| E-mail address | Notify user | Performance of an agreement |
| Educational institution | Showing the right edubadges | Performance of an agreement |
| eduID | Pseudonymous identifier in edubadge | Performance of an agreement |
| Privacy Interaction | Whether the Terms of Use have been accepted | Performance of an agreement |
| Edubadges | Storage of edubadges | Performance of an agreement |
| Backups | Recovery of edubadges service in case of catastrophic event | Performance of an agreement |
| Education (code) | Linking edubadges to education | Performance of an agreement |
| Grade | Showing the grade in the edubadge (optional to use for the educational institution) | Performance of an agreement |
| Date of obtaining the edubadge | Showing the date on which the edubadge was obtained | Performance of an agreement |
| Unique identifier | Make it possible to award edubadges directly to the student | Performance of an agreement |
An edubadge contains your eduID. The edubadge also contains information such as the time of issue, the issuer (your institution) and information about grades, the educational module and/or learning outcomes. Edubadges essentially last for a lifetime. This is why we keep edubadges until you delete the edubadge or your user account with us (plus a period of one month for backups).
As the owner of an edubadge, you can make the edubadge publicly available in your account/backpack. This allows the edubadge to be verified, for example, by a potential employer or an educational institution.
Guests are viewers of edubadges that have not logged in. No personal data of guests will be processed.
Employees of your educational institution have access to given name(s), surname and e-mail address once you have requested an edubadge. SURF and its parent entity have access to all personal data. Personal data will not be disclosed to other third parties.
Security measures, including the following, have been taken to protect personal data:
You have the following rights with regard to your own personal data:
However, if you and SURF disagree and SURF’s response to your complaint does not lead to an acceptable outcome, you have the right to submit a complaint about SURF to the Dutch Data Protection Authority. More information on the Dutch Data Protection Authority and the procedure for submitting complaints can be found on the website of the Dutch Data Protection Authority.
To exercise these rights, please contact support@edubadges.nl or your own educational institution.
We may amend this privacy statement from time to time. We therefore advise you to consult our privacy statement regularly.