1. Introduction Vrije Universiteit Amsterdam, through the VU Ambulatory Monitoring System (VU-AMS) project based in the Department of Biological Psychology, is committed to protecting the privacy and personal data of research participants, customers, and all other individuals whose data we process. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have under applicable data protection legislation — in particular the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Dutch Implementation Act (Uitvoeringswet AVG). VU-AMS is a research-grade physiological monitoring device developed at Vrije Universiteit Amsterdam. It is used worldwide by academic research groups to record physiological signals — including electrocardiography (ECG), impedance cardiography (ICG), electrodermal activity (EDA/skin conductance), and accelerometry — in both laboratory and naturalistic ambulatory settings. 2. Data Controller The data controller responsible for processing your personal data is: Vrije Universiteit Amsterdam Department of Biological Psychology — VU-AMS De Boelelaan 1105 1081 HV Amsterdam The Netherlands For questions about this Privacy Policy or the processing of your personal data, contact us at privacy@vu.nl or via https://vu-ams.nl. You may also contact the Data Protection Officer (Functionaris voor Gegevensbescherming) of Vrije Universiteit Amsterdam at fg@vu.nl. 3. Personal Data We Collect Depending on your relationship with VU-AMS, we may collect the following categories of personal data. Research participants. When you take part in a study using the VU-AMS device, we may collect physiological data (ECG, ICG, skin conductance, and accelerometry), demographic data relevant to the study, behavioural and psychological data such as questionnaire responses or task performance, and contact details where needed for scheduling or follow-up. Physiological data constitutes health data under Article 9 GDPR and is therefore classified as special category data requiring explicit consent and heightened protection. Customers, researchers, and business contacts. If you purchase or borrow a VU-AMS device, request support, or enter into a commercial or collaborative relationship, we may process your name, job title, and institutional affiliation, your email address, telephone number, and postal address, billing and payment information, and communication records. Website visitors. When you visit https://vu-ams.nl, we may collect standard technical data such as IP address, browser type, and pages visited, in accordance with our cookie policy. 4. Legal Basis for Processing We process personal data only where a valid legal basis under Article 6 GDPR (and Article 9 GDPR for special categories) exists. For physiological and health data from research participants we rely on explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR) obtained through a study-specific informed consent procedure. For the management of orders, licenses, and support agreements we rely on the performance of a contract (Article 6(1)(b) GDPR). For internal administration, security, and service improvement we rely on legitimate interests (Article 6(1)(f) GDPR), where those interests are not overridden by your rights. Where data is processed for academic research conducted in the public interest we rely on Article 6(1)(e) and Article 9(2)(j) GDPR, subject to appropriate safeguards. Where required by Dutch or EU law we rely on legal obligation (Article 6(1)(c) GDPR). 5. Purposes of Processing We process personal data to conduct scientific research on stress, emotion, and autonomic nervous system function; to validate and improve VU-AMS hardware and software; to provide technical support, training, and documentation to device users; to manage customer relationships, orders, and invoicing; to comply with legal, ethical, and regulatory obligations including those of the Medical Research Ethics Committee (METC) and the VU Amsterdam Research Ethics Review Committee (RERC); and to improve the vu-ams.nl website and communications. 6. Sharing of Personal Data We do not sell personal data. We may share data in limited circumstances: with other researchers or institutions, but only in anonymised or pseudonymised form under appropriate data sharing agreements; with service providers acting as processors on our behalf, under a data processing agreement (verwerkersovereenkomst) ensuring GDPR compliance; with public authorities or ethics committees where legally required; and within Vrije Universiteit Amsterdam on a need-to-know basis. Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission. 7. Data Retention We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law or research ethics obligations. Research participant data is retained for the duration required by the applicable research protocol; raw physiological data is typically retained for a minimum of ten years after publication in accordance with the Netherlands Code of Conduct for Research Integrity. Customer and business contact data is retained for the duration of the contractual relationship and up to seven years thereafter for tax and accounting purposes. Website analytics data is retained for a maximum of 26 months. After the retention period, data is securely deleted or anonymised. 8. Security We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These include encryption of data at rest and in transit, access controls and role-based permissions, pseudonymisation of research participant data wherever possible, and regular security assessments and staff training. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and affected individuals as required by law. 9. Your Rights Under the GDPR Under the GDPR you have the right of access (Article 15) to request a copy of the personal data we hold about you; the right to rectification (Article 16) to correct inaccurate or incomplete data; the right to erasure (Article 17), subject to legal and research integrity obligations; the right to restriction of processing (Article 18) in certain circumstances; the right to data portability (Article 20) where processing is based on consent or contract and carried out by automated means; the right to object (Article 21) to processing based on legitimate interests or public interest grounds; and the right to withdraw consent at any time without affecting the lawfulness of prior processing. To exercise any of these rights, please contact privacy@vu.nl. We will respond within one month. If you are unsatisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl. 10. Research Participant Safeguards Where your data is collected as part of a scientific study, the following additional provisions apply. Participation is voluntary and you may withdraw at any time without consequence. Each study is governed by its own informed consent procedure approved by a recognised ethics committee. Your data will be pseudonymised: your identity is replaced by a code, and the linking key is stored separately and securely. Research results are published in aggregate or anonymised form; individual participants are not identified. In exceptional cases, data may be retained after withdrawal where complete removal would compromise the scientific integrity of already-analysed results, as permitted under Article 17(3)(d) GDPR. 11. Cookies and Website Analytics The VU-AMS website may use cookies and similar tracking technologies. A separate cookie notice is available on the website. Functional cookies necessary for the operation of the website are placed without prior consent; analytical and marketing cookies are only placed with your explicit consent. 12. Changes to This Privacy Policy We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. The date of the most recent revision is shown at the top of this document. Where changes are material, we will notify you by appropriate means. 13. Contact VU-AMS — Vrije Universiteit Amsterdam Department of Biological Psychology De Boelelaan 1105, 1081 HV Amsterdam, The Netherlands Email: privacy@vu.nl | Website: https://vu-ams.nl Data Protection Officer: fg@vu.nl Dutch Data Protection Authority (Autoriteit Persoonsgegevens): www.autoriteitpersoonsgegevens.nl | +31 (0)70 888 85 00