Privacy statement

Last updated: 19 October 2026

Who we are

Utrecht Holdings is the Knowledge Transfer Office for Utrecht University and UMC Utrecht. It is formed by UU Holding B.V. and UMCU Holding B.V., Bestuursgebouw, Heidelberglaan 8, 3584 CS Utrecht, the Netherlands. The two are jointly responsible for the personal data described here.

Questions about this statement, or about your data: secretariaat@utrechtholdings.nl.

What this statement covers

The Invention Management System at invention.utrechtholdings.nl, which Utrecht Holdings uses to receive and assess inventions, and to protect them with patents and other IP rights.

When you tell us about an invention through the Reach Out form

We ask your title, name and email address, and a short description of the problem and your solution. We use them to contact you about your invention: a Business Developer reads your description and gets in touch. We send you a confirmation by email. We process these details because you agree to it on the form; you can withdraw that agreement at any time by contacting us.

Your account

When you are invited to the system, we keep your name, initials, email address, institution, department and division, your preferred language, and a profile picture if you add one. Your password is stored only in a form that cannot be turned back into the password.

We also ask your gender, which you may leave out. Utrecht Holdings aims to provide its services without personal bias, and this helps us monitor whether we do. We use it only in totals, never to judge an invention.

Invention disclosures

A disclosure holds what you tell us about the invention, the files you add, and the people who contributed to it: their names, initials, email address, nationality, department, division, position, role in the development, preferred language and gender. Nationality is asked because patent offices require it of inventors. Contributors you list receive an email asking them to confirm their part.

We use this to assess the invention, to decide with you whether and how to protect it, to agree on costs and on the share of each contributor, and to plan meetings. We do this on the basis of Utrecht Holdings' legitimate interest in protecting and transferring the knowledge developed at Utrecht University and UMC Utrecht, and to meet the agreements and regulations on intellectual property that apply to their employees.

Patents and other IP rights

When an invention leads to a patent application or another IP right, Utrecht Holdings keeps a case file for it. It holds the inventors' names, institution and department as they appear in the filings; the names and work email addresses of Utrecht Holdings staff working on the case; and the names, work email addresses and messages of the people at patent attorney firms and patent offices, as they appear in the correspondence. We use it to apply for, maintain and manage the IP rights, to keep track of the deadlines the attorneys report, and to keep the attorneys' invoices. We do this on the basis of the same legitimate interest, and, for invoices, our legal obligation to keep financial records.

Who can see your data

As a researcher, you see the disclosures you made in full. On a disclosure that lists you as a contributor, you see its overview and the submitted version as a PDF, including the list of contributors. Utrecht Holdings' Business Developers see all disclosures. Case files for IP rights are seen only by the Business Developers and the colleagues appointed to administer IP; researchers have no access to them.

Who processes data for us

We use these services, under agreements that bind them to our instructions:

• Koyeb runs the system, on servers in Frankfurt, Germany.
• Scaleway sends the system's emails, from France, and keeps its nightly backup, in Amsterdam, the Netherlands.
• HubSpot holds our relationship records: for each invention, a deal with its title and number, the email addresses of the people involved, and the meetings we plan. HubSpot keeps this data in its data centre in the European Union.
• Google Workspace receives the attorney correspondence that is forwarded to the system.
• IPFolio holds our patent records until 31 March 2027, after which they are kept in this system only. IPFolio stores data in the United States; that transfer is covered by the EU-US Data Privacy Framework.

We do not sell personal data or use it for advertising.

How long we keep it

• Reach Out messages that do not lead to a disclosure: two years.
• Accounts: for as long as you work with us. Once an account is deactivated, no one can sign in with it; its name and email address stay for as long as the disclosures that name it.
• Invention disclosures: indefinitely, as the record of what was invented, by whom, and what was decided.
• Case files for IP rights: for as long as the IP rights are in force, and seven years after the last of them ends. Invoices are kept for at least seven years.
• Forwarded attorney correspondence that turns out not to belong to any case: one year.
• Backups are kept for up to one year.

Cookies

The system sets only the cookies it needs to work: one that keeps you signed in, one that protects forms against misuse, and, when you confirm your part in an invention from an email, one that remembers that link for a short while. It sets no analytics or advertising cookies.

Security

The system is reached over an encrypted connection only. Access is limited by role, files are only handed out to people allowed to see them, and every important action is recorded. Our hosting provider keeps technical logs, including IP addresses, for a limited time to keep the service secure.

Your rights

You can ask to see the personal data we hold about you, to have it corrected or completed, to have it removed where we are not required to keep it, to have its use restricted, or to receive it in a common format. You can also object to how we use it. Contact secretariaat@utrechtholdings.nl; we answer within a month. If you are not satisfied with our answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.