WHAT-IF Privacy Statement

(24 November 2025)

This privacy statement applies to all participants of the the research project “What-If: Advanced Simulations for Testing the Effect of the Information Environment on the Functioning of Democracy”, funded by the European Research Council (Horizon Europe: Grant Agreement #101177574), conducted by Vrije Universiteit Amsterdam, Barcelona Supercomputing Center, Royal Holloway University of London, Universität Konstanz, Universitat de Barcelona, University of Amsterdam, European University Institute, University of Vienna, National University of Political Studies and Public Administration, Vilnius Gediminas Technical University, Vytautas Magnus University, Trinity College Dublin, Universitat Oberta de Catalunya, Internews Europe, and the European Association for Viewers; and led by Prof. Wouter van Atteveldt from the Vrije Universiteit Amsterdam

The Vrije Universiteit Amsterdam (hereinafter: “VU”) attaches great importance to the protection of your privacy and the security of your personal data. In this privacy statement we describe how we handle your personal data collected during the survey and the data donation process. We process your personal data in accordance with applicable privacy legislation, including the General Data Protection Act (hereinafter: “GDPR “) and the General Data Protection Implementation Act.

Who is responsible for the processing of my personal data?

Stichting VU and the project partners mentioned above are jointly responsible for the data processing operations described in this privacy statement. Stichting VU maintains the Vrije Universiteit Amsterdam as a privately run university in accordance with the Higher Education and Research Act of The Netherlands (‘Wet op het hoger onderwijs en wetenschappelijk onderzoek’). Stichting VU has its registered office at De Boelelaan 1105 in (1081 HV) Amsterdam and is registered with the Chamber of Commerce under number 53815211.

What (categories of) personal data will be processed?

We will process the following personal data:

For research participants who complete surveys: Your answers to survey questions about your background, media habits, political attitudes and other topics.
For research participants who donate Social Media data: Behavioural data about your Social Media usage collected through data donation.
For research participants who are recruited through NetQuest and have consented explicitly to allowing NetQuest to track their browsing data: Information on your internet browsing collected through the NetQuest browser tracking tools.

Note that we do not gather, receive or process any directly identifying personal information about you such as your name, (e-mail) address, date of birth or IP address. However, we believe that your behavioral data might contain information that can be indirectly linked to you, so we treat this information as personally identifiable information. All data are linked based on a participant ID provided by the polling company, but we do not receive any information about you from the polling company apart from the questionnaire answers.

For which purposes are my personal data processed, and on the basis of which legal grounds?

The personal data will only be used for the following purposes:

Academic studies looking at how people consume news, and the correlates of news consumption and people’s attitudes. Some studies may be based on the questionnaire data only, on data from the social media accounts or browsing data only, or on both (linked using your participant ID provided by the polling company). Some examples may include descriptive studies looking at the news sources people use online), and how those sources are correlated to their opinions on particular issues. We will only publish and/or make public aggregate data, and never share raw data from your social media data.
To train virtual agents, such as Large Language Models (LLMs). We want these agents to learn how humans interact in the (digital) media environment. For example, how do humans react to different messages or news posted online, which ones are they more likely to like, share, comment on, the type of comment – and how this behavior differs based on the political and sociodemographic characteristics of the person. These virtual agents will not be trained to behave exactly like you in the simulation environment. Instead, to protect the participants privacy, when deployed in the simulation environment, these agents will be instructed to act like a generic person (e.g. a politically centrist woman of 35 years of age who follows news often). The models representing the agents may be used in future simulations and/or experiments. Even though agents do not represent specific persons, we will not share or publish any models unless we can guarantee that no personally identifiable information can be extracted from the models.

We process your personal data on the basis of the following legal grounds:

You have given consent to the processing of your personal data. In that case you have the right to withdraw your consent at any time by contacting us via the contact details below.

Who has access to my personal data?

The personal data will only be accessed by employees of the consortium institutions mentioned above in Section 1 who by reason of their function have a role in the processing of your personal data for the abovementioned purposes and for whom it is necessary that they have access to the personal data.

Data may be made available later to researchers with a legitimate research interest through a secure environment, but only in a way that ensures you cannot be identified. De-identified and fully anonymous data from this study may be shared with the research community at large to advance science through commonly used platforms, such as GitHub, Open Science Framework, and Dataverse.

Specifically for the Dutch survey and data donation participants recruited through Ipsos I&O, we will share the following categories of personal data shall be shared with the University of Amsterdam:

a. For research participants who complete surveys: Your answers to survey questions about your background, media habits, political attitudes and other topics.

b. For research participants who donate Social Media data: Behavioural data about your Social Media usage collected through data donation.

This data is shared on the basis of your granted consent and will be used by the University of Amsterdam for the purposes of scientific research about media use.

When processing your personal data, we may make use of service providers (processors) who process your personal data on behalf of and under the responsibility of the VU. The VU concludes processing agreements with these service providers to ensure that your personal data is processed carefully, securely and in accordance with the General Data Protection Regulation (GDPR). We remain solely responsible for these processing activities.

Will my personal data be transferred to countries outside of the European Economic Area?

No, your personal data will not be transferred to international organisations or countries outside the European Economic Area (EEA). The EEA includes all EU countries plus Norway, Liechtenstein and Iceland. Transfers of personal data between these countries are not subject to additional rules under the General Data Protection Regulation (GDPR).

For how long will my personal data be retained?

We will not retain your personal data for longer than is necessary to achieve the predetermined purposes or as long as required by law.

Your answers to survey questions about your background, media habits, political attitudes and other topics: minimum of 10 years after publishing
Behavioural data about your Social Media usage collected through data donation: minimum of 10 years after publishing
Information on your internet browsing collected through the NetQuest browser tracking tools: minimum of 10 years after publishing

How will my personal data be secured?

The VU takes appropriate technical and organizational measures to protect your personal data against loss and any form of unlawful processing.

In particular, as your social media and internet usage information (if applicable) can never be anonymized completely, they are stored in a secured research environment at the VU. Researchers that need to access this data will only be able to do so if they can guarantee secure transmission and storage of the data at their institution.

Who can I contact with questions about the processing of my personal data?

You can ask questions about how we process your personal data via wouter.van.atteveldt@vu.nl.

How can I exercise my privacy rights?

On the basis of the GDPR you have the right – under certain conditions – to access your personal data that we process, to correct your personal data if it contains factual inaccuracies, to delete your personal data, to limit the processing of your personal data, to portability of your personal data and to object to the processing of your personal data.

If you wish to exercise any of these privacy rights, you can contact the Data Protection Officer of VU Amsterdam via:

Data Protection Officer
De Boelelaan 1105
1081 HV AMSTERDAM
functionarisgegevensbescherming@vu.nl

To be able to deal with your request, you may be asked to identify yourself on the basis of additional personal data that the VU has of you. If this method of identification is not possible, you may be asked to identify yourself with an identification card. In this way it will be verified that the request has been made by the right person. If you are not satisfied with the way in which we deal with your personal data, you always have the right to submit a complaint with a supervisory authority.