Monitoring and recordkeeping

In compliance with its legal and statutory obligations, the UPB monitors and records the use of the technological infrastructures under its management, namely with the aim of keeping the records deemed necessary for the correct technical support of the equipment and guaranteeing the security of the Institute’s infrastructures. This monitoring will be carried out in line with the minimum requirements for Networks and Information Systems set out in Council of Ministers Resolution 41/2018, in strict compliance with the interests of the organization and its users. Within the scope of monitoring, UPB guarantees non-interference in electronic communications protected by cryptographic algorithms, respecting the rights, privacy and freedom of its users. The UPB collects data relating to the use of infrastructures in a pseudonymized form, comprising only the data necessary for the purposes previously identified, namely IP addresses, ports, protocols, date, time, user-agent browser and metadata relating to layers 3 and 4 of the Open System Interconnection (OSI) model. More data may be processed within the scope of some services, and the user will be informed in advance of the additional data in the conditions of use of each service. In the absence of another retention period defined in the service’s own conditions of use or by legal imposition, records will be kept for a maximum period of 24 months. Access to these records by anyone outside the UPB is expressly forbidden. Access by UPB technicians is only authorized within the scope of the infrastructure security monitoring process or in exceptional and justified situations for technical checks or compliance with legal obligations.