Instituto Politécnico de Bragança

All personal data collected by the organic units of the UPB are mandatory in the context of employment in the civil service.

Applicants who do not become students, either because they have not been accepted, because they give up before starting, or because the procedure runs out at the end of the application, have their personal data deleted at the end of the period needed to guarantee the claim deadlines, with the exception of billing data, if there has been a payment, which is only deleted after the legal deadline.

Most of this data is needed to answer official surveys such as RAIDES. In order to do this, educational institutions keep this information for the duration of the student’s stay and for a further two years after their last enrolment.

The person responsible for informing and advising all actors on their obligations under the applicable legislation, monitoring compliance with the regulation or other EU or national data protection provisions, as well as with the organization’s privacy policy, providing advice on the matter and monitoring the implementation of the data protection impact assessment, as well as cooperating with the supervisory authority. It also becomes the point of contact, not only for the supervisory authority, on issues related to processing, but also for the data subjects themselves, in particular for the purposes of exercising their rights, and their contact details must be made public and communicated to the supervisory authority.

For data processing to be lawful, personal data must be processed on the basis of the consent of the data subject concerned or on another legitimate basis provided for by law, either in this Regulation or in another act of Union or Member State law referred to in this Regulation, including the need to comply with legal obligations to which the controller is subject or the need to perform contracts to which the data subject is part of or in order to carry out pre-contractual steps requested by the data subject.

It is the process whereby there is no longer a link between the data subject and the data. In simpler terms, it consists of removing, modifying or replacing individual characteristics with coded representations to ensure that personal data cannot be attributed to an identified or identifiable natural person.

This means that the personal data collected must be limited to what is necessary for the purposes for which it is processed.

These are all the operations carried out on the data entrusted by the data subject. Access to data is data processing. Keeping it on file, creating copies, consulting it, publicising it, etc. are also data processing.

This is the person to whom the personal data relates.

Article 9 of the GDPR applies even stricter restrictions to the processing of special categories of personal data, defined as: ‘personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, as well as the processing of genetic data, biometric data uniquely identifying a person, data concerning health or data concerning a person’s sex life or sexual orientation.’ All this data has additional processing restrictions. Biometric data is defined as ‘personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person which permits or confirms the unique identification of that natural person, in particular facial images or dactyloscopic data’ (Article 4(14) of the GDPR). Health data is defined as ‘personal data relating to the physical or mental health of a natural person, including the provision of health services, which reveal information about his or her state of health’ (Article 4(15) of the GDPR).