Instituto Politécnico de Bragança

UPB reserves the right to make changes to this Technology Infrastructure Use Policy at any time, and such changes will be properly announced.

The UPB assumes no responsibility for the use of its infrastructures when this involves any action contrary to the law, the statutes and regulations and these provisions, and such responsibility rests with the users.

As part of its responsibilities for responding to security incidents and detecting vulnerabilities, the UPB team responsible analyzes cases of non-compliance with these provisions. In each case, it notifies the infrastructure manager, the head of the respective unit and the offender, if identified, and assesses the decision to temporarily suspend access to the technological infrastructure or other measures to mitigate the impacts. In situations involving personal data, the Data Protection Supervisor is notified.

In compliance with its legal and statutory obligations, the UPB monitors and records the use of the technological infrastructures under its management, namely with the aim of keeping the records deemed necessary for the correct technical support of the equipment and guaranteeing the security of the Institute’s infrastructures. This monitoring will be carried out in line with the minimum requirements for Networks and Information Systems set out in Council of Ministers Resolution 41/2018, in strict compliance with the interests of the organization and its users. Within the scope of monitoring, UPB guarantees non-interference in electronic communications protected by cryptographic algorithms, respecting the rights, privacy and freedom of its users. The UPB collects data relating to the use of infrastructures in a pseudonymized form, comprising only the data necessary for the purposes previously identified, namely IP addresses, ports, protocols, date, time, user-agent browser and metadata relating to layers 3 and 4 of the Open System Interconnection (OSI) model. More data may be processed within the scope of some services, and the user will be informed in advance of the additional data in the conditions of use of each service. In the absence of another retention period defined in the service’s own conditions of use or by legal imposition, records will be kept for a maximum period of 24 months. Access to these records by anyone outside the UPB is expressly forbidden. Access by UPB technicians is only authorized within the scope of the infrastructure security monitoring process or in exceptional and justified situations for technical checks or compliance with legal obligations.

As part of the pursuit of its mission and duties, UPB collects some personal data from users when they use its infrastructures. UPB guarantees strict compliance with the legislation in force on data protection and privacy, as well as guiding its activity by guaranteeing the rights and freedoms of users, in accordance with its Data Protection and Privacy Policy.

With the exception of publicly available content, access to UPB resources is granted through specific access credentials. The basic principle for creating user accounts for access to UPB’s technological infrastructures takes into account the user’s profile as well as the resource and/or service they need to access, also bearing in mind that UPB, as an Identity provider, is responsible for supplying reliable and accurate identity assertions to its own services and those of third parties, making it essential to guarantee a process for assigning credentials with a high degree of reliability and security, forcing greater accountability on those involved in the whole process. Users with a contractual or occasional link are eligible for access accounts to resources, and the person responsible for assigning the account is responsible for identifying the individual, ensuring that there is a legitimate reason and clearly distinguishing between the types of identity registered in the systems (users, generic, non-human accounts, etc.). In the process of assigning identity to users, UPB collects at least the following data: name, email address and institutional identification number of the holder. The accounts associated with a user are always accompanied by an expiry date appropriate to the profile and reason justifying their creation, which constitutes the right of access, being aligned at the maximum limit with the terminus of the link or reason for creation. User accounts are created by those responsible for UPB’s technological infrastructures within the scope of their duties. In cases where access to resources by a user requires authorization, this must be duly justified so that it takes into consideration the profile and functions, and will be granted by the Institution entity responsible for the service. Thus, in addition to the situations identified above, temporary user accounts with limited permissions may be created to access wireless networks and other electronic services displayed on the Internet. Authorization to access resources implies express acceptance of this policy, and remains valid for as long as the right of access persists. It may be suspended or canceled in the event of non-compliance or for security reasons. The authorizations granted are personal and non-transferable, and it is up to the user to maintain the confidentiality and protection of the credentials assigned to them.