UPB seeks to protect users’ personal data through various appropriate technical and organisational measures. From a technological point of view, it uses various mechanisms and controls in accordance with the best practices in the field, with the aim of guaranteeing the confidentiality, integrity, availability and resilience of personal data.
With a view to the security of personal data, UPB implements the following measures:
a) Restrictions on access to personal data, based on the ‘need to know’ criterion as well as the competences and attributions of those accessing it, applied in strict accordance with what was communicated to the holder of the personal data when it was collected;
b) The transfer of personal data through encrypted communication channels;
c) Special category data is stored in encrypted form, as are the corresponding backup copies;
d) Protection of technological infrastructures with technical and organisational mechanisms to prevent unauthorised access;
e) Monitoring of technological infrastructures at various levels, such as access control, misuse and abnormal traffic, with the aim of preventing, detecting and stopping unauthorised access to personal data.
Under the terms of the legal framework on Personal Data Protection, UPB guarantees the data subject the right to access, update, rectify or erase their personal data, upon written request addressed to the Data Protection Supervisor.
The data subject also has the right to be notified in the event of a personal data breach, in accordance with and under the terms of the GDPR.
When the data subject’s right of access harms fundamental rights and legitimate interests of natural persons, it should be limited.
The period for which data is stored and kept varies according to the purpose of the processing, and is guided by the legally defined time limits.
UPB may keep personal data for as long as it may be required to fulfil some type of responsibility deriving from a legal relationship, the execution of a contract or the application of pre-contractual measures.
Whenever there is no specific legal requirement, the data will be stored and kept only for the period necessary to fulfil the purposes for which it was collected and processed or for the period of time authorised by the Supervisory Authority, after which it will be deleted.
When processing data for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes, the UPB may keep the data for longer periods, without prejudice to applying the appropriate guarantees, under the terms of the legislation in force, for the rights and freedoms of the data subject. These guarantees imply the adoption of technical and organisational measures aimed at ensuring, in particular, compliance with the principle of data minimisation.
The information gathered is for the use of UPB, in accordance with the purposes indicated at the time of collection or for compliance with legal obligations.
The information gathered will be treated confidentially and may be accessed by a restricted group of UPB employees, in compliance with their professional duties, within the precise limits and for the purposes of carrying out their duties.
Information on the processing of personal data is provided to the data subject at the time it is collected or, if the personal data has been obtained from another source, within a reasonable time, depending on the circumstances.
When the data is collected, UPB, as the data controller, provides the holder of the personal data with more detailed information on how the information will be used, namely:
a) The identity and contact details of the data controller.
b) The contact details of the Data Protection Supervisor.
c) The purposes for which personal data are processed, as well as the legal basis for such processing.
d) The recipients or categories of recipients of the personal data.
e) The rights of the data subject.The data retention period or the criteria used to define this period.
g) Quais os dados que tem de fornecer obrigatoriamente e quais são facultativos.
Personal data processed by UPB may be legitimately transmitted to third parties when the fulfilment of purposes directly related to the legitimate functions of the data subject or the controller is verified.
Whenever personal data is likely to be legitimately transferred to another recipient, the data subject is informed prior to the communication of personal data to third parties and, where justified, may demand that their personal data not be transferred, provided that this does not jeopardise the vital and legitimate interest of one of the parties or the public interest.
Whenever UPB has the intention or need to process personal data for a purpose other than that for which it was collected, it will first provide the data subject with information about that purpose and other necessary information. When it is not possible to inform the data subject of the origin of the personal data that UPB holds, because various sources have been used, the data subject must be provided with all the information that exists about that origin.
At UPB, the processing of personal data depends on the verification of conditions of legitimacy and the verification of the lawfulness of the purpose of such processing, as well as the observance of the principle of proportionality lato sensu.
Specifically, all processing of personal data at UPB will only be done as long as:
a) It is necessary for the pursuit of legitimate interests and if the data subject has unequivocally given their consent;
b) It is necessary for the performance of a contract or for the fulfilment of any legal obligation to which the controller is subject;
c) It is necessary for the fulfilment of obligations and the exercise of specific rights of the UPB, or of the data subject in terms of labour legislation, social security and social protection, under the terms of the GDPR;
c) It is necessary for the protection of the vital interests of the data subject or another individual;
d) It is necessary for the performance of a task carried out in the public interest or in the exercise of official authority in which the controller is vested;
e) It is necessary for the pursuit of the legitimate interests of the controller or of a third party to whom the data are disclosed, provided that the interests or the rights, freedoms and guarantees of the data subject are not overridden.
UPB collects personal data in person, in writing, by telephone or through computer systems. The personal data collected is processed either by non-automated means or by computer, in strict compliance with personal data protection legislation, and is stored in specific databases. Under no circumstances will the data collected be used for any purpose other than that for which the data subject’s consent was given or the condition of legitimacy of the processing.
Within the scope of its activity, UPB collects and processes the personal data necessary for the pursuit of its mission and attributions, under the terms of the Legal Framework for Higher Education Institutions (Law no. 62/2007, of 10 September) and its Statutes (approved by Normative Order no. 62/2008, DR. no. 236, 2nd series, of 5 December).
UPB recognises the right of citizens to the protection of their personal data and ensures that all data subjects who entrust UPB with the processing of their personal data are aware of the purpose and processing of the information provided, as well as their rights in this regard and how to exercise them, under the terms and in accordance with the provisions of Article 8 of the Charter of Fundamental Rights of the European Union (‘Charter’), Article 16(1) of the Treaty on the Functioning of the European Union (‘TFEU’) and the General Data Protection Regulation (‘GDPR’). This is in accordance with Article 8(1) of the Charter of Fundamental Rights of the European Union (‘Charter’), Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) and the General Data Protection Regulation (GDPR).
In this context, and bearing in mind that the pursuit of such goals depends on a solid combination of responsible users, appropriate technologies and secure processes, the UPB, under the provisions of Article 24(2) of the GDPR, and in strict compliance with the legal requirements prescribed by Articles 136(1) and 136(4) of the Code of Administrative Procedure (approved by Decree-Law 4/2015, of 7 January), establishes this Personal Data Protection Policy. º 4 of the Code of Administrative Procedure (approved by Decree-Law no. 4/2015, of 07 January), establishes this Personal Data Protection Policy, with a view to facilitating the effective application of the GDPR within the framework of its own characteristics and specificities as a Public Higher Education Institution.
Procedures have therefore been defined for requesting access, rectification or erasure of personal data. Mechanisms have been created to facilitate the exercise of the right to restriction of processing, the right to portability and the right to object, as well as new rules that complement the provisions on the protection and processing of personal data laid down in the Terms and Conditions that regulate the offer of the various products and services and which are duly publicised in the respective specific services to which the academic community and other users have recourse.
In this way, UPB informs the Academic Community and other Users of the general rules on privacy and the processing of personal data, which it collects and processes in a lawful, fair and transparent manner, in strict compliance with the general Data Protection framework in force in the Portuguese legal system. As the controller of personal data and information processing activities, UPB ensures that it implements and promotes appropriate and effective technical and organisational measures to comply with the principles of data protection, in accordance with the provisions of the GDPR, and that it takes into account the nature, scope, context and purposes of the information processing, as well as the risk of failure to protect the rights and freedoms of natural persons. The UPB therefore makes available and publicises this Personal Data Protection Policy in a clear and comprehensive manner and recommends that all users read it carefully and responsibly.
For questions related to the processing of personal data and the exercise of your rights under the GDPR, you can contact the Data Protection Supervisor at protecao.dados@ipb.pt.
The UPB Data Protection Supervisor performs the following duties, among others:
-
- Informs and advises the UPB or the subcontractor, as well as the employees who process data, about their obligations under the GDPR or applicable legislation;
-
- It monitors the compliance of data processing with the data protection provisions of the European Union or the Member States, as well as with the policies of the responsible or subcontractor regarding the protection of personal data;
-
- Provides advice, when requested, on the data protection impact evaluation and monitors its realization, in cases where it is carried out, under the terms of Article 35 of the GDPR;
-
- It cooperates with the control authority, which you can consult, and is your point of contact for questions related to data processing.