This Personal Data Protection Policy applies exclusively to the processing of personal data carried out by ISVOUGA.
For the purposes of this Personal Data Policy, «Personal data» means information relating to an identified or identifiable natural person («data subject»). In these terms, a natural person is considered identifiable who can, directly or indirectly, be identified, in particular by reference to an identifying element - such as a name, an identification number, location data, identifiers electronically - or to one or more specific elements of that individual's physical, physiological, genetic, mental, economic, cultural or social identity.
The data controller at the University
The entity responsible for the collection and processing of personal data is ISVOUGA, which in its context, decides what data is collected, the means of processing, the period of conservation and the purposes what they are used for.
Typology of personal data collected
ISVOUGA, within the scope of its activity, collects and processes the personal data necessary for the pursuit of its mission and duties, in accordance with the Legal Regime of Higher Education Institutions.
Collection of personal data
ISVOUGA collects personal data in person, by phone, in writing or through computer systems. The personal data collected are processed either by non-automated means (for example, manual files) or by computer and in strict compliance with the legislation on the protection of personal data, being stored in specific databases created for this purpose. In no case will the collected data be used for any purpose other than that for which consent was given by the data subject or the condition of processing legitimacy.
About the lawfulness of the processing of personal data
At ISVOUGA, the processing of personal data depends on verifying the legitimacy conditions and verifying the lawfulness of the purpose of that same treatment, as well as observing the principle of proportionality lato sensu. In particular, all processing of personal data at ISVOUGA will only occur as long as:
- It is necessary for the pursuit of legitimate interests and if the data subject has unequivocally given his consent;
- Is necessary for the performance of a contract or for the fulfillment of any legal obligation to which the controller is attached;
- Is necessary for the protection of vital interests of the data subject or another natural person;
- Is necessary for the exercise of public interest functions or the exercise of public authority in which the controller is invested;
- It is necessary for the pursuit of legitimate interests of the controller or the third party to whom the data is communicated, provided that the interests or rights, freedoms and guarantees of the data subject should not prevail.
About the purposes of processing personal data
Information on the processing of personal data is provided to the data subject at the time of collection or, if personal data has been obtained from another source, within a reasonable period, depending on the circumstances. When collecting data, ISVOUGA, as the controller, provides the holder of personal data with more detailed information about the use he will make of the information, namely:
- The identity and contact details of the controller.
- The contact details of the data protection officer.
- The purposes for which the processing of personal data is intended, as well as the legal basis for that same treatment.
- The recipients or categories of recipients of personal data.
- The rights of the data subject.
- The data retention period or the criteria used to define this period.
- Which data you must provide and which are optional.
The personal data processed by ISVOUGA can be legitimately transmitted to third parties when the fulfillment of purposes directly related to the legitimate functions of the data subject or the controller is verified. Whenever personal data are likely to be legitimately transferred to another recipient, the data subject is informed prior to the communication of personal data to third parties, and, when justified, may require that his personal data not be transferred, provided that this is does not harm the vital and legitimate interest of one of the parties or the public interest. Whenever ISVOUGA has the intention or need to process personal data for any purpose other than that for which it was collected, it will provide the data holder with information about that purpose and other information needed. When it is not possible to inform the data subject of the origin of the personal data held by the University, due to having resorted to several sources, he must be provided with all the information, which exists about that same source.
Retention period for personal data
The period during which data is stored and preserved varies according to the purpose of the respective treatment. ISVOUGA may retain personal data for as long as it may be required to assume some type of liability arising from a legal relationship, the performance of a contract or the application of pre-contractual measures. Whenever there is no specific legal requirement, the data will be stored and preserved only for the period necessary to fulfill the purposes that motivated its collection and treatment or for the period of time authorized by the Control Authority, after which they will be deleted. ISVOUGA, in the case of processing for the purposes of public interest archiving, or for the purpose of scientific or historical research, or for statistical purposes, may retain the data for longer periods, without prejudice to applying the appropriate guarantees, under the terms of the legislation in force, for the rights and freedoms of the data subject. These guarantees imply the adoption of technical and organizational measures aimed at ensuring, inter alia, compliance with the principle of data minimization.
Rights of data subjects
Pursuant to the legal framework on the Protection of Personal Data, ISVOUGA guarantees the data subject the right to access, update, rectify or delete their personal data, upon written request addressed to the data protection officer. When the data subject's right of access undermines fundamental rights and legitimate interests of natural persons, this should be limited.
About security measures
ISVOUGA seeks to protect users' personal data through various appropriate technical and organizational measures in order to guarantee the confidentiality, integrity, availability and resilience of personal data.
About the communication of personal data to other entities (subcontracted third parties)
ISVOUGA, within the scope of its attributions, may use third parties to provide certain services. When data processing is carried out by a subcontractor or third party to whom data are transmitted, ISVOUGA verifies that it has sufficient guarantees for the execution of appropriate technical and organizational measures, so that the processing meets the requirements of the legislation in force and ensures defense of the rights of the data subject. The treatment in these terms is regulated by contract or other normative act, which binds the subcontractor or the third party to the guidelines established by ISVOUGA, as the entity responsible for processing the data, and defines the object and duration of this treatment, the nature and purpose of the same , the type of personal data and the categories of data subjects and the obligations and rights of the controller.
The contract stipulates, inter alia, that the subcontractor or third party:
- It only processes personal data transmitted using documented instructions from ISVOUGA, including with regard to data transfers to third countries or international organizations, unless you are required to do so by Union or Member State law to which you are applying. is subject, in that case informing the person responsible for handling this legal requirement prior to processing, unless the law prohibits such information for important reasons of public interest;
- Ensures that persons authorized to process personal data make a commitment to confidentiality or are subject to appropriate legal obligations of confidentiality;
- Adopts the most appropriate security measures;
- Deletes or returns to ISVOUGA all personal data after the completion of the provision of services related to processing, deleting existing copies, unless data retention is required under Union or Member State law;
- Provides ISVOUGA with all the information necessary to demonstrate compliance with the obligations provided for in this article and facilitates and contributes to audits, including inspections, conducted by the controller or by another auditor appointed by this mandate;
- The subcontractor cannot hire another subcontractor without ISVOUGA's authorization, and the request must be sent to the data controller.
In any case, ISVOUGA also remains responsible for the personal data it makes available.
About the transfer of personal data outside Portugal
The performance of certain assignments by ISVOUGA may involve the transfer of your data outside Portugal. ISVOUGA verifies in advance that the country or territory to which the data is transferred guarantees an adequate level of data protection or has been subject to an adequacy decision by the European Union. If so, ISVOUGA will strictly comply with the applicable legal provisions, as well as the guidelines approved by the administration.
About ISVOUGA online portals
Changes to ISVOUGA's personal data protection policy
Questions and suggestions
To find out more about how ISVOUGA treats your personal data, or to clarify any doubts, submit a complaint or comment on matters relating to Privacy and Protection of Personal Data, use the following contacts:
Rua António de Castro Corte Real
4520-181 Santa Maria da Feira
Tel.: 256 377 550
Fax: 256 377 559