Personal Data Protection Policy
The Privacy Policy of ISVOUGA – Instituto Superior de Entre do Douro e Vouga was formulated in order to maintain the privacy and security of the information collected from our customers and users. The established privacy policy comprises how information capable of identifying our students, teachers and employees is stored and used. ISVOUGA, as an organization that deals with personal data on a daily basis, considers itself committed to the regulated matters and the obligations imposed by the new European data protection legislation constituted, namely, by the Regulation (EU) 2016/679 of the Parliament and of the Council ( on the protection of individuals with regard to the processing of personal data and on the free movement of such data) hereinafter referred to as GDPR. In this sense, the present Personal Data Protection Policy is approved, with the purpose of reinforcing its commitment and respect for the rules of privacy and protection of personal data. Accordingly, this Personal Data Protection Policy is directly applicable to all operations carried out within the scope of the activities pursued by the group of bodies that make up ISVOUGA. Under no circumstances ISVOUGA discloses or markets personal information or data of its customers and users to third parties.
About the Personal Data Protection Policy
The Privacy Policy of ISVOUGA – Instituto Superior de Entre do Douro e Vouga was formulated in order to maintain the privacy and security of the information collected from our customers and users. The established privacy policy comprises how information capable of identifying our students, teachers and employees is stored and used. ISVOUGA recognizes the right of citizens to the protection of their personal data, ensuring that all holders of personal data, who entrust their treatment to ISVOUGA, are aware of the purpose and process of processing the information provided, as well as of the rights assist them in this matter and the way in which they are exercised, under the terms and in accordance with the provisions of Article 8 (1) of the Charter of Fundamental Rights of the European Union (“Charter”) of Article 16. 1, paragraph 1, of the Treaty on the Functioning of the European Union (TFEU) and the General Data Protection Regulation (GDPR). Consequently, procedures are defined to request, duly legitimated, access, rectification or deletion of personal data. Mechanisms are created to facilitate the exercise of the right to limit treatment, the right to portability and the right to object and new rules that complement the provisions on the protection and treatment of personal data, provided for in the Terms and Conditions that regulate the offer of the various products and services and which are duly advertised in the respective specific services to which the academic community and other users turn. In this way, ISVOUGA makes known to the Academic Community and the other Users the general rules of privacy and treatment of personal data that it collects and treats in a lawful, loyal and transparent manner, in strict respect and compliance with the general framework of Data Protection in force in the Portuguese legal system. As the person responsible for the processing of personal data and information, ISVOUGA guarantees that it carries out and promotes appropriate and effective technical and organizational measures to comply with the principles of data protection, in accordance with the provisions of the GDPR, and that it takes into account the nature, scope, context and purposes of processing information, as well as the risk of failures to protect the rights and freedoms of natural persons. Therefore, ISVOUGA makes available and disseminates, in a clear and extensive way, this Personal Data Protection Policy, which is why its academic community and all users recommend its careful and responsible reading.
Scope
This Personal Data Protection Policy applies exclusively to the processing of personal data carried out by ISVOUGA.
Personal Information
For the purposes of this Personal Data Policy, «Personal data» means information relating to an identified or identifiable natural person («data subject»). In these terms, a natural person is considered identifiable who can, directly or indirectly, be identified, in particular by reference to an identifying element – such as a name, an identification number, location data, identifiers electronically – or to one or more specific elements of that individual’s physical, physiological, genetic, mental, economic, cultural or social identity.
The data controller at the University
The entity responsible for the collection and processing of personal data is ISVOUGA, which in its context, decides what data is collected, the means of processing, the period of conservation and the purposes what they are used for.
Typology of personal data collected
ISVOUGA, within the scope of its activity, collects and processes the personal data necessary for the pursuit of its mission and duties, in accordance with the Legal Regime of Higher Education Institutions.
Collection of personal data
ISVOUGA collects personal data in person, by phone, in writing or through computer systems. The personal data collected are processed either by non-automated means (for example, manual files) or by computer and in strict compliance with the legislation on the protection of personal data, being stored in specific databases created for this purpose. In no case will the collected data be used for any purpose other than that for which consent was given by the data subject or the condition of processing legitimacy.
About the lawfulness of the processing of personal data
At ISVOUGA, the processing of personal data depends on verifying the legitimacy conditions and verifying the lawfulness of the purpose of that same treatment, as well as observing the principle of proportionality lato sensu. In particular, all processing of personal data at ISVOUGA will only occur as long as:
- It is necessary for the pursuit of legitimate interests and if the data subject has unequivocally given his consent;
- Is necessary for the performance of a contract or for the fulfillment of any legal obligation to which the controller is attached;
- Is necessary for the protection of vital interests of the data subject or another natural person;
- Is necessary for the exercise of public interest functions or the exercise of public authority in which the controller is invested;
- It is necessary for the pursuit of legitimate interests of the controller or the third party to whom the data is communicated, provided that the interests or rights, freedoms and guarantees of the data subject should not prevail.
About the purposes of processing personal data
Information on the processing of personal data is provided to the data subject at the time of collection or, if personal data has been obtained from another source, within a reasonable period, depending on the circumstances. When collecting data, ISVOUGA, as the controller, provides the holder of personal data with more detailed information about the use he will make of the information, namely:
- The identity and contact details of the controller.
- The contact details of the data protection officer.
- The purposes for which the processing of personal data is intended, as well as the legal basis for that same treatment.
- The recipients or categories of recipients of personal data.
- The rights of the data subject.
- The data retention period or the criteria used to define this period.
- Which data you must provide and which are optional.
The personal data processed by ISVOUGA can be legitimately transmitted to third parties when the fulfillment of purposes directly related to the legitimate functions of the data subject or the controller is verified. Whenever personal data are likely to be legitimately transferred to another recipient, the data subject is informed prior to the communication of personal data to third parties, and, when justified, may require that his personal data not be transferred, provided that this is does not harm the vital and legitimate interest of one of the parties or the public interest. Whenever ISVOUGA has the intention or need to process personal data for any purpose other than that for which it was collected, it will provide the data holder with information about that purpose and other information needed. When it is not possible to inform the data subject of the origin of the personal data held by the University, due to having resorted to several sources, he must be provided with all the information, which exists about that same source.
Retention period for personal data
The period during which data is stored and preserved varies according to the purpose of the respective treatment. ISVOUGA may retain personal data for as long as it may be required to assume some type of liability arising from a legal relationship, the performance of a contract or the application of pre-contractual measures. Whenever there is no specific legal requirement, the data will be stored and preserved only for the period necessary to fulfill the purposes that motivated its collection and treatment or for the period of time authorized by the Control Authority, after which they will be deleted. ISVOUGA, in the case of processing for the purposes of public interest archiving, or for the purpose of scientific or historical research, or for statistical purposes, may retain the data for longer periods, without prejudice to applying the appropriate guarantees, under the terms of the legislation in force, for the rights and freedoms of the data subject. These guarantees imply the adoption of technical and organizational measures aimed at ensuring, inter alia, compliance with the principle of data minimization.
Rights of data subjects
Pursuant to the legal framework on the Protection of Personal Data, ISVOUGA guarantees the data subject the right to access, update, rectify or delete their personal data, upon written request addressed to the data protection officer. When the data subject’s right of access undermines fundamental rights and legitimate interests of natural persons, this should be limited.
About security measures
ISVOUGA seeks to protect users’ personal data through various appropriate technical and organizational measures in order to guarantee the confidentiality, integrity, availability and resilience of personal data.
About the communication of personal data to other entities (subcontracted third parties)
ISVOUGA, within the scope of its attributions, may use third parties to provide certain services. When data processing is carried out by a subcontractor or third party to whom data are transmitted, ISVOUGA verifies that it has sufficient guarantees for the execution of appropriate technical and organizational measures, so that the processing meets the requirements of the legislation in force and ensures defense of the rights of the data subject. The treatment in these terms is regulated by contract or other normative act, which binds the subcontractor or the third party to the guidelines established by ISVOUGA, as the entity responsible for processing the data, and defines the object and duration of this treatment, the nature and purpose of the same , the type of personal data and the categories of data subjects and the obligations and rights of the controller.
The contract stipulates, inter alia, that the subcontractor or third party:
- It only processes personal data transmitted using documented instructions from ISVOUGA, including with regard to data transfers to third countries or international organizations, unless you are required to do so by Union or Member State law to which you are applying. is subject, in that case informing the person responsible for handling this legal requirement prior to processing, unless the law prohibits such information for important reasons of public interest;
- Ensures that persons authorized to process personal data make a commitment to confidentiality or are subject to appropriate legal obligations of confidentiality;
- Adopts the most appropriate security measures;
- Deletes or returns to ISVOUGA all personal data after the completion of the provision of services related to processing, deleting existing copies, unless data retention is required under Union or Member State law;
- Provides ISVOUGA with all the information necessary to demonstrate compliance with the obligations provided for in this article and facilitates and contributes to audits, including inspections, conducted by the controller or by another auditor appointed by this mandate;
- The subcontractor cannot hire another subcontractor without ISVOUGA’s authorization, and the request must be sent to the data controller.
In any case, ISVOUGA also remains responsible for the personal data it makes available.
About the transfer of personal data outside Portugal
The performance of certain assignments by ISVOUGA may involve the transfer of your data outside Portugal. ISVOUGA verifies in advance that the country or territory to which the data is transferred guarantees an adequate level of data protection or has been subject to an adequacy decision by the European Union. If so, ISVOUGA will strictly comply with the applicable legal provisions, as well as the guidelines approved by the administration.
About ISVOUGA online portals
ISVOUGA presents on its online portals a statement regarding the privacy practices related to the website (s). This declaration contains the identification of the collected data, technical information, as well as the security and confidentiality guarantees required by the Law and the other rights of the data subjects. ISVOUGA respects the right to privacy and does not store any personal information on the websites without the consent of the data subjects or in an unlawful manner. Regarding the collection and use of technical information, the sites may use cookies, namely session. Technical information will be used only for statistical purposes.
Changes to ISVOUGA’s personal data protection policy
ISVOUGA reserves the right, at any time, to readjust or amend this Privacy Policy, these changes being duly publicized.
Questions and suggestions
To find out more about how ISVOUGA treats your personal data, or to clarify any doubts, submit a complaint or comment on matters relating to Privacy and Protection of Personal Data, use the following contacts:
Rua António de Castro Corte Real Apartado 132 4520-181 Santa Maria da Feira
Tel.: 256 377 550
Fax: 256 377 559
e-mail: [email protected]
