Data and Privacy Protection Policy
Data and Privacy Protection Commitment
UNIVERSITY OF ALGARVE complies with all legal, European and national standards that are applicable with regard to data and privacy protection and security of information.
UNIVERSITY OF ALGARVE is currently implementing a Personal Data Protection System and an Information Security System, in order to ensure compliance with standards and to demonstrate or provide evidence of institutional responsibility with regard to data protection and security of information, implementing all necessary technical and organizational measures, with regard to compliance with the general legal framework of the applicable Data Protection Law and with regard to the legal framework of the General Data Protection Regulation, applicable as of 25 May 2018 .
For further clarification or information, or in order to exercise the rights related to this area, please contact the Data Protection Officer of the UNIVERSITY OF ALGARVE via e-mail address firstname.lastname@example.org.
“Personal data” refers to information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier. Personal identifiers refer to, for instance, a name, an identification number, location data, electronic identifiers, or to one or more specific pieces of information regarding the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing of Personal Data”
“Processing” refers to any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction.
“Cookies” are small text files containing information that is considered relevant and that devices that are used for access (computers, mobile phones or portable mobile devices) load via the browser when a website is visited by the User (Recipient of the Service, Student or Citizen).
University of Algarve with its head office at Campus da Penha, Estrada da Penha, 8005 139, Faro, Portugal, legal person governed by public law, Tax No. 505 387 271, henceforth referred to as UNIVERISTY OF ALGARVE, is the entity responsible for the website www.ualg.pt and for the IT applications, referred to below as channels or applications, via which “Users” (Recipients of the Service, Students or Citizens have remote access to the UNIVERISTY OF ALGARVE services that are presented, marketed or supplied at any time through these means.
Use of the channels or applications by any “User” (Recipient of the Service, Student or Citizen) may imply the undertaking of personal data processing operations in which the protection, privacy and security is ensured by UNIVERISTY OF ALGARVE, as the entity responsible for the respective processing, pursuant to the terms of this Data and Privacy Protection Policy.
Data Controller Contacts
If you wish to contact the Data Protection Officer of the UNIVERSITY OF ALGARVE please send an e-mail to email@example.com, describing the subject of your query and indicating an e-mail address, a telephone number or a postal address.
For all other matters, please use the following general contact information for the UNIVERSITY OF ALGARVE:
- Postal Address: Campus da Penha, Estrada da Penha,
- E-mail: firstname.lastname@example.org
- General Phone: 00351 289 800 100
- General Fax: 00351 289 800 061
Collection and Processing of Personal Data
UNIVERSITY OF ALGARVE processes personal data which is strictly necessary for supplying information and for operating its channels, in accordance with usage by “Users” (Recipients of the Service, Students or Citizens), whether it be data that is supplied by “Users” (Recipients of the Service, Students or Citizens) for the purpose of registering requests or obtaining information, whether it be data supplied by “Users” (Recipients of the Service, Students or Citizens) for the purpose of using those channels, or that data resulting from the use of the services supplied by UNIVERSITY OF ALGARVE through the channels, or accesses, consultations, instructions, transactions and other records regarding their usage.
In particular, use or activation of certain functionalities of the channels may imply processing various direct or indirect personal identifiers, such as name, residential address, contact information, device addresses or geographical location, whenever the “User” (Recipient of the Service, Student or Citizen) has given his/her express consent.
In all cases “Users” (Recipients of the Service, Students or Citizens) shall always be informed of the need to access such data in order to use the functionalities of the channels in question.
The personal data that is collected by UNIVERSITY OF ALGARVE is processed by computer, in some cases in an automated fashion, including the processing of files or the creation of profiles and with regard to managing the precontractual or post-contractual relationship with the “Users” (Recipients of the Service, Students or Citizens), pursuant to national and European standards that are in force.
Categories of Processed Personal Data
The categories or types of personal data of “Users” (Recipients of the Service, Students or Citizens) who are the subjects of processing are as follows: first name, last name, date of birth, processing, address 1, address 2 (door number and floor, address 3 (locale), post code, name of post code, country, country dialing code, landline phone number, mobile phone number, e-mail, name of the employer company (not mandatory), citizen card number, tax number, social insurance number, student number, NIB (Portuguese basic bank account number) (not mandatory), IBAN (not mandatory), SWIFT (not mandatory) and photograph.
All operations pertaining to data processing complies with the basic legal guidelines regarding data protection and privacy, namely with regard to their circulation, legality, accuracy, transparency, purpose, minimization, preservation, preciseness, integrity and confidentiality, and UNIVERSITY OF ALGARVE shall be available to demonstrate its responsibility to the data subject or any other third party entity with a legitimate interest in the matter.
Basis for Legitimacy
All data processing operations undertaken by UNIVERSITY OF ALGARVE have a basis of legitimacy, namely because the data subject gave his/her consent for the processing of his/her personal data for one or more specific purposes, whether it is because the processing is considered necessary for executing a contract in which the data subject is a party, or due to precontractual diligence at the request of the data subject, or because the processing is necessary for complying with a legal obligation that the controller is subject to, whether for public interest reasons or because the processing is considered necessary in light of the legitimate interests pursued by UNIVERSITY OF ALGARVE or by third parties.
Purpose of Processing
All personal data processed through the UNIVERSITY OF ALGARVE channels shall be exclusively used for supplying information to “Users” (Recipients of the Service, Students or Citizens), for managing the personal information of the Recipients of the service considered necessary for managing the relationship or communication, as well as providing services to “Users” (Recipients of the Service, Students or Citizens) and, in general, managing the precontractual, contractual or post-contractual relationship with “Users” (Recipients of the Service, Students or Citizens) .
The collected personal data may also and possibly be the object of processing for statistical purposes, for information dissemination or promotional actions, and for communication actions, namely, to promote dissemination actions pertaining to cycles of study, new functionalities or new services via direct communication, whether via postal correspondence, e-mail, messages or telephone calls, or any other electronic communications service.
The previous information always being guaranteed, along with obtainment of the express authorization for these latter purposes, the “Users” (Recipients of the Service, Students or Citizens) can, at any time exercise their right to object to the use of their personal data for other purposes that extrapolate management of the relationship with UNIVERSITY OF ALGARVE, namely for the purposes of pursuing public interest, for sending informative communications or for inclusion on lists or informative services, thus requiring a written request to be sent to the Data Protection Officer of the UNIVERSITY OF ALGARVE, as per the procedures indicated below .
Period for which Data are Stored
Personal data shall be stored only for the period of time necessary for the purposes that led to their collection or their later processing, in full compliance with all legal guidelines applicable to archives.
UNIVERSITY OF ALGARVE may, possibly, use two broad categories of cookies: cookies pertaining to websites and cookies pertaining to direct electronic communication channels, both categories always allow respective deactivation by the “Users” (Recipients of the Service, Students or Citizens).
Cookies used by UNIVERSITY OF ALGARVE on all its channels do not gather personal information that allow for identification of “Users” (Recipients of the Service, Students or Citizens) and they store only general information, namely the form or geographical location of access and the manner in which Users use the channels, and other means. Cookies only contain information related to the preferences of “Users” (Recipients of the Service, Students or Citizens); no personal identifiers are recorded.
“Users” (Recipients of the Service, Students or Citizens) may, at any time, via their internet browser, decide to be notified when they receive cookies or choose to block cookies from their system.
Regarding the type of purposes, UNIVERSITY OF ALGARVE may, possibly, whenever justified, use three different types of cookies according to the following specifications:
- essential cookies – some cookies are essential to accessing specific areas of the online channels, permitting browsing and use of applications, namely accessing secure areas of websites through user registration – without these cookies, services that require this cannot be provided;
- functionality cookies –functionality cookies allow the user’s website browsing preferences to be remembered, thus eliminating the need to reconfigure and personalize with each visit;
- analytics cookies – these cookies are used to analyze how “Users” (Recipients of the Service, Students or Citizens) use websites, allowing articles or services to be highlighted that may be of interest to “Users” (Recipients of the Service, Students or Citizens), monitoring the performance of websites and knowing which pages are the most popular, determining the method of connection between pages that is most effective or determining why some pages are receiving error messages – these cookies are used only for statistics creation and analysis and they never collect personal information.
For these purposes, UNIVERSITY OF ALGARVE may personalize information and offers, and identify or correct any problems that may arise in relation to usage.
In relation to the type of expiration, there are two types of cookies:
- persistent cookies – these are cookies that remain stored in the devices used to access the channels (computers, mobile phones, etc.) via the browser, and they are always used whenever “Users” (Recipients of the Service, Students or Citizens) re-visit any channel – in general, they are used to direct browsing in accordance with the interests of the “User” (Recipient of the Service, Student or Citizen), allowing UNIVERSITY OF ALGARVE to provide a more personalized service;
- session cookies – these are temporary cookies that are generated and only remain available until the session is closed, given that the next time the “User” (Recipient of the Service, Student or Citizen) accesses his/her website browser the cookies will no longer be stored – the information obtained allows sessions to be managed, problems to be identified and a better browsing experience can be offered.
“Users” (Recipients of the Service, Students or Citizens) can deactivate part or all of the cookies at any time – all they have to do is follow the instructions provided in the internet browser that they use; however, if they deactivate the cookies they may lose access to some of the website functionalities.
Also, within this category of cookies, “Users” (Recipients of the Service, Students or Citizens) always have the possibility of deactivating the sending of electronic communications via the specific option indicated at the footnote of these communications.
Communication of Data to other Entities
The availability of information or the supply of services by UNIVERSITY OF ALGARVE to its “Users” (Recipients of the Service, Students or Citizens) via the channels may eventually entail the use of third party services provided by subcontracted entities, including entities whose head office is located outside of the European Union in order to supply certain services, and this may imply access to personal data of the “Users” (Recipients of the Service, Students or Citizens) by these entities .
Under these circumstances and whenever necessary, UNIVERSITY OF ALGARVE shall only use subcontracted entities that offer sufficient guaranties of execution of adequate technical and organizational measures in a manner that ensures that the processing satisfies the requirements of the applicable standards; such guarantees are formalized in a contract that is signed between UNIVERSITY OF ALGARVE and each third party entity.
Except for compliance with legal obligations, under no circumstance shall the data of “Users” (Recipients of the Service, Students or Citizens) be communicated to third party entities that are not subcontracted or legitimate recipients, and no other communication shall be made for purposes other than those mentioned above.
International Data Transfers
Any transfer of personal data to a third-party country or international organization shall only be carried out by virtue of compliance with legal obligations or in guaranteed compliance with European and domestic legal norms applicable to this matter.
Taking into account the most advanced techniques, the application costs and the nature, scope, context and purpose of the processing, along with the risks of probability and variable gravity for “Users” (Recipients of the Service, Students or Citizens), UNIVERSITY OF ALGARVE and all the entities that it subcontracts apply the technical and organizational measures that are suited to ensuring a level of security that is suited to the risk.
As such, various security measures have been adopted in order to protect personal data against diffusion, loss, undue usage, change, processing or unauthorized access, as well as against any other form of illicit processing.
It is the exclusive responsibility of “Users” (Recipients of the Service, Students or Citizens) to maintain access codes confidential, refraining from sharing them with third parties, and specifically with regard to the IT applications used to access the channels, maintain and preserve the devices used for access under the proper security conditions and follow the security practices advised by the manufacturers and/or operators, namely with respect to installing and updating the necessary security applications, namely, among others, antivirus applications.
Whenever it is necessary to subcontract services from third party entities that may have access to personal data of “Users” (Recipients of the Service, Students or Citizens), subcontractors hired by UNIVERSITY OF ALGARVE shall be obliged to adopt security measures and protocols at an organizational level, along with technical measures necessary for protecting the confidentiality and security of the personal data, as well as preventing unauthorized access, loss or destruction of personal data.
Rights of the Data Subjects
“Users” (Recipients of the Service, Students or Citizens) of the UNIVERSITY OF ALGARVE may, as personal data subjects, at any time, exercise their rights to data protection and privacy, namely right of access, rectification, erasure, portability, restriction, or objection to processing, in accordance with the terms and limitations stipulated in the applicable norms.
Any request to exercise rights pertaining to protection of data and privacy shall be drafted in writing by the respective data subject and sent to the Data Protection Officer, in accordance with the procedure and contact listed below.
Complaints or Suggestions and Reporting of Incidents
“Users” (Recipients of the Service, Students or Citizens) of the UNIVERSITY OF ALGARVE are entitled to submit a complaint, whether by filing a complaint in the Complaints Book or by submitting a complaint to the regulatory authorities. “Users” (Recipients of the Service, Students or Citizens) may also make suggestions via e-mail to email@example.com.
UNIVERSITY OF ALGARVE is currently implementing an incident management system related to data and privacy protection and security of information.
If a “User” (Recipient of the Service, Student or Citizen) wishes to report the occurrence of any situation of violation of personal data that accidentally or illicitly causes destruction, loss, unauthorized alteration, disclosure, or access to personal data that has been transmitted, stored or subject to any type of processing, may contact the Data Protection Officer or use the general contacts of the UNIVERSITY OF ALGARVE as described above.
In order to ensure respective ongoing updating, development and improvement, UNIVERSITY OF ALGARVE may, at any time undertake the changes to this Data and Privacy Protection Policy that are considered suitable or necessary, their publication being ensured in the various channels in order to guarantee the respective transparency and information to the “Users” (Recipients of the Service, Students or Citizens).
Express Consent and Acceptance
The terms of the Data and Privacy Protection Policy are complementary to the terms and provisions pertaining to personal data as stipulated in the General Usage Conditions of the UNIVERSITY OF ALGARVE channels.
Free, specific and informed provision of personal data by the respective subject implies knowledge and acceptance of the conditions of this Policy, considering that by using the channels or providing their personal data, “Users” (Recipients of the Service, Students or Citizens) are expressly authorizing the processing of their data in accordance with the rules stipulated in each of the channels or applicable collection instruments.
Data Protection Officer
In order to exercise any type of rights of data protection and privacy or regarding any subject pertaining to the data protection, privacy and security of information, “Users” (Recipients of the Service, Students or Citizens) who interact with UNIVERSITY OF ALGARVE may contact the Data Protection Officer via e-mail address firstname.lastname@example.org, describing the subject of the request and indicating an e-mail address, telephone number or postal address.
Version 1.1, Published on 28 November 2018
Download a PDF file of the University of Algarve's Data and Privacy Protection Policy here.