Universidade Aberta is a distance learning higher studies institution, that within the accomplishment of its mission and in the relations and articulations it establishes with Society, has the need to handle citizens’ personal data.
Identification of the Data Controller
- Universidade Aberta (UAb)
- Headquarters: Palácio Ceia, Rua da Escola Politécnica, n.º 147, 1269-001 Lisboa – Portugal
- Fiscal Identification Number: 502 110 660
- General phone line: (+351) 213 916 300
Object
The present Policy applies to all personal data processing done under Universidade Aberta’s responsibility, including all its bodies and services as well as any data processor that carry out that type of data processing.
General Framework
Universidade Aberta, while performing its activities, collects and processes personal data necessary to the prosecution of its attributions according to the Legal Regime of Higher Learning Institutions (Law No. 62/2007, of September 10) and the Legal Regime of Higher Institution Distance Learning (Law decree No. 133/2019, of September 3). Universidade Aberta assumes the complete fulfilment of the provisions of (EU) Regulation 2016/679 of the European Parliament and of the 27th April 2016 Council - GDPR - and other applicable legislation, including national legislation supplementing the GDPR.and the Data Protection Act, Law 58/2019, of August 8, that assures the respective execution in the national legal order, as well as Law No. 26/2016, of August 22, which approves the regime for access to administrative and environmental and reutilization of administrative documents, beyond other pertinent legislation, either European or national.
Principles Regarding Personal Data Processing
On this issue, Universidade Aberta strictly complies with the principles of lawfulness, loyalty and transparency, end-use limitations, minimization, exactitude, data conservation time limits, as well as integrity and confidentiality, taking into consideration the content attributed to those principles by the applicable legislation.
The enforcement of the rules and the personal data processing policy at Universidade Aberta has been done by design of the systems and the processes and occurs by default in all the procedures. The conservation of activity records of processing, including the early deletion of the data is assured.
In the same way, necessary organizational and technical measures are implemented to ensure confidentiality, integrity, availability, and security in the data processing.
These demands are part of all instruments related to service supply by data processors, and their compliance is supervised by Universidade Aberta.
Rights of the Data Subjects
Universidade Aberta guarantees to data subjects the right to access, update, rectify, delete, limit or opposition to the processing of personal data concerning them. The University will only be able to employ processes that imply automatized individual decisions, including the definition of profiles on the terms stated by the European Committee for Data Protection.
Only if the Law determines otherwise, all personal data handled by Universidade Aberta result from:
- filling of forms by the respective subjects; or
- their consent to its obtention by third parties, after being explicitly informed of the specific and determined finalities of the respective processing.
Before starting any data processing that doesn’t occur of its attributions as a Public Higher Education Institution, Universidade Aberta asks for previous consent by the respective subjects, on the terms previously stated.
Universidade Aberta limits third party access to the data they are responsible for processing as foreseen on the Law. For example, within matters of scientific research the impact evaluation is demanded every time the data volume and/or quality or the use of new technologies advise it, unless its irreversible anonymization is ensured from the start.
Universidade Aberta does not keep records of its websites visitors, even if indirectly.
Data subjects can exercise their rights by contacting Universidade Aberta, who will provide a written answer (including by electronic means) to the subject’s request at the maximum deadline of a month counting from the reception of the request. Requests can be addressed through the following means:
- letter addressed to Universidade Aberta’s headquarters (through post office or delivered in person); or
- filling out this contact form.
Data subjects can complain directly to the Comissão Nacional de Proteção de Dados (National Data Protection Commission/CNPD) by using its available contacts at www.cnpd.pt.
Data Conservation Period
Personal data are kept only for the necessary period of time for the realization of the purposes for which they are processed.
Universidade Aberta commits to the legally established maximum deadlines of conservation. However, data can be kept for longer periods, in case of public interest and fulfilment of distinct purposes that may subsist, for example: the exercise of a right in a judicial process; archives of public interest; scientific or historical research; statistical uses. In such cases, all adequate technical and organizational means for the safekeeping of personal data are applied.
Those guarantees imply the application of technical and organizational means that ensures the respect for the data minimization principle and their pseudonymization.
Data Transfer for Third Party Countries
Universidade Aberta is a Higher Education Institution with various international partners. Normally, subjects’ personal data are not transferred to third party countries, although it can happen, for example in the case of mobility agreements for students, teaching and non–teaching staff and combined degree offers. In such cases, Universidade Aberta makes sure their data is transferred to countries that have an adequate policy on this issue, following articles 45 onwards of the GDPR, and takes due diligence in the sense of assuring that personal data are exclusively targeted to the purposes they were collected for and that the rights of the subjects are integrally respected.
Data Protection Officer
Considering the legal obligation that results from line a) of No. 1 of the 37th article of GDPR, Universidade Aberta designated a Data Protection Officer (DPO), that is responsible for ensuring, among other aspects, the conformity of the processing and personal data protection activities with the applicable legislation and the present Privacy Policy.
As such, the personal data subjects can address an enquiry to the DPO, concerning personal data processing and related topics, using this
contact form.
Privacy Policy Updates
Universidade Aberta reserves the right to proceed to updates regarding the present Privacy Policy. Such changes will be duly posted on the respective website and/or other adequate channels.
We recommend that you periodically consult our privacy policy to stay informed about how Universidade Aberta protect your Personal Data and keep up to date on the information and rights that assist you
Updated at: 2022.09.20