1. Introduction
2. Objectives
3. Personal Data
4. Responsible for treatment
5. Collection and Processing of Personal Data
6. Purpose, Lawfulness of Processing and Retention Periods
7. Transfer of Personal Data to Other Entities
8. Personal Data Received from Entities Outside Universidade Católica Portuguesa
9. Transfer of Data to Third Countries
10. Rights of the Data Subject
11. Confidentiality and Safety of Your Personal Data
12. Privacy Policy Updates
1. Introduction
Universidade Católica Portuguesa is strongly committed to respecting and ensuring the privacy, confidentiality and safety of your personal data and of your rights as a data subject, in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and other applicable European and national legislation.
Universidade Católica Portuguesa is actively adopting practices and policies to implementing the GDPR and to modify its procedures in order to contribute to the safety, integrity and confidentiality of your personal data.
2. Objectives
The purpose of this Privacy Policy is to provide general information on how your personal data are processed at Universidade Católica Portuguesa, as well as on your rights as a data subject and how you may exercise these rights. Our Cookie Policy is set out in a separate document.
3. Personal Data
Para efeitos da presente Política de Privacidade, o conceito de “dados pessoais” bem como quaisquer terminologias, expressões e conceitos relacionados com proteção de dados são aqueles que vêm definidos no RGPD e na legislação nacional ou europeia em vigor a cada momento.
4. Responsible for treatment
The entity responsible for processing your data is Universidade Católica Portuguesa, legal person nº 501 082 522, headquartered at Palma de Cima, 1649-023, Lisboa, Portugal, telephone (+351) 217 214000, a Data Protection Officer having been appointed to discharge its legally entrusted duties: compliance.rgpd@ucp.pt.
5. Collection and Processing of Personal Data
A| Universidade Católica Portuguesa collects data related to different categories of data subjects, including but not limited to: students, collaborators, teachers, researchers, clients, companies associated to clients, and representatives of UCP's governing bodies and service providers. As a rule, information regarding the purposes of processing, the lawfulness and the length of time data can be retained and stored is detailed in the data collection form.
B| Regarding the different categories of data subjects, Universidade Católica Portuguesa can process different categories of personal data, namely: 1| Identification data, such as name, nationality, home address, contacts, citizen card details, passport and taxpayer number; 2| Academic and professional data, such as proof of academic degree, diplomas, degree letters, CV, position, function, job description, company, work address; 3| Professional activity data, such as business activities, information related to cases; 4| Billing and expenditure data, such as fees.
C| In compliance with the principle of data minimisation, the personal data collected and processed are limited to those which are indispensable for the purpose for which they are intended.
6. Purpose, Lawfulness of Processing and Retention Periods
Universidade Católica Portuguesa processes your personal data within the scope of its activity and for specific purposes, including but not limited to: provision of teaching; academic administration; fulfilment and execution of employment and teaching contracts; provision and supply of services; dissemination of academic initiatives; promotion of academic degrees; for the use of infrastructures; execution of statutory and regulatory measures, detailed and duly laid out in the registry of their processing activities, based on the principle of lawfulness of processing provided for in Article 6 of the GDPR, such as: consent; compliance with a legal obligation; performance of a contract; protecting the vital interests of the data subject; performance of a task carried out in the public interest or for the purposes of the legitimate interests pursued by Universidade Católica Portuguesa or third parties. Personal data are stored for no longer than the period strictly necessary for the purpose for which they were collected. In certain situations, namely by legal obligation, your personal data may be kept for longer periods.
7. Transfer of Personal Data to Other Entities
Your personal data are confidential and are exclusively processed by Universidade Católica Portuguesa. Therefore, as a rule, they will not be transferred or in any way made available to third parties, except in certain situations, within the purposes of their collection and processing and within the legally defined lawfulness principle. Universidade Católica Portuguesa may share personal data with its affiliated companies, with external entities such as public authorities, pursuant to legal obligation, or with subcontractors such as certifying entities, external consultants, auditors, information technology, communications or other service providers, within the limits and legal framework.
8. Personal Data Received from Entities Outside Universidade Católica Portuguesa
Universidade Católica Portuguesa may receive your personal data through any partner entities or clients, who have certified to the lawfulness of the transfer and will process such data with the required transparency and confidentiality and in accordance with the present Privacy Policy and other internal policies in force related to safety and privacy of personal data.
9. Transfer of Data to Third Countries
Universidade Católica Portuguesa is a research and teaching institution with several international partnerships. Your personal data, as a matter of principle, will not be transferred to third countries, although this may occur, namely within the scope of mobility agreements for students, lecturers and staff, and of joint degrees. In such cases, Universidade Católica Portuguesa shall ensure that the data are transferred to countries on the basis of an adequacy decision, under the terms of Articles 45 and following of the GDPR and it shall take due care to ensure that your personal data are exclusively intended for the purposes for which they were collected and that your rights as a data subject are fully respected.
10. Rights of the Data Subject
A| Right of Access: upon request, you have the right to obtain confirmation as to whether your personal data are being processed by Universidade Católica Portuguesa. You also have the right to access your personal data and obtain the following information: (I) the purposes of the processing; (II) the categories of personal data concerned; (III) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations, in which case you shall be informed of the guarantees applied to the transfer of your data; (IV) the period for which the personal data will be stored or, if not possible, the criteria used to determine that period; (V) the rights you enjoy in relation to the processing of your personal data; (VI) where the personal data are not collected from you, any available information as to their source; (VII) the existence of automated decision-making, including profiling, and, in those cases, information about the logic involved, as well as the significance and the envisaged consequences of such processing.
B| ) Right of Rectification: should you consider that your personal data (objective personal data you provided) are incomplete or incorrect, you can request their rectification or that the data be completed.
C| Right to Erasure: you can request that your personal data be deleted whenever one of the following situations occurs: (I) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (II) you withdraw your consent on which the processing is based and where there is no other legal ground for the processing; (III) you object to the processing of data and there are no overriding legitimate grounds for the processing, to be assessed on a case-by-case basis, which justify the processing; (IV) personal data have to be erased for compliance with a legal obligation to which the Universidade Católica Portuguesa is subject; or (V) the personal data have been collected in relation to the offer of information society services.
The right to erasure shall not apply when processing is necessary for the following purposes: (I) exercising the right of freedom of expression and information; (II) compliance with a legal obligation which requires processing to which Universidade Católica Portuguesa is subject; (III) reasons of public interest in the area of public health; (IV) archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (V) establishment, exercise or defence of legal claims.
D| Right to Restriction of Processing: restriction of processing enables the data subject to request the controller to restrict access to personal data or to suspend processing activities. You can request restriction of processing of your personal data in the following cases: (I) if you contest the accuracy of your personal data, for a period enabling Universidade Católica Portuguesa to verify the accuracy of such data; (II) if Universidade Católica Portuguesa no longer needs the personal data for the purposes of the processing, but if the data are required for the establishment, exercise or defence of legal claims; or (III) if you have objected to processing pending the verification whether the legitimate grounds of Universidade Católica Portuguesa override your own.
E| Right to data portability: you can request to receive the personal data you provided to Universidade Católica Portuguesa in a structured, commonly used and machine-readable format. You also have the right to request that Universidade Católica Portuguesa transmit those data to another controller, where technically feasible. The right to data portability is limited to where: (I) the processing is based on consent or on a contract; and (II) the processing in question is carried out by automated means.
F| Right to Object: you have the right to object, at any time, on grounds relating to your particular situation, to processing of your personal data in the following situations: (I) When the processing is grounded on the legitimate interest of Universidade Católica Portuguesa; or (II) When the processing is carried out for purposes other than those for which the data were collected, but which are compatible with the same. In such cases, Universidade Católica Portuguesa shall no longer process your personal data unless it demonstrates compelling legitimate grounds for the processing which override your own interests as a data subject. You also have the right to object where personal data are processed for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing.
G| Right to Withdraw Consent: where data processing is based on consent, you shall have the right to withdraw your consent at any time. Universidade Católica Portuguesa provides a form regarding the exercise of your rights, where you are asked to provide proof of identity. You should note that your request may not be answered immediately, and that you shall be informed of the measures in progress within 30 days of submission of the request.
11. Confidentiality and Safety of Your Personal Data
Universidade Católica Portuguesa is committed to ensuring the protection of your personal data, based on the principles of integrity, confidentiality and availability. For this purpose, it employs technical and organizational measures adequate to protect the confidentiality and safety of your personal data, in accordance with the GDPR. Our systems are subjected to periodic analyses to ensure that your personal data are protected. It is not possible, however, to guarantee the total security of the information transferred over the internet.
The technical and organizational security measures adopted by Universidade Católica Portuguesa are also required of any service providers who may process your personal data.
Should there be a security breach that causes destruction, loss, alteration, disclosure, or unauthorized access to personal data, Universidade Católica Portuguesa shall inform the supervisory authority of the data breach within the legal deadline and, if applicable, the data subject directly affected by the data breach.
12. Privacy Policy Updates
This Privacy Policy may be subject to changes and updates, and should therefore be regularly consulted.
Last updated: July 30, 2020