1. Introduction
Universidade Católica Portuguesa’s priority is to respect and ensure the privacy, confidentiality and security of your personal data and your rights as a data subject, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and with other applicable European and national legislation.
Universidade Católica Portuguesa is actively adopting GDPR implementation practices and policies and changing its procedures in order to contribute to the security, integrity and confidentiality of your personal data.
2. Purpose
The purpose of this Privacy Policy is to provide general information on Universidade Católica Portuguesa’s processing of your personal data, as well as on your rights as a data subject and how to exercise them. The Cookie Policy is governed by a separate document.
3. Personal Data
For the purposes of this Privacy Policy, the concept of “personal data” and any terminology, expressions and concepts related to data protection are those defined in the GDPR and in the national or European legislation in force at any given time.
4. Data controller
The controller of your data is Universidade Católica Portuguesa, legal entity no. 501082522, with its registered office at Palma de Cima, 1649-023, Lisbon, Portugal, telephone (+351) 217 21 40 00, which has appointed a Data Protection Officer (Data Protection Office) to carry out the duties assigned by law: compliance.rgpd@ucp.pt.
5. Collection and processing of personal data
A| Universidade Católica Portuguesa collects data relating to different categories of data subjects, such as, among others, students, staff, lecturers, researchers, clients, staff of corporate clients, representatives of UCP’s governing bodies and service providers. As a rule, information on the purposes of processing, the legal basis and the retention/storage periods for personal data is provided on the form used to collect them.
B| Universidade Católica Portuguesa may process various categories of personal data from the different categories of data subjects, such as: 1| Identification data, for example, name, nationality, address, contact details, citizen card and passport data and taxpayer number; 2| Academic and professional data, for example, proof of academic degree, diplomas, degree certificates, CV, position, role, job description, company, office address; 3| Professional activity data, for example, business activities, information relating to proceedings; 4| Billing and expense data, for example, fees.
C| In compliance with the principle of data minimisation, the personal data collected and processed are only those that are indispensable for their intended purpose.
6. Purpose, legal basis for processing and retention periods
Universidade Católica Portuguesa processes your personal data in the course of its activity and for specific purposes, such as, among others, the provision of teaching services, academic management, the performance and execution of employment, teaching, service provision and supply contracts, the dissemination of academic initiatives, the promotion of its courses, the use of infrastructures and the implementation of statutory and regulatory measures, as described in detail and duly set out in its record of processing activities, relying on the lawful bases provided for in Article 6 of the GDPR, such as consent, compliance with a legal obligation, performance of a contract, protection of the data subject’s vital interests, the exercise of functions in the public interest or legitimate interests pursued by Universidade Católica Portuguesa or third parties. Personal data are kept for the period strictly necessary for the purpose for which they were collected. In certain situations, namely where required by law, your personal data may be kept for longer periods.
7. Disclosure of personal data to other entities
Your personal data are processed exclusively by Universidade Católica Portuguesa and are confidential. As a rule, therefore, they will not be disclosed or in any way made available to third parties, except in certain situations, within the purposes of their collection and processing and on the legal grounds defined by law. Universidade Católica Portuguesa may share personal data with companies in which it holds an interest, with external entities such as public authorities, where required by law, or with processors such as certification bodies, external consultants, auditors, and providers of information technology, communications or other services, within the legal limits and framework.
8. Personal data received from entities outside Universidade Católica Portuguesa
Universidade Católica Portuguesa may receive your personal data from any partner entities or clients who certify that they have a lawful basis for disclosing them, and will process such data with the required transparency and confidentiality and in accordance with this Privacy Policy and other internal policies in force relating to the security and privacy of personal data.
9. Transfer of data to third countries
Universidade Católica Portuguesa is a research and teaching institution with various international partners. In principle, your personal data will not be transferred to third countries, although this may occur, namely under mobility agreements for students, lecturers and staff and joint degrees. In these cases, Universidade Católica Portuguesa ensures that the data are transferred to countries covered by an adequacy decision, under Articles 45 et seq. of the GDPR, and takes due steps to ensure that your personal data are used exclusively for the purposes for which they were collected and that the rights of data subjects are fully respected.
10. Rights of personal data subjects
A| Right of Access: whenever you request it, you may obtain confirmation as to whether your personal data are being processed by Universidade Católica Portuguesa. You may also access your personal data and obtain the following information: (I) the reasons why your personal data are processed; (II) the types of personal data processed; (III) the entities to which your personal data may be disclosed, including entities located in countries outside the European Union or international organisations, in which case you will be informed of the safeguards applied to the transfer of your data; (IV) the period for which your data will be kept or, if that is not possible, the criteria used to determine that period; (V) the rights you enjoy in relation to the processing of your personal data; (VI) if the personal data were not provided by you, information on their source; (VII) the existence of automated individual decisions, including profiling, and, in that case, information on the logic involved in such processing, as well as its significance and envisaged consequences.
B| Right to Rectification: whenever you consider that your personal data (objective personal data provided by you) are incomplete or incorrect, you may request that they be rectified or completed.
C| Right to Erasure: you may request that your personal data be erased where one of the following situations applies: (I) the personal data are no longer necessary for the purpose for which they were collected or processed; (II) you withdraw the consent on which the processing is based and there is no other legal basis for it; (III) you object to the processing of the data and there are no overriding legitimate interests, to be assessed case by case, justifying the processing; (IV) the personal data must be erased under a legal obligation to which Universidade Católica Portuguesa is subject; or (V) the personal data were collected in the context of the offer of information society services.
The right to erasure does not apply where processing is necessary for the following purposes: (I) exercising freedom of expression and information; (II) compliance with a legal obligation requiring the processing and applicable to Universidade Católica Portuguesa; (III) reasons of public interest in the area of public health; (IV) archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as the exercise of the right to erasure seriously impairs the achievement of the objectives of that processing; or (V) the establishment, exercise or defence of a right in legal proceedings.
D| Right to Restriction of Processing: restriction of processing allows the data subject to ask the controller to restrict access to personal data or to suspend processing activities. You may request restriction of the processing of your personal data in the following cases: (I) if you contest the accuracy of your personal data, for a period enabling Universidade Católica Portuguesa to verify their accuracy; (II) if Universidade Católica Portuguesa no longer needs the personal data for processing purposes, but such data are required for the establishment, exercise or defence of a right in legal proceedings; or (III) if you have objected to the processing, pending verification as to whether the legitimate interests of Universidade Católica Portuguesa override yours.
E| Right to Portability: you may ask Universidade Católica Portuguesa to provide, in a structured, commonly used and machine-readable format, the personal data you have provided. You also have the right to ask Universidade Católica Portuguesa to transmit those data to another controller, where technically feasible. The right to portability applies only in the following cases: (I) where the processing is based on express consent or the performance of a contract; and (II) where the processing is carried out by automated means.
F| Right to Object: you have the right to object to the processing of your personal data at any time, on grounds relating to your particular situation, in the following situations: (I) where the processing is based on the legitimate interest of Universidade Católica Portuguesa; or (II) where the processing is carried out for purposes other than those for which the data were collected, but compatible with them. In such cases, Universidade Católica Portuguesa will stop processing your personal data, unless it has legitimate grounds for such processing that override your interests. You may also object to the processing of your data for direct marketing purposes, including profiling related to such marketing.
G| Right to Withdraw your Consent: where the processing of data is based on your consent, you may withdraw that consent at any time. Universidade Católica Portuguesa has a specific form for exercising your rights, in which you will be asked for proof of your identity. Please bear in mind that your requests may not be met immediately; you will be informed, within 30 days of submitting the request, of the measures under way.
11. Confidentiality and security of your personal data
Universidade Católica Portuguesa is committed to ensuring the protection of your personal data, based on the principles of integrity, confidentiality and availability. To this end, it uses appropriate technical and organisational measures to protect the confidentiality and security of your personal data, in accordance with the GDPR. Our systems undergo periodic reviews to ensure that your personal data are protected. However, it is not possible to guarantee the complete security of information transmitted over the internet.
The technical and organisational security measures adopted by Universidade Católica Portuguesa are also required of service providers who may process personal data on its behalf.
In the event of a security breach causing the destruction, loss, alteration, disclosure of, or unauthorised access to, personal data, Universidade Católica Portuguesa will notify the supervisory authority within the legal time limit and, where applicable, the data subject directly affected by the data breach.
12. Updates to the Privacy Policy
This Privacy Policy may be amended and updated, so it is advisable to consult it regularly.
Last updated: 30 July 2020