Privacy Policy – CEDIS Website
SCOPE
This privacy policy applies to the processing of personal data of research members and website users of CEDIS – Centro de Investigação e Desenvolvimento sobre Direito e Sociedade da Universidade Nova de Lisboa (hereafter “CEDIS-UNL”).
WHO ARE WE?
Personal data will be processed by CEDIS-UNL, a research centre of the NOVA School of Law – an organic unit of UNL – whose mission is to contribute to the development of Legal Science, promoting productivity, scientific merit and innovation in research.
For the purposes of the applicable legislation on personal data protection and, in particular, the General Data Protection Regulation (hereinafter, “GDPR”), UNL – collective entity no. 501 559 094 with headquarters at Campus de Campolide, 1099-032 Lisbon – shall be the controller of the personal data it processes, in the sense in which such expressions are defined and used in the GDPR.
WHAT PERSONAL DATA DO WE PROCESS?
In order to respect the principle of minimization, in the context of the creation and availability in the website of the researcher profiles, CEDIS-UNL treats the following personal data of its researcher members:
- Name;
- Username and password;
- E-mail address
- Telephone contact;
- Address;
- Country of origin and nationality;
- Gender;
- Ciência ID and FCT association key;
- Identification document number;
- Academic qualifications;
- Information of their (eventual) contract with FCT.
Optionally, researchers may also share with CEDIS-UNL the following personal data:
- ORCID and Scopus ID;
- Cienciavitae or other Curriculum Vitae;
- Academic and professional background;
Regarding the users of the website, CEDIS-UNL collects their personal data through the implemented cookies, namely:
- IP of users browsing the website;
- [add others when the development of the website is completed].
CEDIS-UNL ensures that only personal data deemed strictly necessary to ensure the pursuit of the purposes set out below will be processed.
WHAT ARE THE PURPOSES OF PROCESSING PERSONAL DATA?
The processing of the data identified above allows CEDIS-UNL to
Disseminate relevant information to CEDIS members and website users, namely, institutional information (including its Regulations), evaluation results, activities plan and reports, composition of its Director and Scientific Councils, as well as its technical team, news and activities of CEDIS and its researchers;
To make available and divulge its groups/research lines, its activities and scientific production, as well as the projects in which CEDIS coordinates or participates;
To serve as a platform for the registration of researchers and to disseminate the list of research team members, through the creation of individual profiles, managed by the researchers themselves
Disseminate announcements of events that are of interest to CEDIS or held by it, as well as announcements of calls for grants, positions, awards, calls for publications and for participation in projects;
Moreover, as a research centre of the UNL, which embraces scientific projects funded by external funding bodies, CEDIS-UNL has reporting and contractual obligations to these bodies and to the UNL, as well as legal obligations to the Directorate General of Education and Science Statistics (DGEEC). To this end, it also needs to process the personal data of CEDIS researchers, for the purposes of monitoring their scientific production, evaluation of projects by funding agencies, monitoring of national scientific and technological potential and quality assessments of UNL.
WHAT IS THE LAWFULNESS CONDITION?
Depending on the purpose of the specific processing, your data will be processed by CEDIS-UNL because they are necessary
- for the execution of pre-contractual diligences and/or a contract, if you are part of an externally funded scientific project (art. 6.1 b) of the GDPR);
- to comply with legal obligations to which CEDIS-UNL is subject (art. 6.1 c) of the GDPR);
- for the purposes of the legitimate interests pursued by CEDIS-UNL or third parties, provided that these interests are weighed against the fundamental rights and freedoms of the data subject (art. 6.1 f) of the GDPR).
With regard to the navigation data mentioned above – collected using cookies – these may also be processed based on the express consent of the user (art. 6.1 a) of the GDPR).
HOW LONG DO WE KEEP PERSONAL DATA?
In order to ensure that personal data are only kept for the necessary period of time, CEDIS-UNL has set deadlines for the erasure or anonymization of processed data.
Where time limits for erasure/anonymization cannot be predicted, CEDIS-UNL will periodically review the need to retain the data in question.
In certain cases, the retention of your data may occur for longer periods, namely, when required by law.
WHAT SECURITY MEASURES HAVE BEEN ADOPTED TO PROTECT PERSONAL DATA?
Information security and personal data protection are priorities for CEDIS and UNL. For this reason, UNL has implemented and maintains a set of technical and organisational measures that, taking into account the most advanced techniques, implementation costs, the nature, scope, context and purposes of each personal data processing, allow to mitigate the risks for the personal data subject and prevent the occurrence of personal data breaches and security incidents in general.
In particular, the following measures stand out, among others:
- Development of the necessary efforts to ensure that third parties collaborating with CEDIS-UNL guarantee adequate protection of the personal data to which they have access;
- Limiting access to personal data to specific persons, and only when their contact with such personal data is justified within the scope of their functions;
- Storage of all personal data processed by CEDIS-UNL in servers that offer security guarantees, including access control and backups;
TO WHOM DO WE TRANSMIT YOUR DATA?
In the pursuit of its mission, as a research centre of UNL, and in compliance with contractual and legal obligations to which it is subject, CEDIS may have to share the personal data of its research members with other entities.
In particular, in the context of externally funded scientific projects, CEDIS may have to share the profiles of its researchers with funding entities such as the Fundação para a Ciência e a Tecnologia (FCT), in order to comply with contractual obligations to which it is subject.
The personal data of its researchers may also be shared with the Directorate General for Education and Science Statistics (DGEEC), for the purpose of monitoring its scientific production and the national scientific and technological potential, in compliance with legal obligations to which it is subject.
As CEDIS is a research centre of UNL, your personal data may be shared with the NOVA School of Law and with UNL, for the purposes of monitoring and quality assessment.
Any sharing or transfer of personal data will only be made to third parties who ensure adequate protection of the personal data to which they have access or who act exclusively under the guidance of CEDIS-UNL (subcontractors) and who comply with technical and organizational measures similar to those to which CEDIS-UNL is bound.
DATA TRANSFERS TO COUNTRIES OUTSIDE THE EUROPEAN UNION
In the context of the normal operation of the CEDIS website, no data transfers occur outside the European Economic Area, so that the personal data of the holders are not stored or accessed in States whose legal systems do not confer a degree of protection equivalent to that required by the GDPR.
WHAT ARE THE RIGHTS OF DATA SUBJECTS?
Data subjects may at any time exercise their rights, including requesting further information regarding the processing of their data, rectifying their data, as well as, within certain limits, erasing their data, revoking consent given or opposing the processing of their data, among others, via the email address cedis@novalaw.unl.pt. They may also contact the UNL Data Protection Officer at dpo@unl.pt.
Personal data subjects should be aware that in certain cases (e.g. due to legal requirements) their request may not be granted. In any case, they will be informed of the measures taken in this regard within one month of the request being made.
Data subjects also have the right to lodge a complaint with the supervisory authority, which in Portugal is the Comissão Nacional de Proteção de Dados at https://www.cnpd.pt/.
This page should be consulted regularly by users of the CEDIS website, as this privacy notice may be updated from time to time.
– Page updated on 7 December 2021 –