Privacy Policy
Privacy Policy of the Faculty of Veterinary Medicine of the University of Lisbon
The Faculty of Veterinary Medicine of the University of Lisbon (hereinafter referred to as FMV-ULisboa) is a public legal entity forming part of the University of Lisbon, with statutory, scientific, pedagogical, cultural, administrative, financial and asset management autonomy.
Within the scope of its mission, FMV-ULisboa provides, through its institutional website, information concerning its activities with the aim of disseminating them to the academic community, society at large and all other interested parties.
FMV-ULisboa is committed to protecting the privacy and security of all its students, academic staff and employees (hereinafter referred to as “Users”). These principles are fundamental to its organisation and operations, ensuring compliance with its legal obligations, in particular those arising from the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of 27 April 2016) and Portuguese Data Protection Law (Law No. 58/2019 of 8 August).
To this end, FMV-ULisboa has implemented a range of measures designed to strengthen its Privacy Policy.
FMV-ULisboa processes personal data across its various areas of activity, both within its physical premises and through its online platforms, making the protection of such personal data a key priority.
FMV-ULisboa also seeks to ensure that all its Users are aware of the rules and principles governing the protection and processing of personal data and is committed to safeguarding such data in accordance with the requirements and procedures laid down in the applicable legislation.
1. FMV-ULisboa Privacy Policy
General Framework
In strict compliance with the law, FMV-ULisboa has introduced new security practices and strengthened its internal procedures with the constant objective of ensuring the security of the data to which it has access. To this end, it promotes, across each of its research units and other constituent units, structures and services, a harmonised data processing policy through the implementation of coordinated measures designed to establish common practices for the processing, protection and security of personal data, while respecting the autonomy and responsibility of each of these entities in relation to the processing of personal data.
The protection of Personal Data is a fundamental right. Accordingly, your privacy is of paramount importance to FMV-ULisboa. This Privacy Policy explains the Personal Data we collect, the purposes for which it is processed, the principles governing its use, and the rights of the individuals to whom the data relates.
With the aim of safeguarding personal data protection, FMV-ULisboa, acting as the Data Controller, undertakes to:
- Ensure that Personal Data are processed solely for the purpose(s) for which they were originally collected, or for purposes that are compatible with those original purposes.
- Commit to implementing a culture of data minimisation, whereby only the Personal Data that are strictly necessary for carrying out its activities are collected, used and retained.
To this end, we recommend that you read this Privacy Policy carefully in order to understand your rights, the conditions under which you provide your personal data, and the circumstances in which you authorise its collection, use and disclosure.
2. FMV-ULisboa’s Commitment
3. Protecting Your Personal Data
Through this Policy, FMV-ULisboa recognises the importance of the security of the personal data it processes and is committed to safeguarding the privacy of data subjects while ensuring the effective delivery of its activities across all areas of operation.
This Policy also provides information on the rules, principles and good practices observed by FMV-ULisboa in relation to the processing of personal data entrusted to it, in accordance with the General Data Protection Regulation (GDPR) and other applicable legislation. It further explains the means available to data subjects for exercising their rights.
4. Data Controller
5. Data Protection Officer
- Monitoring compliance with the applicable data protection legislation;
- Acting as the point of contact for queries relating to the processing of personal data;
- Cooperating with the Portuguese Data Protection Authority (CNPD) in its capacity as the supervisory authority;
- Providing information and advice to FMV-ULisboa and its data processors regarding their obligations concerning privacy and data protection.
Accordingly, data subjects may contact the Data Protection Officer regarding any matter relating to the processing of their personal data using the following email address:
Email: rgpd@ulisboa.pt6. Amendments to the Privacy Policy
FMV-ULisboa reserves the right to amend this Privacy Policy at any time. Any amendments will be duly published on the Faculty’s website and/or through any other communication channels deemed appropriate.
7. Cookie Policy
This website uses session cookies solely to analyse web traffic patterns, identify technical issues and provide users with an improved browsing experience.
All web browsers allow users to accept, refuse or delete cookies by selecting the appropriate settings within their browser. Cookies can generally be configured through the browser’s “Options” or “Preferences” menu.
Please note, however, that disabling cookies may prevent certain website services from functioning correctly, thereby affecting, either partially or entirely, your browsing experience.
For further information about cookies, including how to identify which cookies have been set and how to manage or delete them, please visit www.allaboutcookies.org, which provides guidance for the main web browsers.
Acceptance of these Terms
By voluntarily and expressly accepting the Cookie Policy on our website, you consent to the collection and use of your information as described in this Cookie Policy.
FMV-ULisboa 360° Privacy Policy
8. 360° Privacy Policy
FMV-ULisboa has developed and implemented a 360° Privacy Policy, comprising a comprehensive set of measures designed to protect personal data. The implementation of this policy involved identifying the personal data under its responsibility, assessing data quality, developing a record of processing activities, defining security controls, implementing data protection and monitoring mechanisms, and introducing new procedures as part of a continuous improvement process.
This information is intended to present our Privacy Policy in a structured and accessible manner, providing greater transparency regarding the way we process personal data.
9. Personal Data
Personal Data means any information, regardless of its nature or medium (including sound or image), relating to an identified or identifiable natural person (the “data subject”).
An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to a name, identification number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
10. Special Categories of Personal Data
- Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
- Genetic data;
- Biometric data processed for the purpose of uniquely identifying an individual;
- Data concerning health;
- Data concerning a person’s sex life or sexual orientation.
11. Data Subjects
A data subject is any natural person to whom personal data relate.
Within the scope of FMV-ULisboa’s activities, data subjects include:
Members of the governing bodies, academic staff, collaborators, technical and administrative staff, irrespective of their contractual relationship, other service providers, users of the Faculty’s services, individuals collaborating directly or indirectly with FMV-ULisboa, as well as any natural person who provides personal data to FMV-ULisboa or authorises FMV-ULisboa to process such data.
12. Categories of Personal Data Processed by FMV-ULisboa
FMV-ULisboa processes personal data of different types and levels of sensitivity, depending on the purpose of the processing, including, by way of example:
- Identification data: name, date of birth, place of birth, sex, nationality, address, telephone number, professional qualifications, email address, national identity card number and/or passport number, taxpayer identification number, driving licence number and social security number.
- Family information: marital status, spouse’s name, children or dependants, and any other information required to determine salary-related benefits.
- Employment information: working hours, workplace, date of commencement of employment, job title, professional category, length of service within that category, salary grade, type of contractual relationship and professional qualification certificates.
- Financial information: salary, additional remuneration, variable or fixed payments, allowances, holiday entitlement, attendance records, leave, other remuneration-related information, mandatory or voluntary contributions and their rates, payment methods, bank name and bank account details (NIB or IBAN), and declarations regarding the compatibility of professional duties, where applicable.
- Special categories of personal data: degree of disability of the employee and/or any member of their household, temporary incapacity resulting from occupational accidents or work-related illnesses, and sickness absence.
13. Record of Processing Activities
FMV-ULisboa maintains a Record of Processing Activities, in accordance with Article 30 of the GDPR, which includes:
- The name and contact details of the Data Controller and, where applicable, any Joint Controller, the Data Controller’s representative and the Data Protection Officer;
- The purposes of the processing;
- A description of the categories of data subjects and categories of personal data;
- The envisaged time limits for the erasure of the different categories of personal data;
- The technical and organisational security measures implemented to ensure the pseudonymisation and encryption of personal data and to guarantee the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
14. Principles Governing the Processing of Personal Data
- Lawfulness, fairness and transparency: personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
- Purpose Limitation Principle: Personal data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner that is incompatible with those purposes.
- Data Minimisation Principle: Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
- Accuracy Principle: Personal data shall be accurate and, where necessary, kept up to date. Every reasonable step shall be taken to ensure that inaccurate personal data, having regard to the purposes for which they are processed, are erased or rectified without delay.
- Storage Limitation Principle: Personal data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed.
- Integrity and Confidentiality Principle: Personal data shall be processed in a manner that ensures their security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, through the implementation of appropriate technical and organisational measures.
As the Data Controller, FMV-ULisboa undertakes to ensure that the processing of personal data is carried out in strict compliance with the above principles and is able to demonstrate such compliance whenever required.
15. Lawful Basis for the Processing of Personal Data
FMV-ULisboa processes personal data only where at least one of the following legal bases applies:
a) Consent of the Data Subject
Where the data subject has given consent to the processing of their personal data for one or more specific purposes through a freely given, specific, informed and unambiguous indication of their wishes.
Consent may be obtained by any means, including electronic means, and FMV-ULisboa shall retain evidence of such consent in order to demonstrate that the data subject has authorised the processing of their personal data.
The data subject has the right to withdraw consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
b) Performance of a Contract or Pre-contractual Steps
Where processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
This includes, for example, the processing of personal data relating to academic staff, employees and service providers for the management of employment relationships or contractual arrangements with FMV-ULisboa.
c) Compliance with a Legal Obligation
Where processing is necessary for compliance with a legal obligation to which FMV-ULisboa is subject.
This includes, for example, processing required to fulfil statutory obligations towards the Social Security Authorities, the Portuguese Tax Authority and other public authorities, including the supervising Ministry.
d) Vital Interests
Where processing is necessary to protect the vital interests of the data subject or another natural person, for example in the event of a medical emergency.
e) Public Interest / Exercise of Official Authority
Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
For example, this may include communications with the Directorate-General of Health. As a public higher education institution, FMV-ULisboa carries out much of its educational mission in the public interest, although the applicable legal basis must always be assessed for each individual processing activity.
f) Legitimate Interests
Where processing is necessary for the purposes of the legitimate interests pursued by FMV-ULisboa or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data.
16. Special Categories of Personal Data
FMV-ULisboa may process special categories of personal data under the following circumstances:
- Where the data subject has given explicit consent to the processing of such data for one or more specified purposes;
- Where processing is necessary for carrying out obligations or exercising specific rights of FMV-ULisboa or of the data subject in the field of employment, social security or social protection law, as provided for under European Union law, national law or a collective agreement;
- Where processing is necessary to protect the vital interests of the data subject or another natural person and the data subject is physically or legally incapable of giving consent;
- Where the processing relates to personal data which have manifestly been made public by the data subject;
- Where processing is necessary for the establishment, exercise or defence of legal claims, or whenever courts are acting in their judicial capacity;
- Where processing is necessary for reasons of substantial public interest on the basis of European Union or national law;
- Where processing is necessary for the purposes of preventive or occupational medicine, the assessment of an employee’s working capacity, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services, on the basis of European Union or national law or pursuant to a contract with a health professional;
- Where processing is necessary for reasons of public interest in the area of public health, on the basis of European Union or national law;
- Where processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, on the basis of European Union or national law.
17. Purposes of the Processing of Personal Data
Given the diversity of its activities, FMV-ULisboa processes personal data for the following purposes:
- Financial Data: Payment of salaries and remuneration; Procurement of goods and services; Payment management; Receipt and assessment of procurement submissions; Performance of contracts with suppliers.
- Contractual Procedures: Drafting and management of contracts and related administrative procedures; Receipt and handling of IT support requests; Development of new information technology solutions for the university community.
- Human Resources: Human resources management, including attendance and working time management; Payroll processing; Performance appraisal; Promotion of occupational health and safety; Allocation of employee social benefits.
- Institutional Activities: Organisation of events in accordance with FMV-ULisboa’s mission and statutory objectives; Arranging event insurance; Participation in international events; Cooperation with partner universities and equivalent higher education institutions.
18. Retention Period for Personal Data
Personal data shall be retained only for the period necessary to fulfil the purposes for which they are processed.
FMV-ULisboa complies with the statutory maximum retention periods established by law. However, personal data may be retained for longer periods where necessary for reasons of public interest or for other continuing legitimate purposes, such as the establishment, exercise or defence of legal claims, archiving in the public interest, scientific or historical research, or statistical purposes. In such cases, appropriate technical and organisational measures shall be implemented to safeguard personal data.
These safeguards include, in particular, measures designed to ensure compliance with the principles of data minimisation and pseudonymisation.
19. How Personal Data Are Collected
FMV-ULisboa may collect personal data either directly (i.e. from the data subject) or indirectly (i.e. through third parties). Data may be collected through the following channels:
- Direct Collection: In person; By telephone; By email; Through FMV-ULisboa’s online platforms (e.g. the Fénix Platform and the training portal).
- Indirect Collection: Through partner organisations, such as partner universities or schools.
20. Rights of Data Subjects
- Right of Access: The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, to access those personal data.
- Right to Rectification: The data subject has the right to request the rectification of inaccurate personal data at any time and to have incomplete personal data completed, including by means of providing a supplementary statement.
- Right to Erasure (“Right to be Forgotten”): The data subject has the right to obtain the erasure of personal data where one of the following grounds applies: i. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; ii. the data subject withdraws consent and there is no other legal basis for processing; iii. the data subject objects to the processing and there are no overriding legitimate grounds for continuing the processing; iv. the personal data have been unlawfully processed; v. the personal data must be erased to comply with a legal obligation to which FMV-ULisboa or one of its processors is subject.
In accordance with the applicable legislation, FMV-ULisboa is not required to erase personal data where processing is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
- Right to Restriction of Processing: The data subject has the right to obtain restriction of processing where one of the following applies: i. the accuracy of the personal data is contested, for a period enabling FMV-ULisboa to verify their accuracy; iii. FMV-ULisboa no longer requires the personal data for the purposes of processing, but the data are required by the data subject for the establishment, exercise or defence of legal claims.
- Right to Data Portability: The data subject has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format and has the right to transmit those data to another Data Controller where: i. the processing is based on consent or on a contract to which the data subject is a party; and ii. the processing is carried out by automated means.
- Right to Object: The data subject has the right to object, at any time, on grounds relating to their particular situation, to the processing of personal data concerning them where such processing is based on the legitimate interests pursued by FMV-ULisboa or where the processing is carried out for purposes other than those for which the personal data were originally collected. The data subject also has the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).
21. Exercising Data Subject Rights
- By post or in person:
FMV-ULisboa
Avenida da Universidade Técnica
1300-477 Lisbon
Portugal
By email: rgpd@ulisboa.pt
22. Lodging a Complaint with the CNPD
Data subjects have the right to lodge a complaint directly with the Portuguese supervisory authority, the National Data Protection Commission (Comissão Nacional de Proteção de Dados — CNPD), using the contact details available on its official website (www.cnpd.pt).
23. Security Measures
Taking into account the principles of proportionality and appropriateness, the state of the art, implementation costs, the nature, scope, context and purposes of processing, as well as the likelihood and severity of the risks involved, FMV-ULisboa implements appropriate technical and organisational security measures to ensure a level of security appropriate to the risks, including, for example:
- Use of firewalls and intrusion detection systems across its information systems;
- Implementation of access control procedures based on differentiated user profiles and the need-to-know principle;
- Logging of activities performed on information systems containing personal data;
- Implementation of backup procedures;
- Anti-spam protection for incoming and outgoing corporate emails;
- Installation, maintenance and management of antivirus and firewall systems on Faculty computers;
- Pseudonymisation of personal data;
- Physical access controls for buildings and facilities;
- Automatic fire detection and intrusion detection systems;
- Delivery of training and awareness programmes on information security and data protection.
24. Transfer of Data to Third Parties
24.1. Data Processors and Third Parties
Data Processors
FMV-ULisboa may engage third-party organisations acting as Data Processors to process personal data on behalf of the University and strictly in accordance with its instructions, in full compliance with the GDPR, Portuguese data protection legislation and this Privacy Policy.
Data Processors may not disclose the data subject’s personal data to any other entity without FMV-ULisboa’s prior written authorisation and are likewise prohibited from appointing further sub-processors without the Faculty’s prior approval.
FMV-ULisboa undertakes to ensure that all Data Processors provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures to protect the privacy of personal data and safeguard the rights of data subjects.
All Data Processors are bound by a written contract with FMV-ULisboa specifying: the subject matter and duration of the processing; the nature and purpose of the processing; the categories of personal data; the categories of data subjects; the rights and obligations of the parties; confidentiality obligations; and the security measures to be implemented.
Third Parties
FMV-ULisboa is required by law and by applicable administrative procedures to disclose personal data, where necessary, to other organisations, including but not limited to:
- The Portuguese Tax Authority;
- Social Security and/or the General Pension Fund (Caixa Geral de Aposentações);
- Embassies;
- Professional bodies;
- Research institutions;
- Insurance companies;
- Other public authorities;
- Higher Education accreditation bodies;
- Higher Education Social Action organisations;
- Partner universities for the purposes of the Erasmus Programme or equivalent mobility schemes;
- Funding agencies and partner institutions participating in applications for national or European funding.
Whenever personal data are shared with any of these organisations, FMV-ULisboa will assess whether the data subject’s consent is required and will take all necessary measures to ensure that such organisations carry out their activities in accordance with the principles of the GDPR.
25. Personal Data Breaches
- FMV-ULisboa has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the breach, particularly measures rendering the data unintelligible to unauthorised persons, such as encryption;
- FMV-ULisboa has subsequently taken measures ensuring that the high risk to the rights and freedoms of the data subject is no longer likely to materialise; or
- Individual notification would involve a disproportionate effort, in which case FMV-ULisboa shall issue a public communication or adopt an equivalent measure through which the data subjects will be informed.
Any personal data breach involving processing carried out under the responsibility of FMV-ULisboa may be reported through the following channel:
- By email: rgpd@ulisboa.pt
Final Note
We recommend that you consult this Privacy Policy periodically to remain informed about how FMV-ULisboa protects your Personal Data and to keep up to date with your rights and the information relating to the processing of your personal data.
Date of the latest update: February 2022