Skip to main content

U.Porto Data Protection Policy

The University of Porto is a public foundation regulated by private law, whose mission includes the production of scientific, cultural and artistic knowledge, higher education strongly anchored in research, the social and economic valorisation of knowledge, and active participation in the progress of the communities to which it belongs. To best achieve these goals and to comply with all the requirements imposed on us as a public higher education institution, we may need to process some of your personal data.

What will my data be used for?

If you are a student at U.Porto, in order to provide you with the necessary conditions to build an academic path rooted in excellence, as well as to comply with all the legal obligations to which we are bound, your personal data may be processed, in particular, for the following purposes:

  • enrolment and registration management;
  • maintaining and updating your individual student process;
  • granting special attendance statutes;
  • management of national and/or international mobility programs;
  • recognition of equivalences and documents conferring degrees and other academic titles;
  • issuance of certificates and diplomas;
  • maintenance of school insurance and notification of claims;
  • awarding prizes;
  • management of attendance, grades and other academic information.

To ensure democratic and equal access to higher education, U.Porto provides several social support services. If you apply for or benefit from these services some of your personal data may be processed for one or more of the following purposes:

  • management of scholarships and other social support;
  • management of the collaborators' scholarship;
  • management of university halls of residence;
  • management of access to health care provided by the Health Unit of the Social Support Services of U.Porto, or by other entities with which it has signed clinical protocols.

Within the scope of its mission as a higher education institution, U.Porto is committed to the promotion of scientific research as one of its main objectives, aiming not only to produce and disseminate knowledge, but also to valorise the activity of its researchers, lecturers and students.

In this context, you may be asked to collaborate on projects run by members of the U.Porto community, as part of their study cycles or research activities. The specific data to be collected and the purpose of their collection will depend on the research project in question, as will the format of the study itself, which may vary from surveys to clinical studies with or without intervention. Regardless, your participation in these projects will always be voluntary and your personal data will only be processed with your consent, in strict compliance with the highest ethical standards recognised by the scientific community.

Also in this context, the U.Porto can make its students' data available for internal research projects, related, for example, to the analysis of academic success and its constraints. In this case, the data will only be shared if the study is duly validated, to ensure that it complies with applicable legislation and best ethical practices, and the data communicated will never include information regarding the identity of the students.

To ensure your safety and the safety of those who interact with us, as well as of the assets that are located within our spaces (whether the assets belong to the University or to third parties), U.Porto has Video Surveillance Systems set up at various locations on its premises.

All cameras are installed in strict accordance with legal requirements.

U.Porto makes its knowledge available to the community by providing services in the most varied fields of knowledge through its schools and research centres, or structures specially set up for this purpose.

In particular, you have access to nutrition counselling, clinical analysis, gerontology, dental or psychology consultations.

The personal data you provide in this context will be solely and exclusively used for the provision of the services you request, as well as to guarantee the training of its students and the promotion of scientific research, in line with the University's mission.

The personal data you provide in this context will be solely and exclusively used by U.Porto for the provision of the services you request, as well as, considering the University's mission and having assured compliance with the required ethical and legal demands, to guarantee the training of its students and the promotion of scientific research in the areas in question.

U.Porto considers the need to establish and support connections to its former students more of a true strategic priority than a legal imperative.

Thus, if you are a former student of this University, you may receive, via e-mail, messages related to:

  • University news;
  • alumni’s professionally successful initiatives (publications, books, blogs, job positions, TV programmes, etc.);
  • employability surveys;
  • dissemination of professional opportunities;
  • continuing education offers;
  • events specifically aimed at the alumni audience.

You may at any time unsubscribe from such communications, without having to provide a reason.

Additionally, your personal data will need to be processed should you decide to obtain the ALUMNI U.Porto Card.

Within the scope of initiatives promoted by U.Porto (Junior University, Thematic Seminars, Conferences, etc.), in which you decide to participate, some of your personal data may be requested for the purpose of managing your registration and accreditation, as well as billing (in the case of paid events).

Additionally, photos and/or videos may be captured during these events, for the purpose of dissemination and promotion in internal and external communication channels.

If you are a member of U.Porto, or if you have actively subscribed to any of these, you may receive various types of institutional communications, related to the activities carried out by the University and the different entities that it comprises:

  • newsletters;
  • dissemination regarding the education offered by the University;
  • dissemination of professional opportunities;
  • requests for collaboration in scientific research activities.

If you are a member of this University, the U.Porto Card is the document that identifies you as such, ensuring that you have access to a wide range of services from U.Porto and partner institutions. The data associated with the card will only be processed if strictly necessary to:

  • access University infrastructures (classrooms; parking; halls of residence; canteens; etc.);
  • access the printing service;
  • record attendance;
  • manage library loans;
  • manage payments.

If you use U.Porto's technological infrastructures, including wi-fi networks, some of your personal data will be automatically collected and analysed in order to monitor the security of those infrastructures and prevent their misuse. For more information on this topic, you can consult U.Porto’s Policy on Acceptable Use of Technological Infrastructures.

The U.Porto Websites may use cookies to ensure the best possible user experience whenever you visit us. Cookies are small electronic files stored on your device, which allow platforms to distinguish each visitor and maintain their preferences throughout the respective session. For more information about the types of cookies used by U.Porto, you can consult the privacy policies of each of its Websites.

Depending on your specific relationship with U.Porto, your personal data may be processed for one or more of the following purposes, in order to ensure the regular functioning of the institution:

  • execution of a contract (work, scholarship, or other);
  • process payments;
  • managing an application or recruitment process;
  • issue the U.Porto card;
  • control and manage access and use of University services such as libraries, canteens, sports and technological infrastructures, among others;
  • manage electoral procedures;
  • analyse complaints, requirements, appeals and similar procedures;
  • conduct audits and certification and accreditation procedures;
  • support decision-making and continuous improvement of internal processes;
  • communicate to the Directorate-General for Education and Science Statistics, regarding the RAIDES and RENATES surveys;
  • comply with other legal obligations, including cooperation with competent authorities;
  • communicate in the event of possible emergencies.

What information may be collected and processed about me?

The data we process will depend on the context of your interaction with U.Porto, and may include, namely:

  • Identification data [e.g.: name; student number; photograph; parents’ names; nationality; place of birth; date of birth; sex; marital status; tax identification number; identification document number];
  • Contact details [e.g.: address; e-mail; telephone contact];
  • Academic data [e.g.: study cycle; course; year of enrolment; type of attendance; number of enrolled/approved ECTS and respective ratings; higher education admission regime; previous educational establishments; academic qualifications; number of times a student required course extensions; professional situation];
  • Payment details [e.g.: regularized and unregularized values; bank identification number; scholarship status; receipt for tuition fees and charges];
  • Sound and image data [e.g.: photographs; videos];
  • Health data [e.g.: clinical history; medicine consumption; medical certificates; allergies and other intolerances];
  • Biometric data [e.g.: fingerprint matrix];
  • Technical data [e.g.: IP address; visit date and time; cookies]

Will my data be shared with third parties?

U.Porto may share your data with third parties, if there is a legal obligation to do so or if this sharing proves to be legitimate and is based on an adequate lawfulness condition (for example, if it is necessary for the performance of the contract to which you are a party or if we have obtained your express consent). Here are some examples of entities with which the data may be shared:

  • Public Administration bodies (Ministry of Education; Tax Authority; Social Security, among others) to fulfil legal obligations;
  • institutions in the banking sector and insurance companies for the management of payments and conclusion of insurance contracts;
  • institutions with which it has signed contracts or other cooperation instruments (e.g. CGD bank for the issuance of the U.Porto Card; other higher education institutions within the framework of exchange programmes, etc.), as strictly necessary for their execution.

Additionally, there may be data sharing with entities acting as Data Processors, whenever U.Porto decides to hire a third party to process the data on its behalf, for well-defined purposes. In those situations, the relationship will be regulated by a Data Processing Agreement, as required by the legislation, in order to instruct the third party on how to process the data and to demand certain guarantees, on aspects such as information security and confidentiality.

How long will my data be kept?

U.Porto will keep your personal data for the period deemed necessary to fulfil the purposes for which they were collected or for others that are duly and substantially related to them within the framework of our institutional mission.

We may also preserve your data for a longer period whenever there is a legal obligation to do so (as is the case, for example, with the individual student process) or when there are strong reasons of public interest that justify it (such as archiving purposes in the public interest, scientific or historical research, or statistics).

What security measures will my data be subject to?

U.Porto protects the information of all those who have a relationship with the institution, through the implementation of technical and organisational measures that allow for the mitigation of the risks, of variable geometry and intensity, that could affect the fundamental rights and freedoms of the data subjects affected, in the event of a data breach.

The implementation of these measures is done while taking into consideration the most advanced techniques, application costs, nature, scope, context and purposes of each processing of personal data carried out under the responsibility of the institution.

In particular, the following measures are implemented to ensure the confidentiality, integrity and availability of any information qualified as personal data:

  • implementation of “institutional authentication” mechanisms;
  • definition of access control schemes based on the “need to know” criterion;
  • use of encrypted communication channels for the transfer of personal data;
  • protection of technological infrastructures against unauthorized access;
  • storage of data of a particularly sensitive nature and respective backups in encrypted form;
  • monitoring of the technological infrastructures for the prevention and detection of practices contrary to those permitted by the U.Porto’s Policy on their Acceptable Use.

Can I request access, rectification or erasure of my data?

Yes, you may ask for additional information regarding the way your data are being processed, as well as request the exercise of the rights defined in the legislation, such as access, rectification, restriction of processing, or erasure of your data.

Additionally, when the data is being processed based on your consent, you can withdraw that consent at any time and request the erasure of the data. This will not compromise the lawfulness of the data processing carried out until that moment.

If you are a member of U.Porto, you can submit these requests at our internal platform, accessible at https://www.up.pt/pdados, using the section available for this purpose. Otherwise, you should send your request by e-mail, directly addressing the service responsible for processing your data or contacting the Data Protection Unit at [email protected].

Your request will be promptly analysed and, if necessary, we will ask the service involved, internally, to act accordingly. If we consider that the request does not meet the conditions to be fulfilled, partially or completely, we will explain you the reason.

If you consider that your data is not being subject to legitimate processing, you also have the right to lodge a complaint with the National Authority – Comissão Nacional de Proteção de Dados (www.cnpd.pt).

Who can I contact, should I have questions related to these matters?

If you need further clarification, you can contact the Data Protection Officer of the University of Porto, at [email protected].

Changes to this Policy

This informative text is reviewed and updated whenever we consider it necessary. This may be due to external factors, such as legislative changes, or internal factors, related to the carrying out of new activities that involve the processing of personal data or the introduction of changes to ongoing activities.

Whenever we make changes to the text, we will indicate the corresponding date. We recommend that you check this page periodically to stay informed.

This policy was last updated in December 2024.