Privacy Policy

Last updated: September 18, 2025

Important: This Privacy Policy explains how the Pedagogical Innovation Center (Centro de Inovação Pedagógica - CIP) of the Polytechnic of Porto collects, uses, and protects your personal data when you use our learning platform. By using our platform, you agree to the collection and use of information in accordance with this policy.

1. Data Controller Information

Data Controller: Centro de Inovação Pedagógica (CIP)
Institution: Instituto Politécnico do Porto (P.PORTO)
Address: Edifício da Biblioteca do P.PORTO - 3.º Piso
Rua Dr. Roberto Frias, 712
4200-465, Porto, Portugal
Email: cip@sc.ipp.pt
Phone: +351 225 571 097
Website: https://cip.ipp.pt

2. Data Protection Officer (DPO)

3. Legal Basis for Processing

We process your personal data in accordance with the General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679 and Portuguese Law No. 58/2019. The legal bases for processing your data include:

• Contractual necessity: To provide educational services and manage your learning experience
• Legitimate interest: To improve our platform, conduct research, and enhance educational outcomes
• Consent: For optional services, marketing communications, and research participation
• Legal obligation: To comply with educational regulations and legal requirements

4. Types of Data We Collect

4.1 Personal Identification Data

• Full name
• Email address
• Username and password
• Phone number (if provided)
• Institution/organization affiliation
• Professional title or role
• Country/region of residence

4.2 Educational and Learning Data

• Course enrollment and progress information
• Assessment results and grades
• Assignment submissions and feedback
• Forum posts and discussions
• Learning preferences and settings
• Certificates and completion records
• Attendance and participation data

4.3 Technical and Usage Data

• IP address and device information
• Browser type and version
• Operating system
• Platform usage patterns and navigation paths
• Login timestamps and session duration
• Cookies and similar tracking technologies

4.4 Communication Data

• Support requests and correspondence
• Feedback and survey responses
• Event registration information
• Newsletter subscription preferences

5. Purposes of Data Processing

We use your personal data for the following purposes:

5.1 Educational Services

• Creating and managing user accounts
• Delivering course content and learning materials
• Tracking learning progress and performance
• Providing assessments and feedback
• Issuing certificates and credentials
• Facilitating communication between learners and instructors

5.2 Platform Management and Improvement

• Maintaining platform security and preventing fraud
• Analyzing usage patterns to improve user experience
• Developing new features and educational tools
• Conducting educational research and analytics
• Quality assurance and performance monitoring

5.3 Communication and Support

• Responding to inquiries and providing technical support
• Sending important platform updates and announcements
• Delivering newsletters and educational content (with consent)
• Notifying about events, courses, and opportunities

5.4 Legal and Compliance

• Meeting educational institution requirements
• Complying with legal obligations and regulations
• Protecting intellectual property rights
• Maintaining records for accreditation purposes

6. Data Sharing and Third-Party Access

We may share your personal data in the following circumstances:

6.1 Within P.PORTO

• With relevant schools and departments for educational purposes
• With IT services for technical support and maintenance
• With administrative services for institutional reporting

6.2 External Partners

• Technology service providers: Hosting, cloud storage, and platform maintenance
• Educational partners: Course providers and accreditation bodies
• Research collaborators: For approved educational research (anonymized data)
• INOV-NORTE consortium members: For collaborative educational initiatives

6.3 Legal Requirements

We may disclose your data when required by law, court order, or to protect our rights and the safety of our users.

Important: We never sell your personal data to third parties for commercial purposes.

7. Data Retention Periods

We retain your personal data for the following periods:

• Active accounts: Duration of your engagement with the platform plus 2 years
• Inactive accounts: 3 years from last login, then anonymized or deleted
• Course data: 5 years after course completion for accreditation purposes
• Assessment records: 7 years for academic and legal requirements
• Technical logs: 12 months unless required for security investigations
• Research data: As specified in research consent agreements

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right	Description	How to Exercise
Right to Information	Be informed about how your data is processed	This privacy policy provides this information
Right of Access	Request a copy of your personal data	Contact our DPO or use platform export features
Right to Rectification	Correct inaccurate or incomplete data	Update through platform settings or contact support
Right to Erasure	Request deletion of your personal data	Submit request to DPO (subject to legal restrictions)
Right to Restrict Processing	Limit how your data is processed	Contact DPO with specific restrictions
Right to Data Portability	Receive your data in a machine-readable format	Use platform export tools or contact DPO
Right to Object	Object to processing based on legitimate interests	Contact DPO with your objection
Right to Withdraw Consent	Withdraw consent for optional processing	Update preferences or contact DPO

Note: Some rights may be limited by our educational mission and legal obligations. We will respond to all valid requests within 30 days.

9. Data Security Measures

We implement comprehensive security measures to protect your personal data:

9.1 Technical Safeguards

• SSL/TLS encryption for data transmission
• Encrypted data storage with regular backups
• Multi-factor authentication for administrative access
• Regular security updates and patches
• Firewall protection and intrusion detection systems
• Regular security audits and penetration testing

9.2 Organizational Measures

• Role-based access controls
• Staff training on data protection
• Data protection impact assessments
• Incident response procedures
• Regular policy reviews and updates

10. Cookies and Tracking Technologies

Our platform uses cookies and similar technologies to:

• Essential cookies: Enable core platform functionality
• Performance cookies: Analyze usage and improve performance
• Functional cookies: Remember your preferences and settings
• Analytics cookies: Understand user behavior (with consent)

You can manage cookie preferences through your browser settings. However, disabling essential cookies may affect platform functionality.

11. International Data Transfers

Your data is primarily processed within the European Union. When we transfer data outside the EU, we ensure adequate protection through:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs)
• Certified platforms with appropriate safeguards

12. Children's Privacy

Our platform is primarily designed for adult learners and educational professionals. If we become aware of any data collected from children under 16 without proper consent, we will take immediate steps to delete such information. Parents and guardians have the right to:

• Access their child's personal data
• Request correction or deletion
• Withdraw consent for processing

13. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Portuguese Data Protection Authority within 72 hours
• Inform affected individuals without undue delay
• Provide clear information about the breach and recommended actions
• Take immediate steps to contain and remediate the breach

14. Third-Party Links and Services

Our platform may contain links to external websites and services. We are not responsible for the privacy practices of these third parties. We recommend reviewing their privacy policies before providing any personal information.

15. Research and Analytics

We may use aggregated and anonymized data for:

• Educational research and publications
• Platform improvement and innovation
• Sharing best practices with the educational community
• Reporting to funding bodies and partners

Such research data cannot be used to identify individuals and is processed in accordance with ethical research standards.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will:

• Notify users of significant changes via email or platform announcements
• Update the "Last Updated" date at the top of this policy
• Maintain previous versions for reference
• Ensure continued compliance with applicable laws

Important: Continued use of the platform after policy updates constitutes acceptance of the revised terms.

17. Contact Information and Complaints

17.1 Contact Us

17.2 Supervisory Authority

You have the right to lodge a complaint with the Portuguese Data Protection Authority:

18. Accessibility and Language

This Privacy Policy is available in multiple languages. In case of any discrepancy between versions, the Portuguese version shall prevail. We are committed to making our privacy information accessible to all users, including those with disabilities.