Information notice on the protection of personal data at the University of Namur

Why an information leaflet?

Personal data is processed when information relating to natural persons is used by automated means (for example, by computerized processes) or in files. To carry out its missions, the University of Namur (or UNamur) is required to process personal data. These are subject to regulations on the protection of personal data, which require a certain degree of transparency concerning the processing that is carried out.

The purpose of this notice is to provide general information on the processing of personal data carried out by the University of Namur, in addition to the more specific information that is, where appropriate, provided at the time of data collection or on other media made available to the persons concerned by such processing.

Ethical principles relating to the use of IT tools

Why does the University of Namur process personal data?

The University of Namur processes personal data to carry out mainly the following missions and activities:

      - the use of the UNI FOR CHANGE application

      - the job placement service and career center

     - Parking management

     - Video surveillance

The legal basis on which the University of Namur uses this personal data depends on the situation encountered:

  • It will be, depending on the case, processing necessary for the performance of a mission of public interest entrusted to the University as part of its teaching, research and community service missions.
  • In many cases, the University must process certain data to comply with its legal obligations (e.g. in labor law, for the awarding of public contracts, the keeping of its accounts, or to respond to requests for information from third parties legally entitled to request such information).
  • Some processing operations are based on a contract concluded with the data subject (for example, an employment contract, a lease agreement, a publishing contract, registration for a symposium, ...).
  • In some cases, the University relies on a legitimate interest to process data. Such is the case to ensure the promotion of its activities or to ensure the security of its buildings.
  • Finally, some processing operations are based on the consent of data subjects (for example, for newsletter subscriptions)

As a general rule, the University retains data for the period necessary with regard to the purposes for which they are processed, taking into account, where applicable, the rights of data subjects, mandatory legal retention requirements, the legal period during which the University may be held liable.

Who processes and has access to personal data?

The University's missions and activities are carried out through its institutional services, faculties and schools, and its research centers and institutes.

However, the legal entity that is responsible for data processing is the asbl Université de Namur, whose registered office is established at rue de Bruxelles 61, 5000 Namur.

Is the data communicated to third parties within the University?

The personal data processed by the University of Namur is in principle reserved for internal use by members of the University's staff for the purposes of their duties.

They may, however, be transmitted to third parties (public administrations, publishers, other universities or educational establishments, inter-university consultation bodies - including the Conseil des Recteurs francophones (CRef)-, ARES, AEQES, research funders, tax authorities, ONSS, ONEM, legal authorities, subcontractors, ....), insofar as this is necessary for the purpose for which the data is processed, if the University of Namur is legally obliged to do so, or when the University uses external service providers, some of whom are responsible for processing this data on its behalf and on its instructions.

What rights do I have as a person concerned by data processing carried out by the University of Namur?

In accordance with the regulations on the protection of personal data, people whose data is processed have rights, the conditions and limits of which are set out mainly in Chapter III of the General Data Protection Regulation (GDPR).

Listed below is an overview of these rights:

A right to information

Any person has the right to ask whether or not data concerning him or her is being processed, and if so to request to receive information about the processing.

Right of access

Any person whose data is processed by the University has the right to request that a copy of the processed data concerning him or her be communicated to him or her.

Right of rectification

Any person whose data is processed by the University has the right to request that data concerning him or her that is inaccurate or incomplete be rectified or completed.

Right of opposition

There is a right to object without cause to his or her data being used for canvassing purposes. This right implies, for example, for third parties to the University the possibility of requesting that they no longer receive information on University activities by e-mail or post.

Any individual whose data is processed by the University may also request, on grounds relating to his or her particular situation, that his or her data no longer be processed by the University when the processing is carried out as part of a mission of public interest or to achieve a legitimate interest. In this case, the University will no longer process the data, unless there are compelling and legitimate grounds for the processing which override the interests of the data subject or the processing is necessary for the establishment, exercise or defense of the University's legal claims.

Right to withdraw consent

Where the use of personal data is based on the consent of the person whose data is being processed, the latter has the right to withdraw this consent at any time. This does not call into question any processing that has already been carried out on the basis of this consent.

Right to erasure

This right enables the individual to request the erasure of his or her data when processing is unlawful or is no longer necessary with regard to the purposes for which the data was collected.

This right cannot always be exercised, particularly if:

  • The processing of data is necessary for the exercise of the right to freedom of expression and information ,
  • The processing of data is necessary for compliance with the University's legal obligations,
  • The processing of data is essential for the establishment, exercise or defense of its legal rights,
  • This erasure makes impossible or seriously compromises the purposes of processing carried out for scientific or historical research or statistical purposes.

Right to data portability

If personal data has been provided to the University for the conclusion of a contract or for a use based on consent, the person whose data is processed has the right to request to receive this data in a commonly used structured format or to request to communicate it to a third party, provided however that the use of his/her data by the University is carried out by automated processes.

Right to limitation of processing

In certain cases, a person may request that the processing of his/her data be limited while checks are made on a request concerning said data.

This right can be exercised in four hypotheses:

  • During the period allowing the University to verify the accuracy of data that has been disputed,
  • If the processing is unlawful but the data subject nevertheless does not wish his/her data to be erased and instead requests that its use be restricted,
  • If the University no longer needs the data for the purposes for which it was used, but the data is still necessary for the establishment, exercise or defense of legal claims,
  • If a person has objected to the processing of his or her data, during the verification as to whether the legitimate reasons pursued by the University can justify its continued use.
  • In these cases, the University will limit itself to storing the data pending these verifications and will not use it otherwise.

There are, however, exceptions to this limitation. Data may continue to be processed with the consent of the data subject, for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for important reasons of public interest.

Right not to be subject to an automated decision

Any individual has the right not to be subject to a decision based exclusively on an automated process, if the decision produces legal effects concerning him or her or significantly affects him or her in a similar way. In this case, the person concerned will request human intervention and the opportunity to express his or her point of view and challenge the decision.

This right cannot be exercised in certain cases, however, in particular if the decision is necessary for the conclusion or performance of a contract, is authorized by law or is based on the person's explicit consent.

How can I contact the University to find out more about exercising my data protection rights?

Unless a specific procedure is brought to the attention of the persons concerned (for example, for unsubscribing from mailing lists by automated means or for access to examination papers), questions and requests to exercise rights may be addressed (in this case providing proof of identity), to UNamur's Data Protection Officer:

Data Protection Delegate
Services du Rectorat
Rue de Bruxelles, 61
5000 Namur

More information on personal data protection is available on the Data Protection Authority website: www.autoriteprotectiondonnees.be
It is also possible to lodge a complaint with this Authority or take legal action if the rights of the person whose data has been processed have not been respected, or if the data processing does not comply with the regulations.