University information notice on the protection of personal data at the University of Namur.

Why an information notice?

Personal data is processed when information relating to natural persons is used by automated means (for example, by computerised processes) or in files. In order to carry out its missions, the University of Namur (or UNamur) is required to process personal data. This processing is subject to regulations on the protection of personal data, which require a certain amount of transparency regarding the processing carried out.

The purpose of this notice is to provide general information on the processing of personal data carried out by the University of Namur, in addition to the more specific information which may be provided when the data is collected or on other media made available to the persons concerned by such processing.

Ethical principles relating to the use of IT tools

Why does the University of Namur process personal data?

The University of Namur processes personal data to carry out mainly the following missions and activities:

      - the use of the UNI FOR CHANGE application

      - the job placement service and career center

      - accommodation services for visiting researchers

     - the management of parking facilities

     - video surveillance

The legal basis on which the University of Namur uses this personal data depends on the situation encountered: 

  • Depending on the case, it may be necessary to process data in order to carry out a mission of public interest entrusted to the University as part of its teaching, research and community service missions.
  • In many cases, the University must process certain data in order to comply with its legal obligations (e.g. in employment law, for the awarding of public contracts, the keeping of its accounts, or to respond to requests for information from third parties legally entitled to request this information).
  • Some processing operations are based on a contract concluded with the data subject (for example, an employment contract, a lease contract, a publishing contract, registration for a conference, etc.).
  • In some cases, the University has a legitimate interest in processing data. This is the case for promoting its activities or ensuring the security of its buildings.
  • Lastly, some data processing operations are based on the consent of the persons concerned (for example, when subscribing to a newsletter).

As a general rule, the University retains data for as long as is necessary for the purposes for which it is processed, taking into account, where applicable, the rights of the data subjects, mandatory legal retention requirements and the legal period during which the University may be held liable.

Who processes and has access to personal data?

The University's missions and activities are carried out through its institutional services, faculties and schools, and its research centers and institutes.

However, the legal entity that is responsible for data processing is the asbl Université de Namur, whose registered office is established at rue de Bruxelles 61, 5000 Namur.

Is the data communicated to third parties within the University?

Personal data processed by the University of Namur is in principle reserved for internal use by members of staff of the University for the purposes of their duties.

It may, however, be transmitted to third parties (public administrations, publishers, other universities or educational establishments, inter-university consultation bodies - including the Conseil des Recteurs francophones (CRef), ARES, AEQES, research funders, tax authorities, ONSS, ONEM, judicial authorities, sub-contractors, etc.), insofar as this is necessary for the performance of their duties....), insofar as this is necessary with regard to the purpose for which the data is processed, if the Université Namur is legally obliged to do so, or when the University calls on external service providers, some of whom are responsible for processing this data on its behalf and on its instructions.

What rights do I have as a person concerned by data processing carried out by the University of Namur?

In accordance with the regulations on the protection of personal data, persons whose data is processed have rights, the conditions and limits of which are set out mainly in Chapter III of the General Data Protection Regulation (GDPR).

Please find below an overview of these rights:

A right to information

Any person has the right to ask whether or not data concerning him or her is being processed, and if so to request to receive information about the processing.

Right of access

Any person whose data is processed by the University has the right to request that a copy of the processed data concerning him or her be communicated to him or her.

Right of rectification

Any person whose data is processed by the University has the right to request that data concerning him or her that is inaccurate or incomplete be rectified or completed.

Right to object

You have the right to object, without giving any reason, to your data being used for canvassing purposes. This right implies, for example, for third parties to the University the possibility of requesting that they no longer receive information on University activities by e-mail or post.

Any person whose data is processed by the University may also request, on grounds relating to his or her particular situation, that his or her data no longer be processed by the University in the case of processing carried out as part of a mission of public interest or to fulfil a legitimate interest. In this case, the University will no longer process the data, unless there are compelling legitimate grounds for the processing which override the interests of the data subject or the processing is necessary for the establishment, exercise or defence of legal claims against the University.

Right to withdraw consent

Where the use of personal data is based on the consent of the person whose data is being processed, that person has the right to withdraw that consent at any time. This does not affect any processing that has already been carried out on the basis of that consent.

Right to erasure

This right allows individuals to request the deletion of their data when processing is unlawful or is no longer necessary for the purposes for which the data was collected.

This right cannot always be exercised, particularly if :

  • Data processing is necessary for the exercise of the right to freedom of expression and information,
  • The processing of data is necessary to comply with the University's legal obligations,
  • The processing of data is essential for the establishment, exercise or defence of legal claims,
  • Such erasure renders impossible or seriously compromises the purposes of processing carried out for scientific or historical research or statistical purposes.r seriously compromises the purposes of processing carried out for scientific or historical research or statistical purposes.

Right to data portability

If personal data have been provided to the University for the conclusion of a contract or for use based on consent, the person whose data are processed has the right to request to receive these data in a commonly used structured format or to request to communicate them to a third party, provided however that the use of his/her data by the University is carried out by automated processes.

Right to limit processing

In certain cases, an individual may request that the processing of his/her data be restricted while checks are made on a request concerning said data.

This right may be exercised in four circumstances:

  • While the University verifies the accuracy of data that has been disputed,
  • If the processing is unlawful, but the data subject nevertheless does not wish his or her data to be deleted and instead requests that their use be restricted,
  • If the University no longer needs the data for the purposes for which it was used, but the data is still necessary for the establishment, exercise or defence of legal claims,
  • If a person has objected to the processing of his or her data, during verification as to whether the legitimate reasons pursued by the University can justify its continued use.
  • In these cases, the University will only store the data pending these verifications and will not use it otherwise.

There are, however, exceptions to this limitation. Data may continue to be processed with the consent of the person concerned, for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for important reasons of public interest.

Right not to be subject to an automated decision

Everyone has the right not to be subject to a decision based exclusively on automated means, if the decision produces legal effects concerning him or her or significantly affects him or her in a similar way. In this case, the data subject will request human intervention and the opportunity to express his or her point of view and challenge the decision.

However, this right cannot be exercised in certain cases, in particular if the decision is necessary for the conclusion or performance of a contract, is authorised by law or is based on the person's explicit consent.

How can I contact the University to find out more about exercising my data protection rights?

Unless a specific procedure is brought to the attention of the persons concerned (for example, for unsubscribing from mailing lists by automated means or for access to examination papers), questions and requests to exercise rights may be addressed (in this case providing proof of identity), to UNamur's Data Protection Officer:

Data Protection Officer
Services du Rectorat
Rue de Bruxelles, 61
5000 Namur

More information on personal data protection is available on the Data Protection Authority website: www.autoriteprotectiondonnees.be
It is also possible to lodge a complaint with this Authority or to take legal action if the rights of the person whose data has been processed have not been respected or if the data processing does not comply with the regulations.