Information Notice Regarding the Protection of Personal Data at the University of Namur

Why an information sheet?

The processing of personal data occurs when information relating to natural persons is used by automated means (for example, through computerized processes) or in files. To carry out its missions, the University of Namur (or UNamur) processes personal data. This processing is subject to personal data protection regulations, which require a certain level of transparency regarding the processing activities carried out.

The purpose of this notice is to provide general information about the processing of personal data carried out by the University of Namur, in addition to more specific information that is, where applicable, provided at the time of data collection or through other means made available to the individuals affected by such processing.

Ethical Principles Governing the Use of Computer Systems

Why does the University of Namur process personal data?

The University of Namur processes personal data primarily to carry out the following missions and activities:

Its teaching and degree-granting missions. See in particular: 
Its research missions. See in particular: 
Its community service missions. See in particular: 
Its services to the university community. See in particular: 
Management of services offered to students. See in particular: 
Human resources management
Promotion of its academic programs and activities. See in particular:
Program management. See in particular:
Event organization. See in particular:
Offering sports activities
Management of its alumni network
Administrative, financial, and logistical management of the University. See in particular:
Management of the University’s buildings, infrastructure, and resources, as well as their security. See in particular:

The legal basis on which the University of Namur relies to process this personal data depends on the specific situation: 

  • Depending on the circumstances, this may involve processing necessary for the performance of a public interest mission entrusted to the University as part of its teaching, research, and community service responsibilities.
  • In many cases, the University must process certain data to comply with its legal obligations (for example, under labor law, for public procurement, for maintaining its accounting records, or to respond to requests for information from third parties legally authorized to request such information).
  • Certain processing activities are based on a contract entered into with the data subject (for example, an employment contract, a lease agreement, a publishing contract, registration for a conference, etc.).
  • In some cases, the University relies on a legitimate interest to process data. This is the case, for example, to promote its activities or to ensure the security of its buildings.
  • Finally, certain processing activities are based on the consent of the data subjects (for example, subscribing to a newsletter).

As a general rule, the University retains data for as long as necessary for the purposes for which it is processed, taking into account, where applicable, the rights of the data subjects, mandatory legal retention requirements, and the statutory period during which the University may be held liable.

Who processes personal data and has access to it?

The University’s missions and activities are carried out through its institutional departments, faculties, and schools, as well as its research centers and institutes.

However, the legal entity responsible for data processing is the non-profit organization Université de Namur, whose registered office is located at 61 Rue de Bruxelles, 5000 Namur.

Is the data shared with third parties outside the University?

Personal data processed by the University of Namur is, in principle, restricted to internal use by University staff for the purposes of their duties.

However, it may be disclosed to third parties (public administrations, publishers, other universities or educational institutions, inter-university consultative bodies—including the Council of Francophone Rectors (CRef)—, ARES, AEQES, research funders, tax authorities, ONSS, ONEM, judicial authorities, subcontractors, ...), to the extent that this is necessary in light of the purpose for which the data is processed, if the University of Namur is legally required to do so, or when the University engages external service providers, some of whom are responsible for processing this data on its behalf and in accordance with its instructions.

What are your rights as a data subject in connection with data processing carried out by the University of Namur?

In accordance with regulations governing the protection of personal data, individuals whose data is processed have certain rights, the conditions and limitations of which are set forth primarily in Chapter III of the General Data Protection Regulation (GDPR).

Below is an overview of these rights:

The Right to Information

Any individual has the right to request information on whether or not data concerning them is being processed, and, if so, to request information regarding such processing.

Right of Access

Any individual whose data is processed by the University has the right to request that a copy of the processed data concerning them be provided to them. 

Right to rectification

Any person whose data is processed by the University has the right to request that any data concerning them that is inaccurate or incomplete be rectified or completed.

Right to Object

There is a right to object, without providing a reason, to the use of one’s data for marketing purposes. This right implies, for example, that individuals outside the University may request to no longer receive information about the University’s activities via email or mail.

Any individual whose data is processed by the University may also request, for reasons related to their particular situation, that their data no longer be processed by the University when such processing is carried out in the course of a public interest mission or to pursue a legitimate interest. In such cases, the University will no longer process the data, unless there are compelling and legitimate grounds for the processing that override the interests of the data subject, or if the processing is necessary for the establishment, exercise, or defense of the University’s legal rights.

Right to Withdraw Consent

When the use of personal data is based on the consent of the data subject, the data subject has the right to withdraw that consent at any time. This does not affect the lawfulness of processing carried out prior to the withdrawal of consent.

Right to Erasure

This right allows you to request the erasure of your data when the processing is unlawful or is no longer necessary for the purposes for which the data was collected.

This right may not always be exercised, particularly if:

  • The processing of the data is necessary for the exercise of the right to freedom of expression and information,
  • The processing of data is necessary to comply with the University’s legal obligations,
  • The processing of data is essential for the establishment, exercise, or defense of one’s rights in court,
  • Such erasure would render impossible or seriously compromise the purposes of processing carried out for scientific or historical research purposes or for statistical purposes.

Right to Data Portability

If personal data has been provided to the University for the purpose of entering into a contract or for use based on consent, the data subject has the right to request to receive such data in a commonly used, structured format or to request that it be transmitted to a third party, provided, however, that the University’s processing of the data is carried out by automated means.

Right to Restriction of Processing

In certain cases, a person may request that the processing of their data be restricted while a request concerning said data is being reviewed.

This right may be exercised in four situations:

  • While the University is verifying the accuracy of data that has been contested,
  • If the processing is unlawful but the data subject does not wish to have their data erased and instead requests that its use be restricted,
  • If the University no longer needs the data for the purposes for which it was used, but the data is still necessary for the establishment, exercise, or defense of legal claims,
  • If an individual has objected to the processing of their data, during the verification of whether the legitimate grounds pursued by the University can justify the continued use of such data.
  • In these cases, the University will limit itself to storing the data pending these verifications and will not use it for any other purpose.

There are, however, exceptions to this limitation. The data may continue to be processed with the data subject’s consent, for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for important reasons of public interest.

Right Not to Be Subject to an Automated Decision

Every individual has the right not to be subject to a decision based solely on automated processing if the decision produces legal effects concerning them or similarly significantly affects them. In such cases, the data subject may request human intervention and the opportunity to express their point of view and challenge the decision.

However, this right may not be exercised in certain cases, including when the decision is necessary for the conclusion or performance of a contract, is authorized by law, or is based on the data subject’s explicit consent.

How can I contact the University to learn more about exercising my data protection rights?

Unless a specific procedure has been brought to the attention of the individuals concerned (for example, for unsubscribing from mailing lists through automated means or for accessing exam copies), questions and requests to exercise rights may be directed (in which case proof of identity must be provided) to the UNamur Data Protection Officer:

Data
Protection Officer, Rector’s
Office, Rue de Bruxelles, 61
, 5000 Namur

More information on the protection of personal data is available on the Data Protection Authority’s website: www.autoriteprotectiondonnees.be
It is also possible to file a complaint with this Authority or to bring a legal action if the rights of the individual whose data has been processed have not been respected or if the processing of the data does not comply with the regulations.