Privacy and Personal Data Processing Statement

 

1 - General Provisions

  1. This policy applies to all personal data processed by Ciência Viva – National Agency for Scientific and Technological Culture.
  2. This policy applies to all professionals and partners and any third parties who have or may have access to personal data processed by Ciência Viva - National Agency for Scientific and Technological Culture.
  3. The Data Protection Officer will assume responsibility for the continued compliance of Ciência Viva - National Agency for Scientific and Technological Culture with this policy.

 

2 - Principles relating to personal data processing

Ciência Viva - National Agency for Scientific and Technological Culture is committed to processing personal data in accordance with the requirements of the GDPR.

Article 5 of the GDPR requires that personal data be:

  1. Processed lawfully, fairly and in a transparent manner in relation to the data subject;
  2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes shall not be considered to be incompatible with the initial purposes;
  3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
  4. Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
  5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject; and
  6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures

 

3 - Lawfulness, fairness and transparency in data processing

  1. In order to ensure that the data is processed in a lawful, fair and transparent manner, Ciência Viva - National Agency for Scientific and Technological Culture maintains a GDPR Management System.
  2. Ciência Viva - National Agency for Scientific and Technological Culture is required to ensure that personal data are kept accurate and up to date. When necessary, taking into account the legal grounds on which the data are processed, measures will be taken to ensure that the data are kept up to date.
  3. Data subjects have the right to access, rectification, portability and erasure of their personal data. They also have the right to limit the processing and lodge a complaint to the supervisory authority, the Portuguese Data Protection Authority (CNPD).
  4. Any requests made to Ciência Viva – National Agency for Scientific and Technological Culture should be processed in a timely manner.

 

4 - Data processing legitimacy

  1. Data must be processed in accordance with one of the following legal bases: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest or legitimate interests
  2. Ciência Viva – National Agency for Scientific and Technological Culture will record the legal basis applicable to each data processing.
  3. When consent is invoked as a legal basis for data processing, the evidence of consent must be maintained with the personal data.
  4. When communications are sent to data subjects, on the basis of their consent, the option to revoke consent must be clearly available and the GDPR management system must ensure that this revocation is accurately reflected in the records of Ciência Viva – National Agency for Scientific and Technological Culture.

 

5 - Data Controller

Ciência Viva – National Agency for Scientific and Technological Culture, holder of legal person identification no. 504300156, with its registered office at Pavilhão do Conhecimento – Centro Ciência Viva, is the data controller and has a Data Protection Officer. Ciência Viva - National Agency for Scientific and Technological Culture decides which data are collected, the means of processing and the purposes for which the data are processed.

Its contact details are as follows:

  • Address: Largo José Mariano Gago, Parque das Nações, 1990-073 Lisbon - Portugal
  • Phone: + 351 21 898 50 20
  • Using the form at

The contact details for our Data Protection Officer are:

  • Ciência Viva – National Agency for Scientific and Technological Culture
  • Data Protection Officer
  • Address: Largo José Mariano Gago, Parque das Nações, 1990-073 Lisbon - Portugal
  • Phone: + 351 21 898 50 20
  • Using the form at

 

6 - Data minimisation

Ciência Viva – National Agency for Scientific and Technological Culture guarantees that the personal data processed are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

 

7 - For what purposes are the personal data processed?

As part of its activity, it collects data for the following purposes:

  1. As an employer, it collects, processes and stores personal data on employees, contractors, consultants and jobseekers.
  2. As part of its activity to disseminate scientific and technological culture:
    1. In promoting scientific and technological culture to the entire Portuguese population and carrying out projects in which it collects, processes and stores personal data from the general public, partners, trainees, instructors, educators, teachers and students.
    2. In promoting experimental science education in primary and secondary schools and carrying out projects in which it collects, processes and stores personal data from partners, trainees, instructors, educators, teachers and students.
    3. In organising scientific dissemination campaigns targeting the general public and carrying out projects in which it collects, processes and stores personal data from partners and the general public.
    4. In promoting a National Network of Ciência Viva Centres, interactive science museums in which it collects, processes and stores personal data from customers, partners, trainees and instructors
    5. In developing partnerships with third parties, with a view to promoting scientific projects, in which it collects, processes and stores personal data from trainees, students, educators and teachers and employees of third parties.
    6. As a facilitator and manager of projects in promoting scientific and technological education and culture and bringing society and the scientific community together, in which it collects, processes and stores personal data from the general public, partners, trainees, instructors, educators, teachers and students.
    7. In managing the Pavilhão do Conhecimento – Centro Ciência Viva as a space for access to scientific knowledge and involving the whole of society in scientific issues in a variety of areas, as the largest national science centre, directly connected with international counterparts, in which it collects, processes and stores personal data from the general public, partners, teachers and students.
    8. Promoting and energising the Ciência Viva Clubs at School Network and the Ciência Viva Schools Network as projects to promote active and experimental teaching of science and to promote school success, in which it collects, processes and stores personal data from partners and their employees, educators and teachers, students, trainees and instructors

 

8 - What data are collected and processed

When dealing with Ciência Viva - National Agency for Scientific and Technological Culture, data subjects must provide the personal data strictly necessary for the respective processing activity.

Ciência Viva – National Agency for Scientific and Technological Culture only requests the provision of personal data that are relevant for the purposes of personal data processing activities, excluding other types of data.

Ciência Viva – National Agency for Scientific and Technological Culture collects the following categories of personal data:

  1. Identification data (e.g. name, identification document number, tax identification number, photograph)
  2. Contact data (e.g. address, telephone number or email address)
  3. Biographical data (e.g. date of birth, sex, nationality, place of birth, marital status)
  4. Billing data (e.g. TIN, amount, date, IBAN)
  5. Products and services (e.g. Ciência Viva Journeys card number)       
  6. Family life (e.g. household, number of children)
  7. Professional life (e.g. profession, working hours, pay)
  8. Access accounts (e.g. user account, user authentication credentials)
  9. Contents: Information (e.g. contained in written communications between users and Ciência Viva, recorded calls (video and/or audio))
  10. Transactions (e.g. entries and exits from Ciência Viva centres)
  11. Use of websites and applications (e.g. pages visited, or information about the equipment used (e.g. IP address, geographical location, browser used))

As part of its activity, no decisions are made using automated means, including profiling.

 

9 - Data Recipients

  1. All professionals and partners must avoid any inappropriate disclosure of personal data and comply with the general duties of confidentiality.
  2. Data may be disclosed to third parties when we have a legitimate basis for doing so or when the third party is processing data on our behalf. The contractual relationship is governed by a contract which defines the security and organisational measures for the processing and specifies that it will only act on instructions from Ciência Viva – National Agency for Scientific and Technological Culture.
  3. Data may also be disclosed if necessary for the purposes of complying with a legal obligation, statute or court order; for the purpose of obtaining legal advice; under or for the purposes of exercising or defending a right in legal proceedings or when necessary to defend a legal right; or to safeguard national security.

 

10 - How the personal data are collected

Ciência Viva – National Agency for Scientific and Technological Culture obtains personal data through the following means of collection (or production):

Data provided directly by data subjects

  1. in the process of subscribing to or purchasing products and services (e.g. purchasing Ciência Viva Cards; Birthday Parties; Exhibition Tickets);
  2. in interactions with the Ciência Viva Centres Network; Ciência Viva Clubs Network; Ciência Viva Farm Network; Ciência Viva Journeys and visits to the Pavilhão de Conhecimento facilities,
  3. in letters or emails sent to Ciência Viva;
  4. participating in promotional activities for Ciência Viva,
  5. in responding to satisfaction surveys.

Data collected in the context of data subjects using products and servicesData relating to operations and transactions carried out by data subjects with Ciência Viva (e.g. Book that we want to read; Short-term Shares).

Obligation to provide personal dataIn the context of commercial and contractual relations, is it obligatory to submit and collect some personal data on Employees, Suppliers, Partners, Visitors, Customers, potential Customers and others, which are necessary to comply with pre-contractual and contractual obligations and steps, or those arising from the regulations in force. As a general rule, without these data, Ciência Viva – National Agency for Scientific and Technological Culture will have to refuse to sign the contract or will have to terminate the contract.

 

11 - International Data Transfer

  No personal data are transferred outside the European Union.

 

12 - Retention of Personal Data

  1. In order to ensure that personal data are kept for the time strictly necessary for the purpose of their processing, Ciência Viva – National Agency for Scientific and Technological Culture has adopted a Data Retention and Disposal Policy for each process for which personal data are processed.
  2. The Retention and Disposal Policy considers which data should be kept, for how long and why.
  3. Personal data collected by Ciência Viva – National Agency for Scientific and Technological Culture are stored for the period necessary to achieve the purposes of this Regulation
  4. The personal data collected will be kept secure in order to safeguard its confidentiality, integrity and availability. For this purpose, Ciência Viva – National Agency for Scientific Culture has adopted technical and organisational measures to prevent unauthorised use or access, modification, unlawful or accidental destruction and accidental loss.

 

13 - Rights of personal data subjects

Ciência Viva – National Agency for Scientific and Technological Culture guarantees that data subjects may exercise their rights in relation to the relevant processing.

The data subject has the following rights in terms of personal data protection:

  1. Access: Without prejudice to the protection of the rights of third parties, Data Subjects have the right to access personal data concerning them and to obtain information on their processing conditions.
  2. Rectification: Data Subjects have the right to request the rectification of their personal data which are inaccurate or incomplete (e.g. address, email address, telephone numbers).
  3. Objection: Data Subjects have the right to object to data processing based on the legitimate interest of Ciência Viva – National Agency for Scientific and Technological Culture
  4. Withdrawal of consent: Data Subjects have the right to withdraw the consent they have granted for the processing of data based on them.
  5. To be forgotten: Data Subjects have the right to erasure of their personal data held by Ciência Viva – National Agency for Scientific and Technological Culture, provided that there are no valid grounds for its retention (e.g. compliance with a legal obligation, defence of Ciência Viva – National Agency for Scientific and Technological Culture or third parties in legal proceedings).
  6. Limitation: Data Subjects have the right to request that data processing be limited when:
    1. they have contested the accuracy of the personal data and for a period which allows Ciência Viva – National Agency for Scientific and Technological Culture to verify their accuracy;
    2. the processing is unlawful and they object to the erasure of the personal data;
    3. Ciência Viva – National Agency for Scientific and Technological Culture no longer needs the personal data, but such data are required by the Data Subjects for the purpose of declaring, exercising or defending a right in legal proceedings;
    4. they have objected to the processing and during the period for evaluating the request by Ciência Viva – National Agency for Scientific and Technological Culture
  7. Portability: Data Subjects are entitled to receive the personal data they have provided to Ciência Viva – National Agency for Scientific and Technological Culture, in a structured, commonly used and machine-readable format, and the right to transmit such data to another controller

 

14 - Procedure for exercising rights

In order to exercise your rights, you should contact Ciência Viva - National Agency for Scientific and Technological Culture, through this form or by letter for the attention of Ciência Viva - National Agency for Scientific and Technological Culture, Pavilhão do Conhecimento - Centro Ciência Viva, Largo José Mariano Gago, Parque das Nações, 1990-073 Lisbon - Portugal

Ciência Viva – National Agency for Scientific and Technological Culture will respond to requests within a maximum of 30 days, except for especially complex requests.

Ciência Viva – National Agency for Scientific and Technological Culture will inform data subjects of

  1. any need to extend the response deadline by an additional period of up to 60 days,
  2. with the relevant justification.

Whenever Ciência Viva – National Agency for Scientific and Technological Culture considers that it is not possible to respond to the requests, the data subjects will be informed of Ciência Viva – National Agency for Scientific and Technological Culture’s reasons, within the deadlines set out above.

Exercising your rights is free of charge, except when situations considered excessive, anomalous and/or in bad faith occur. In these situations, Ciência Viva – National Agency for Scientific and Technological Culture will inform data subjects in advance of the fees to be charged and the respective justification.

Ciência Viva – National Agency for Scientific and Technological Culture has adequate mechanisms to verify and confirm the identity of the data subjects who wish to exercise their rights, exclusively attending to those whose identity can be confirmed, and through a channel that allows evidence of the request and the respective response to be kept.

If they so wish, they may also lodge a complaint with the National Data Protection Commission (CNPD) www.cnpd.pt.

 

15 - Security

  1. Ciência Viva – National Agency for Scientific and Technological Culture will maintain data security while protecting the confidentiality, integrity and availability of personal data.
  2. To ensure data security, it has adopted technical and organisational measures to prevent unauthorised use or access, modification, unlawful or accidental destruction and accidental loss.
  3. Access to personal data is controlled and restricted to professionals who need to access them, in accordance with the Information Security Policy, and appropriate security measures have been taken to prevent the unauthorised sharing of the information.
  4. Data is securely erased so that data is unrecoverable.

 

16 - Data breach

In the event of a security breach leading to the accidental or illegal destruction, loss, alteration, unauthorised disclosure of or access to personal data, Ciência Viva – National Agency for Scientific and Technological Culture will assess the risk to the rights and freedoms of data subjects and, if appropriate, report such breach to the CNPD (Portuguese Data Protection Authority).

 

17 - Amendments to the Privacy Policy

Ciência Viva – National Agency for Scientific and Technological Culture reserves the right to amend this Privacy Policy at any time.

If the change is substantial, a notice will be posted on the website.