INFORMATION NOTICE FOR THE DATA SUBJECT
According to the General Data Protection Regulation (GDPR)
- CATEGORIES OF DATA. PURPOSE. LEGAL BASIS. We (Lucian Blaga University of Sibiu – LBUS) may process personal data concerning you to generate and transfer knowledge to society through a) initial and continuous training at the university level for personal development, individual professional insertion, satisfaction of the competence needs of the socio-economic environment, and obtaining scholarships; b) scientific research, development, innovation, and technological transfer, through individual and collective creation, according to Law no. 199/2023 on higher education, with subsequent amendments and completions. We will primarily process your identification data (name, surname, other data from the identity document, email address, phone number, and information contained in the application you complete). We will use your data to respond to any requests, requirements, complaints, or any other inquiries you transmit to us within the relationship with you.
In the event that we ask you to ensure the transmission to us of letters of recommendation, we will process personal data regarding the opinions that the authors of those recommendations have about you. In this case, the source of your personal data will be those individuals. Also, in this case, we will process personal data regarding the authors of those letters (based on their consent) and regarding other identified or identifiable persons mentioned in those documents (based on our legitimate interests).
If you are a visitor to our premises. Then, we may use your personal data to ensure the security of people and objects. In some of our premises, we have installed video surveillance cameras (CCTV) to ensure the security of our employees, other individuals in those premises, and our property. Therefore, we will process images (video recordings) with you (and possibly your voice). In all cases, we have indicated the locations of these cameras through information signs in accordance with the law. Processing data for this purpose is based on our legitimate interest in ensuring the security of people and objects on our premises.
In general, regardless of your position, we may also process your data for the following purposes: recruiting and selecting students, master’s and doctoral students, and residents, keeping records of students, including regarding the insertion of graduates into the labour market (ALUMNI questionnaire, Professional Insertion and Labour Market Dynamics of Bachelor’s / Master’s Graduates – LBUS), scientific research activities and research projects at national and international level, improving the quality of processes carried out within LBUS, as well as for the purpose of preparing the graduate file necessary for enrolment in the final examination of studies, statistics, archiving.
Defending our rights and interests or those of other persons. We may process your data to ascertain, exercise, or defend our rights or interests or those of other persons before the courts, bailiffs, public notaries, other public authorities, arbitration tribunals, mediators or other public or private bodies that resolve disputes, our lawyers, our consultants (such as auditors or experts or specialists), or other natural or legal persons, public or private, involved in those disputes. In this situation, we will process your personal data, as appropriate, on the basis of fulfilling legal obligations incumbent upon us or our legitimate interests.
About third-party data. If you provide us with personal data concerning other persons (for example, your representatives, your family members, persons in your care, etc.), you must ensure that you have informed them about this and have directed them to this information regarding how LBUS processes personal data. We will inform those persons appropriately about how we process their data. - TO WHOM WE WILL DISCLOSE PERSONAL DATA ABOUT YOU. As a rule, we will not disclose your data to other individuals or legal entities. We try to limit access to your data to persons outside LBUS who process your personal data. However, it may be necessary to disclose your data in certain cases, according to the following. We may disclose your data to other companies or individuals, such as the Ministry of National Education, individuals or legal entities acting as authorized persons for us or for other companies in various fields (such as document archiving, document destruction, or data storage, payment services, various services that we may outsource, such as in the field of human resources), other individuals, courts, authorities. In these cases, we will disclose the data for legitimate reasons related to our activity, such as ensuring our ability to ensure document security, relieving our workload, ascertaining, defending, and exercising our rights or the rights of another person. Also, as mentioned above, in certain cases, we may have a legal obligation to disclose data to public authorities or other individuals or legal entities. In all these cases, we will ensure that the recipients of your personal data process them securely and confidentially, in accordance with the purpose for which we transmitted them, and respect your rights.
- UNDER WHAT CONDITIONS COULD WE TRANSFER YOUR DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS. At this time, we do not transfer and do not intend to transfer your personal data or any part thereof to other companies, organizations, or individuals from third countries or to international organizations. If it becomes necessary to transfer data to any of the destinations mentioned above, we will inform you in advance of our decision, giving you the time necessary to exercise your rights regarding the transfer of your data.
- HOW LONG WILL WE KEEP YOUR DATA. We will store your data in accordance with our personal data storage policy, which assigns a storage period based on the purpose of processing and the category of processed data. These periods are based on legal provisions (especially in the field of personal data protection), taking into account also the obligations to store certain data, applicable prescription periods, recommended practices, and the purposes of our activity.
- WHAT COULD HAPPEN IF YOU DO NOT PROVIDE US WITH YOUR DATA. In most cases, you are not obliged to provide us with your personal data. However, if you do not provide the requested data, for example, we will not be able to manage the academic situation of students, conclude a schooling contract, or allow you access to all options on our website, respond to complaints or requests, or send you communications regarding the educational or research/events process that may interest you.
- ABSENCE OF AUTOMATED DECISION-MAKING. We do not make decisions based solely on automated processing of your data (including profiling) that produce legal effects concerning you or similarly affect you to a significant extent.
- YOUR RIGHTS AND HOW TO EXERCISE THEM. Your rights. Right of access to data. You have the right to obtain access to the data concerning you that we process or control or copies thereof; you also have the right to obtain from us information about the nature, processing, and disclosure of this data. Right to rectify data. You have the right to obtain rectification of inaccuracies in the data concerning you that we process or control. Right to erasure of data (“right to be forgotten”). You have the right to obtain from us the erasure of the data concerning you that we process or control. Right to restrict data processing. You have the right to restrict the processing of the data concerning you that we process or control. Right to object. You have the right to object to the processing of data concerning you by us or on our behalf. Right to data portability. You have the right to receive the data concerning you that we process or control in a structured, commonly used, and machine-readable format and to transmit those data to another controller. Right to withdraw consent. In situations where we process data concerning you based on your consent, you have the right to withdraw your consent; you can do this at any time, at least as easily as you initially granted consent; withdrawal of consent will not affect the legality of the processing of data concerning you that we carried out before the withdrawal. Right to lodge a complaint with the supervisory authority. You have the right to lodge a complaint with the supervisory authority for the processing of personal data regarding your data processing by us or on our behalf. In Romania, this authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP). How you can exercise your rights. To exercise one or more of these rights or to ask any questions about any of these rights or any provision in this information or about any other aspects of the processing of your data by us, please use the contact details in the OUR CONTACT DETAILS section below.
- OUR CONTACT DETAILS. Lucian Blaga University of Sibiu, as a state higher education institution under the coordination of the Ministry of National Education, ensures the protection of the fundamental rights and freedoms of individuals regarding the processing of personal data, processes the personal data of university collaborators, and ensures the protection of this data in accordance with applicable legislation; headquarters address: Victoriei Boulevard, no. 10, Sibiu, phone: 0269/21.60.62, fax: 0269/21.78.87, email: rectorat@ulbsibiu.ro, Website: www.ulbsibiu.ro. Contact details of the Data Protection Officer Correspondence address: Victoriei Boulevard, no. 10, Sibiu, phone: 0722 549 915, email: dpo@ulbsibiu.ro available from Monday to Friday between 07:30 – 15:30.
- WHEN THIS INFORMATION APPLIES. This general information applies to the processing of data concerning you by LBUS.
- AMENDMENTS TO THIS INFORMATION NOTE. We may amend this note. In such cases, we will inform you in advance by posting it on our official website 5 days before it comes into effect.
- WHAT THE TERMS USED IN THIS NOTE MEAN. Personal Data Supervisory Authority: an independent public authority that, according to the law, has responsibilities regarding the supervision of compliance with personal data protection legislation. In Romania, this personal data processing supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), headquartered at 28-30 G-ral Gheorghe Magheru Blvd., Sector 1, postal code 010336, Bucharest, tel: 031/805 9211, fax: 031/805 9602.
Personal Data: any information concerning an identified or identifiable natural person (called the “data subject”). A natural person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier, such as name, identification number, location data, online identifier, or one or more specific elements specific to their physical, physiological, genetic, mental, economic, cultural, or social identity. Thus, for example, the following are included in the notion of personal data: name and surname; home address or residence; email address; phone number; personal identification number (CNP); accessed medical services (sensitive data); established diagnosis (sensitive data); genetic data (sensitive data); biometric data (sensitive data); geolocation data. The categories of personal data concerning you that we process are listed above. Data Controller: a natural or legal person who decides why (for what purpose) and how (by what means) personal data are processed. According to the law, the responsibility for complying with personal data protection legislation primarily lies with the data controller. In relation to you, we are the data controller, and you are the data subject. Data Processor: any natural or legal person who processes personal data on behalf of the data controller, other than the controller’s employees. Data Subject: the natural person to whom certain personal data refers (to whom it “belongs”). In our relationship (the controller), you are the data subject. Processing of Personal Data: any operation/set of operations performed on personal data or sets of personal data, whether by automated means or not; for example, collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction of such personal data/sets of personal data. These are just examples. In practice, processing means any operation on personal data, whether automated or manual.