The National University of Science and Technology POLITEHNICA Bucharest understands its obligations towards you and aims to always protect your personal data. At the same time, POLITEHNICA Bucharest, in its desire to be transparent about the categories of data processed, aims to help you understand how and why your data is processed.

Identity and contact details of the operator

The National University of Science and Technology POLITEHNICA Bucharest, CUI 48467613, located at Splaiul Independenței, no. 313, Sector 6, Bucharest, Romania, Postal Code – RO-060042, tel: 021 402 9100, email: cabinet.rector@upb.ro, as a personal data operator, collects and processes personal data through faculties, departments, doctoral schools, directions/services/offices/units, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR) and national legislation on the protection and security of personal data in force. .

POLITEHNICA Bucharest focuses on respecting the principles related to the processing of personal data, which stipulate that personal data are:

1. processed lawfully, fairly, and transparently in relation to the data subject (‘lawfulness, fairness, and transparency’);
2. collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
3. adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’);
4. accurate and kept up to date;
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed;
6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’).

Contact details of the data protection officer

For any questions regarding how POLITEHNICA Bucharest processes data, or if you wish to exercise your rights conferred by legislation, you can contact the Data Protection Officer – Mocanu-Paraschiv Ioana:

• by email, at: dpo@upb.ro;
• phone: +4021 402 9012;
• at the correspondence address: Splaiul Independenței, no. 313, Rectorate building, office no. 418, sector 6, Bucharest;

working hours: Monday-Friday, between 800 – 1600.

Purpose of personal data processing

According to GDPR 679/2016, ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Data are processed for the purpose of concluding and executing any type of contract in which POLITEHNICA Bucharest is a party, for fulfilling legal obligations, in the legitimate interest of the university and all categories of persons.

Data are also processed for carrying out activities necessary to achieve the purpose for which the institution was created: education and culture, and in accordance with its object of activity, as well as in connection with the conduct of complementary activities by POLITEHNICA Bucharest: accommodation services, catering, sports and recreational activities, space rental, etc. Additionally, data collected by the video surveillance system are necessary for the protection of objectives, goods, and values, as well as the protection of persons.

Furthermore, the information processed by the university is used for analyses and statistical processing necessary for substantiating the institution’s management decisions, as well as for archiving purposes, in accordance with legal provisions.

The processing of personal data is primarily carried out for all purposes provided by Law no. 199/2023 or its subsequent legislation, as well as for purposes derived from the mission of the higher education institution or closely related to this mission.

Among the main purposes are: enrollment in study programs, conducting admission activities, carrying out educational activities, graduation, employment/promotion of staff, conducting scientific and publishing activities, accommodation, granting facilities, etc.

Types of personal data collected by POLITEHNICA Bucharest

“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The university processes only the personal data necessary for the above-mentioned purposes, namely for the fulfillment of the mission of POLITEHNICA Bucharest and the execution of the contractual obligations that the university has. The request for these categories of data is based on the necessity of complying with certain legal provisions by POLITEHNICA Bucharest.

The categories of personal data subject to processing are, without being exhaustive, the following: name, surname, personal identification number, ID/Passport series and number, date and place of birth, citizenship, signature, data recorded in civil status documents, domicile, profession, workplace, professional training, family situation, military situation, health and social insurance, bank data, work accidents, data recorded in the Curriculum Vitae, medical situation, information regarding the studies carried out/completed, including grades/averages obtained during the studies, electronic identification addresses (see the cookie usage policyPOLITEHNICA Bucharest), data obtained from audio-video recordings. These vary depending on the category of data subjects (employees/teaching staff/students, etc.).

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, biometric data, data concerning a natural person’s sex life or sexual orientation is permitted only in the situations clearly provided by art. 9 para. (2) of Regulation (EU) 2016/679.

Categories of data subjects

POLITEHNICA Bucharest processes the personal data of the following categories of persons:

• candidates for admission exams/future students;
• students (bachelor’s, master’s, doctoral), trainees, course participants;
• parents and representatives of students,
• former students;
• candidates for job competitions;
• employees: teaching staff, associate teaching staff, auxiliary and non-teaching staff, staff employed in research projects/funded by European funds, hourly paid collaborators;
• former employees;
• collaborators and contractors: service providers, suppliers of goods and services, participants in tenders, bidders;
• visitors: persons registered at access points and/or filmed by video surveillance cameras, visitors to the university’s websites;
• collaborating scientific researchers;
• any natural or legal person who has contractual relations with POLITEHNICA Bucharest.

Legal basis for data processing by POLITEHNICA Bucharest

The legality of processing your personal data is represented by:

• International regulations:

• Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• Regulation (EU) 2015/759 of the European Parliament and of the Council of 29 April 2015 amending Regulation (EC) No 223/2009 and the MEN – National Institute of Statistics (INS) Convention on data processing for the production of official education and vocational training statistics;

• National legislation:

• • Law no. 190 of July 18, 2018, on measures to implement Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
  • Law no. 544/2001 on free access to public information;

• Higher Education Law no. 199/2023 with subsequent amendments and completions;

• Law 258/2007 on the practice of pupils and students;

• • Framework Law no. 153/2017 on the remuneration of personnel paid from public funds;

• Law no. 333/2003 on the guarding of objectives, goods, values, and the protection of persons and its application norms;

• Government Decision 301/2012 Methodological norms for the application of Law 333/2003;

• Instruction 9/2013 on conducting risk analysis for physical security;

• Accounting Law no. 82/1991 republished and updated;

• • Law no. 227/2015 on the Fiscal Code updated by Law no. 131 of July 15, 2020;
  • Law no. 53 of January 24, 2003, the LABOR CODE republished in 2011;
  • Law 307/July 12, 2006, on fire protection, text in force starting March 25, 2016, republished in 2019;
  • Law 481/2004 (republished in 2023) – on civil protection;
  • Law 319/2006 – occupational safety and health;

• Law no. 365/2002 on electronic commerce, republished in 2006, with subsequent amendments;

• • Law no. 129/2019 – for the prevention and combating of money laundering and terrorist financing, as well as for the modification and completion of some normative acts;

• Order no. 3714/2018 of May 21, 2018, on the approval of the Regulation for the organization, operation, and operationalization of the Unique Matriculation Register of Universities in Romania;

• Government Ordinance no. 129 of 2000 on adult professional training, republished in 2014;
• Emergency Ordinance no. 97 of July 14, 2005 (republished) on the record, domicile, residence, and identity documents of Romanian citizens, published in the OFFICIAL GAZETTE no. 719 of October 12, 2011;

• Internal regulations of the university:

• POLITEHNICA Bucharest Charter;

• POLITEHNICA Bucharest Internal Regulation;

• Regulation on the organization and operation of dormitories and canteens belonging to POLITEHNICA Bucharest;

• Methodology for admission to studies and schooling of foreign citizens from non-EU states, who are not part of the European Economic Area and the Swiss Confederation POLITEHNICA Bucharest;
• Other regulations available on the POLITEHNICA Bucharest website (https://upb.ro/regulamente-si-rapoarte/).

According to art. 6 lit. (a) of the GDPR, “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”, the consent of the data subjects can be used as a legal basis for the processing of personal data additional to the purpose pursued by POLITEHNICA Bucharest in order to fulfill the legal obligations incumbent on the institution.

Categories of recipients of personal data

Personal data is intended for use by the operator (POLITEHNICA Bucharest) and is communicated to the following recipients, if applicable:

• Ministries: Ministry of National Education, Ministry of Research and Innovation, Ministry of European Funds, Ministry of Youth and Sports, Ministry of Public Finance, etc.;
• National Council for Higher Education Statistics and Forecast;
• General Directorate of University Education within the MEN;
• National Company Romanian Post (for printed correspondence – if necessary);
• Commercial organizations: banking, accommodation units, food units, etc.;
• Student organizations: LSAC, ASFE, ASIMST, ASPOLI, BEST, EESTEC, etc.;
• Unions/CAR;
• Student Cultural Houses and the Tei Student Cultural Sports Complex;
• IT service providers (maintenance, software development);
• Archiving in physical and/or electronic format; audit; etc.;
• Other national or international higher education institutions;
• National or European institutions that finance research projects;
• Public institutions: social and health services (CASMB, CNAS, ANOFM, etc.), central and local public authorities in Romania (e.g., MAI, ANAF, ITM, ONPCSB, Competition Council, National Archives), police bodies, Court of Accounts of Romania;
• Medical institutions (for occupational medicine services);
• University collaborators;
• Judicial bodies in Romania and other countries (EU, recognized by the EU as complying with personal data protection norms or having personal data protection agreements with Romania), as well as courts, prosecutor’s offices;
• Institutions for investigating and supporting cybersecurity incidents.

Disclosure of data by POLITEHNICA Bucharest to third parties is done according to legal provisions for the categories of recipients mentioned above.

Transfer of personal data to a recipient in a third country

According to Articles 45 and 46 of the GDPR, the transfer of personal data can be carried out:

• based on a decision regarding the adequacy of the level of protection issued by the European Commission, which decides that the third country in question ensures an adequate level of protection. Transfers made under these conditions do not require special authorizations;
• based on appropriate safeguards.

The data transfer will be executed based on a bilateral agreement on personal data protection stipulated through contractual clauses.

The purpose of these transfers is to facilitate the participation in international mobility of students and teaching staff of POLITEHNICA Bucharest.

The period for which personal data will be stored

Personal data that has been or will be requested will be provided by the data subject or their legal representatives and will be processed for a period specified in European and national legislation, in accordance with the GDPR and other legal bases that impose this, respecting the principles of ensuring their security and respecting your rights.

Rights of the data subject

According to EU Regulation 679/2016, you benefit from:

• Transparency of information, communications, and modalities for exercising the rights of the data subject – POLITEHNICA Bucharest provides and communicates any information regarding the processing of personal data, in a concise, transparent, intelligible, and easily accessible form (according to Article 12 of the GDPR);

• • the right to be informed – by POLITEHNICA Bucharest about the type, purpose, and legal grounds of the processing (according to Articles 13 and 14 of the GDPR);
  • the right of access – the data subject has the right to obtain from POLITEHNICA Bucharest a confirmation whether or not personal data concerning them is being processed (according to Article 15 of the GDPR);
  • the right to rectification – without undue delay, of inaccurate personal data (according to Article 16 of the GDPR);
  • the right to erasure of data (“the right to be forgotten”) – the data subject has the right to obtain from POLITEHNICA Bucharest the erasure of personal data concerning them (according to Article 17 of the GDPR);
  • the right to restriction of processing – the data subject can obtain the restriction of processing if one of the cases mentioned in Article 18 of the GDPR applies;

• POLITEHNICA Bucharest has the obligation to notify regarding the rectification or erasure of personal data or restriction of processing (according to Article 19 of the GDPR);

• the right to data portability – POLITEHNICA Bucharest can transmit upon request the initially provided data of the data subject to another operator (according to Article 20 of the GDPR);

• the right to object – the data subject has the right to object within the limits of the applicable legislation (according to Article 21 of the GDPR);
• the right not to be subject to a decision based solely on automated processing, including profiling (according to Article 22 of the GDPR).

You are also recognized the right to file a complaint with the National Supervisory Authority (www.dataprotection.ro) and to address the judiciary.

To exercise these rights, you can address a written, dated, and signed request to the Personal Data Protection Office within POLITEHNICA Bucharest or electronically at the email address dpo@upb.ro.

In these requests, please do not disclose sensitive personal data (information regarding religious beliefs, ethnic or racial origin, or any other information related to health or union membership) when contacting us.

For specific requests related to how we manage your data, we will try to resolve these issues, but please note that there may be circumstances where we cannot comply with certain requests.

When requests from a data subject are manifestly unfounded or excessive, particularly due to their repetitive nature, the controller (POLITEHNICA București) may:

• either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the requested action;
• or refuse to act on the request.

In such cases, the university has the burden of demonstrating the manifestly unfounded or excessive nature of the request.

Source of personal data

POLITEHNICA București collects personal data directly from you or from third parties (such as recommendations, certificates from legal entities, educational institutions, etc.).

If we need to process personal data obtained from third-party legal entities, they are obliged to provide you with the necessary information regarding the use of the transmitted personal data.

Details regarding special data processing or processing based on consent

When processing is based on Article 6(1)(a)the data subject has given consent to the processing of their personal data for one or more specific purposesor on Article 9(2)(a)the data subject has given explicit consent to the processing of those personal data for one or more specific purposes, except where Union or Member State law provides that the prohibition referred to in paragraph (1) may not be lifted by the data subject’s consentfrom the GDPR, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Thus, you can modify or eliminate your consent at any time, and we will act accordingly immediately, except where there is a legal reason or legitimate interest not to do so.

POLITEHNICA București’s commitment and policy on data protection and security

The National University of Science and Technology POLITEHNICA București takes data protection and security very seriously.

All documents containing personal data are recorded and follow the rules for retention, processing, duplication, transport, transmission, and archiving established by professional training legislation, archiving law, accounting legislation, labor legislation, and internal procedures.

Considering the current state of development, implementation costs, and the nature, scope, context, and purposes of processing, as well as the risk with varying degrees of probability and severity for the rights and freedoms of natural persons, the National University of Science and Technology POLITEHNICA București implements appropriate technical and organizational measures to ensure a level of security appropriate to this risk.

Only individuals with specific responsibilities within POLITEHNICA București have access to the personal data of educational service beneficiaries. The staff of POLITEHNICA București who process your data are trained and obliged under the penalty of the Criminal Code to maintain the confidentiality of your personal data.