EDPRO ASSOCIATION

Data Protection Policy

1. Purpose of This Policy

EDPRO ASSOCIATION (“EdPro”) is committed to protecting the personal data of learners, members, applicants, trainers, staff, volunteers, partners and other individuals who interact with the organisation.

This Data Protection Policy establishes the principles and procedures EdPro follows when collecting, accessing, using, storing, sharing and deleting personal data.

The purpose of this policy is to:

• Ensure personal data is processed lawfully, fairly and transparently.

• Protect the confidentiality, integrity and security of personal information.

• Ensure personal data is collected only for legitimate and specified purposes.

• Reduce the risk of unauthorised access, disclosure, loss or misuse.

• Explain the responsibilities of people who handle personal data on behalf of EdPro.

• Support compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Portuguese data-protection legislation.

2. Scope

This policy applies to all personal data processed by EdPro in connection with its activities, including:

• Applications, enrolments and registrations for courses and training programmes.

• Membership registration, administration and support.

• Guidance and administrative assistance for learners.

• The PLA Programme delivered by Centro Qualifica.

• Workshops, seminars, educational events and other learning activities.

• Communications with learners, members, trainers and external partners.

• Membership fees, course payments and financial records.

• Website enquiries, analytics and marketing communications.

• Recruitment, staff, volunteer and contractor administration, where applicable.

This policy applies to employees, officers, volunteers, trainers, contractors and other authorised individuals who handle personal data on EdPro’s behalf, to the extent relevant to their roles.

3. Data Protection Principles

EdPro will follow the data-protection principles established by the GDPR.

3.1. Lawfulness, fairness and transparency

Personal data must be processed lawfully, fairly and transparently. Individuals must receive appropriate information about how their data is used.

3.2. Purpose limitation

Personal data must be collected for specified, explicit and legitimate purposes. It must not subsequently be used in a way that is incompatible with those purposes.

3.3. Data minimisation

Only personal data that is adequate, relevant and necessary for the intended purpose should be collected or accessed.

3.4. Accuracy

Reasonable steps must be taken to ensure that personal data is accurate and, where necessary, kept up to date.

3.5. Storage limitation

Personal data must not be kept in identifiable form for longer than necessary, except where a longer retention period is required or permitted by law.

3.6. Integrity and confidentiality

Appropriate technical and organisational measures must be used to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.

3.7. Accountability

EdPro must be able to demonstrate compliance with applicable data-protection requirements through appropriate policies, records, procedures and safeguards.

4. Types of Personal Data

Depending on the service or activity, EdPro may process:

• Names and contact details.

• Application forms and supporting documents.

• Educational and professional information relevant to a course or application.

• Membership and registration records.

• Attendance, participation, assessment or completion information where applicable.

• Payment, invoice and transaction records.

• Emails, messages, support records and complaints.

• Website usage and technical information.

• Staff, volunteer and contractor information, where applicable.

EdPro will take particular care with sensitive information, including health information or other special-category personal data under the GDPR. Such information must only be collected where necessary and processed where an appropriate legal basis and any additional conditions required by law are satisfied.

5. Lawful Basis for Processing

Before processing personal data, EdPro must identify and document an appropriate lawful basis under the GDPR.

Depending on the circumstances, this may include:

• Contract: where processing is necessary to enter into or perform a contract with a learner or member.

• Legal obligation: where processing is necessary to comply with applicable legal requirements.

• Legitimate interests: where processing is necessary for EdPro’s legitimate interests and those interests do not override the individual’s rights and freedoms.

• Consent: where an individual has given valid consent for a specified purpose and consent is the appropriate legal basis.

Where consent is relied upon, it must be freely given, specific, informed and unambiguous. Individuals must be able to withdraw consent as required by law.

EdPro must not assume that consent is the appropriate legal basis for every processing activity.

6. Collection and Use of Personal Data

Personal data must be collected through appropriate channels and used only for authorised purposes.

When collecting information, EdPro should:

• Explain why the information is needed.

• Collect only information relevant to the requested service.

• Provide the applicable Privacy Notice.

• Verify that the relevant lawful basis has been identified.

• Keep information accurate and correct errors when notified.

• Avoid collecting unnecessary copies of identification documents or other personal records.

• Restrict access to individuals who need the information for their responsibilities.

Personal data must not be used for unrelated purposes without establishing an appropriate lawful basis and providing any additional information required by law.

7. Working with Centro Qualifica and Other Partners

EdPro may share relevant application documents and contact details with Centro Qualifica to facilitate learner referrals, PLA Programme applications and associated administrative communications.

Before sharing personal data, EdPro must:

• Identify the purpose of the disclosure.

• Ensure that the disclosure is lawful and necessary.

• Limit the information shared to what is relevant for that purpose.

• Use an appropriate and secure method of transmission.

• Ensure that learners receive appropriate privacy information.

• Clarify the respective data-protection responsibilities of EdPro and Centro Qualifica.

Where other training providers, instructors, venues or partners are involved, the same principles apply.

If another organisation processes personal data on EdPro’s behalf, an appropriate data-processing agreement must be put in place where required. Where organisations act as joint controllers, the required joint-controller arrangements must be documented.

EdPro must not assume that another organisation’s access to personal data automatically authorises every use of that information.

8. Confidentiality and Authorised Access

All individuals authorised to handle personal data on EdPro’s behalf must maintain its confidentiality.

They must:

• Access only the information necessary for their assigned responsibilities.

• Keep passwords and account credentials confidential.

• Avoid sharing personal information through unauthorised channels.

• Avoid discussing learners’ personal circumstances where others may overhear.

• Ensure documents and devices are not left accessible to unauthorised persons.

• Report suspected unauthorised access or disclosure promptly.

• Follow any applicable confidentiality commitments and security instructions.

Personal data must not be accessed out of curiosity or used for personal purposes.

9. Data Storage and Security

EdPro will implement appropriate technical and organisational security measures proportionate to the risks associated with its activities.

These measures should include, where appropriate:

• Password protection and multi-factor authentication.

• Restricted access to email accounts, membership records and shared folders.

• Secure storage of electronic documents.

• Secure physical storage for paper documents.

• Up-to-date software and device security.

• Appropriate backups and recovery arrangements.

• Secure methods for transferring application documents.

• Regular review of access permissions.

• Secure deletion of information when it is no longer required.

Personal data should not be stored indefinitely in personal email accounts, unmanaged devices or unauthorised cloud services.

Where third-party software or online platforms are used, EdPro should assess whether the provider offers appropriate security and data-protection safeguards.

10. Retention and Deletion

EdPro will maintain appropriate retention periods for different categories of personal data.

Retention periods must take account of:

• The purpose for which the data was collected.

• The duration of the course, membership or other service.

• Applicable Portuguese accounting, tax and other legal obligations.

• The need to maintain evidence of transactions or services provided.

• Any actual or reasonably anticipated legal claims.

When personal data is no longer necessary, it must be securely deleted or anonymised, unless a lawful reason requires continued retention.

EdPro should maintain a retention schedule identifying the principal categories of information, the applicable retention periods and the method of secure disposal.

11. Data Subject Rights

Individuals may have rights under the GDPR to access, rectify, erase or restrict the processing of their personal data, object to certain processing, request data portability, and withdraw consent where consent is the legal basis.

Requests must be handled promptly and in accordance with applicable law.

When a request is received, EdPro should:

1. Record the date and nature of the request.

2. Verify the requester’s identity where reasonably necessary.

3. Identify the personal data and systems concerned.

4. Assess the request and any applicable legal exceptions.

5. Respond within the applicable statutory deadline.

6. Record the outcome and any action taken.

Under the GDPR, the general response period is one month, although a lawful extension may apply in certain circumstances.

Requests should be sent to: info@edpropt.org

Where appropriate, EdPro should coordinate with Centro Qualifica or another relevant organisation if the request concerns data that organisation controls.

12. Personal Data Breaches

A personal data breach may include the accidental loss of a device containing personal information, sending application documents to the wrong recipient, unauthorised access to an account or accidental disclosure of learner information.

Anyone working with personal data on behalf of EdPro must report a suspected breach immediately to info@edpropt.org

EdPro will:

1. Take reasonable steps to contain the incident and prevent further unauthorised access or disclosure.

2. Assess what information was affected and the potential consequences for individuals.

3. Record the incident and the steps taken.

4. Determine whether notification to the competent supervisory authority is required.

5. Inform affected individuals where required by law.

6. Take corrective action to reduce the risk of recurrence.

Where a processor handles data on EdPro’s behalf, it must notify EdPro of a breach without undue delay in accordance with the applicable contractual arrangements and law.

13. Marketing and Communications

EdPro may communicate with learners and members about their applications, courses, memberships, payments, support requests and other relevant services.

Promotional communications concerning courses, workshops, events or other activities must comply with applicable data-protection and electronic-communications rules.

Where consent is required, it must be obtained separately from acceptance of membership terms or course registration conditions.

Marketing recipients must be able to unsubscribe or withdraw consent through an appropriate method.

An individual’s decision not to receive marketing must not prevent the organisation from sending essential communications necessary to provide a service they have requested.

14. Website Cookies and Analytics

EdPro may use essential cookies and analytics technologies to operate and improve its website.

The organisation must identify the cookies and similar technologies actually used on its website and provide appropriate information about their purposes and retention periods.

Where prior consent is required for non-essential analytics cookies or similar technologies, they must not be activated before valid consent is obtained.

Cookie preferences must be managed through an appropriate mechanism, and individuals must be able to withdraw or change their consent where applicable.

15. International Transfers

Where personal data is transferred outside the European Economic Area, EdPro must ensure that the requirements of the GDPR are met.

Depending on the circumstances, this may require an applicable adequacy decision, appropriate safeguards such as standard contractual clauses, and any additional measures required by law.

EdPro should review the locations and transfer arrangements of relevant website, email, storage and other service providers.

16. Training and Responsibilities

EdPro’s management is responsible for ensuring that appropriate data-protection measures are implemented and maintained.

The person designated to oversee this policy should:

• Coordinate data-protection procedures.

• Maintain relevant records and documentation.

• Ensure that privacy notices and consent mechanisms are appropriate.

• Review access controls and security practices.

• Coordinate the response to data-protection requests and incidents.

• Arrange appropriate awareness or training for individuals who handle personal data.

• Review relevant arrangements with Centro Qualifica and other partners.

Employees, volunteers, trainers and other authorised persons must follow this policy and report concerns promptly.

Where a Data Protection Officer is legally required, EdPro must formally designate one and meet the applicable requirements. This policy does not itself appoint a Data Protection Officer.

17. Records and Risk Assessments

EdPro will maintain records and conduct assessments where required by applicable data-protection law.

Depending on the organisation’s activities, this may include:

• Records of processing activities.

• Data-processing agreements with service providers.

• Arrangements with other data controllers.

• Consent and marketing-preference records.

• Personal data breach records.

• Data retention and deletion schedules.

• Data protection impact assessments where processing is likely to result in a high risk to individuals’ rights and freedoms.

The applicability of particular obligations depends on EdPro’s actual processing activities and the requirements of the GDPR.

18. Complaints and Supervisory Authority

Individuals who have concerns about EdPro’s handling of personal data should contact:

EDPRO ASSOCIATION – Organisation of Learning and Professional Development

Email: info@edpropt.org
Address: Rua Dom Afonso Henriques 2
2620-080 Póvoa de Santo Adrião, Odivelas, Lisboa, Portugal.

EdPro will review and respond to complaints in accordance with applicable law.

Individuals also have the right to lodge a complaint with the Portuguese data-protection supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD):

https://www.cnpd.pt/

19. Review and Approval

This policy will be reviewed periodically and whenever significant changes occur in EdPro’s services, data-processing activities, systems or applicable legal requirements.

All relevant personnel should be informed of material changes and any new procedures that apply to their responsibilities.

• EdPro Privacy Notice.

• EdPro Cookie Policy.

• Data Retention Schedule.

• Personal Data Breach Procedure.

• Relevant data-processing agreements.

Organisation: EDPRO ASSOCIATION – Organisation of Learning and Professional Development
NIF/NIPC: 517454084
Policy owner: Edpro's Manager
Effective date: January 2026
Last review date: July 2026
Next review date: January 2027