Data Subject Rights Procedure

EdPro Associação

1. Purpose

This procedure explains how EdPro handles requests from individuals exercising their data-protection rights.

2. Making a request

Requests should be sent to:

support@edpropt.org

or

info@edpropt.org

An individual does not normally need to use specific wording or a particular form.

Requests should contain enough information for EdPro to understand the request and, where necessary, identify the relevant individual and records.

3. Identity verification

Where necessary, EdPro may request reasonable information to verify the identity of the person making the request.

We will not request excessive identification information.

4. Handling requests

EdPro will:

1. Record the request;

2. Confirm what right or rights are being exercised;

3. Verify identity where necessary;

4. Locate relevant personal data;

5. Consider applicable exemptions and restrictions;

6. Consult relevant staff or processors where necessary;

7. Respond within the applicable legal timeframe;

8. Keep an appropriate record of the request and response.

5. Access requests

Where an individual requests access to their personal data, EdPro will provide the information required by applicable data-protection law, subject to applicable exemptions.

6. Rectification

Individuals may request correction of inaccurate or incomplete personal data.

Where appropriate, EdPro will update the relevant records and notify relevant recipients where required.

7. Erasure

Individuals may request deletion of personal data in circumstances provided by applicable law.

Erasure is not an absolute right. EdPro may be required or permitted to retain information for legal, regulatory, contractual, accreditation or other legitimate purposes.

8. Restriction

Individuals may request restriction of processing where applicable.

Where processing is restricted, EdPro will only process the information in accordance with applicable legal requirements.

9. Objection

Individuals may object to certain processing where the applicable legal conditions are met.

Individuals may object to direct marketing at any time.

10. Data portability

Where the right applies, EdPro will provide personal data in a structured, commonly used and machine-readable format and may transmit it to another controller where legally required and technically feasible.

11. Consent

Where processing relies on consent, an individual may withdraw consent.

Withdrawal does not affect processing carried out lawfully before withdrawal.

12. Complaints

Individuals who remain dissatisfied may contact the relevant data-protection supervisory authority.

For EdPro's activities in Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).

EdPro Association is committed to protecting your personal data in accordance with the EU GDPR, and applicable national data protection laws. This policy explains how we collect, use, store, and protect your personal information when you enrol in or participate in our programmes.

Legal Framework

We comply with:

• EU GDPR (Regulation (EU) 2016/679)

• Portuguese Data Protection Law (Lei n.º 58/2019)

• UK GDPR and Data Protection Act 2018

Data We Collect

We may collect:

• Full name and personal details

• Contact information (email, phone, address)

• Date of birth

• Identification or residency details (where required)

• Educational background

• Attendance, participation, and assessment records

Purpose of Processing

We process your data to:

• Manage enrolment and course administration

• Deliver training and learning support

• Track attendance, participation, and progress

• Provide certification and coordinate with awarding bodies (including RVCC processes where applicable)

• Comply with legal and regulatory obligations

Legal Basis for Processing

We process personal data under:

• Contractual necessity

• Legal obligation

• Legitimate interest

• Consent (where applicable)

Data Sharing

We may share your information with:

• Lecturers, administrators, and third-party service providers engaged in delivering our services

• External validating partners, verifiers, examiners, and auditors involved in certification and accreditation processes

• Government departments and regulatory bodies overseeing education quality and qualification awarding

• Local education authorities or equivalent organisations

• Law enforcement agencies where required by law or for crime prevention and detection

• Health service providers or emergency services where disclosure is necessary to protect your vital interests

We do not sell or misuse your personal data for unrelated purposes.

Regulatory Bodies & Government Reporting

We are legally required to provide certain learner data, including sensitive personal data where applicable, to regulatory bodies and government departments for registration, certification, and compliance purposes. These bodies may use the data for statistical analysis and regulatory oversight.

Data Protection Principles

EdPro complies with the six core GDPR principles:

• Lawfulness, fairness and transparency – Data is processed legally and transparently

• Purpose limitation – Data is collected for specific, explicit purposes only

• Data minimisation – Only necessary data is collected

• Accuracy – Data is kept accurate and up to date

• Storage limitation – Data is retained only as long as necessary

• Integrity and confidentiality – Data is securely protected against loss, misuse, or unauthorised access

Data Storage & Security

We apply appropriate technical and organisational measures to ensure your data is secure and accessible only to authorised personnel.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy or as required by law. After this period, data is securely deleted or anonymised.

Your Rights

You have the following rights:

• Right to access your personal data

• Right to rectification of inaccurate data

• Right to erasure (where applicable)

• Right to restrict processing

• Right to object to processing

• Right to data portability

Exercising Your Rights & Queries

If you wish to exercise your rights or have any queries, you may contact us:

📧 support@edpropt.org
📧 info@edpropt.org

Contact Details

EdPro Associação
Rua Dom Afonso Henriques 2
2620-080 Póvoa de Santo Adrião
Odivelas, Lisboa
Portugal

Consent

By continuing with your enrolment and participation in our programmes, you acknowledge that you have read and understood this Data Protection Policy and give your explicit consent to the collection and processing of your personal data as described above.

Data Protection policy- 2026