University Data Protection

This page supplements the Privacy Policy for processing related to applications, registration, academic journeys, academic documents, exchanges with the administration and restricted UIL-BJ services.

It applies only to data actually collected by the University and does not grant access to a record that is not connected to the person concerned.

Article 74 of Gabonese Law No. 025/2023 requires express authorization from the holder of parental responsibility to process a child’s data below age 18, and requires the controller to verify that authorization by any means. The university form reviewed has no separate authorization or verification step for applicants under 18. The Institution must define this process before processing their online applications.

Data is collected and used to:

• review an application and verify the required documents;
• manage registration, a study journey, an appointment or an academic document;
• organize support, communication and campus security;
• comply with applicable administrative, regulatory or cooperation obligations;
• respond to rights requests and handle security incidents.

Access rules should limit each record to services and people authorized for their duties. The repository does not establish that this principle has been audited across every university space, role and type of record.

An identifier sent in a URL or form is never sufficient to authorize access to a record. Access controls must be performed server-side and, when the service relies on a database, through the corresponding security policies.

Identity documents, transcripts, supporting records and academic documents are handled with an appropriate level of confidentiality. Medical, financial or private-life data must be submitted only when its collection is explicitly justified, secured and authorized.

Documents must not be published in news items, galleries, public download areas or assistant tools.

No approved retention schedule by university-record category was found in the repository. The Institution must define retention, archiving, deletion and access after studies end. A breach or suspected access should be reported to the administration for assessment.

Requests to access, correct, update or erase data may be sent to the official contact that the Institution must confirm. Identity or representative status may need to be checked before information is disclosed.

The principles on this page must be supplemented by the internal procedures, records and formalities applicable to each university processing activity.