Privacy Policy
CMU Portugal Academy Last updated: June 2, 2026
This Privacy Policy explains how CMU Portugal Academy collects, uses, and protects your personal data. It applies to the website academy.cmuportugal.org and any service or communication delivered under the CMU Portugal Academy brand.
1. Who we are
The data controller responsible for your personal data is:
ADIST — Associação para o Desenvolvimento do Instituto Superior Técnico
Av. Professor Gama Pinto, 2, 1649-003 Lisboa, Portugal
Tax ID (NIPC): 501 804 625
Operating: CMU Portugal Academy
You can contact us at info@academy.cmuportugal.org. Our Data Protection Officer (DPO) can be reached at dpo@ist-id.pt.
2. What personal data we collect
We collect the minimum data needed for the purpose you contact us for.
When you request a program brochure through our website: - Email address - Country/region - Your consent state (whether you accepted marketing communications) - Time and source of your form submission - Program of interest (derived from which form you used)
When you browse the website: - Standard log data (IP address, browser type, pages viewed, referring URL) - Cookie identifiers (see our Cookie Policy)
When you communicate with us by email or other means: - The content of your communication and any information you choose to share
We do not collect special categories of data (health, religion, political views, etc.) and we do not knowingly collect data from people under 16.
3. Why we process your data, and on what legal basis
| Purpose | Data used | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Send you the program brochure you requested | Email, program of interest | (b) Performance of a contract at your request |
| Send you marketing communications about programs, events, and updates | Email, country/region, consent state | (a) Your consent (you can withdraw at any time) |
| Operate, secure, and improve the website | Log data, cookies | (f) Our legitimate interest in providing a functioning, safe website |
| Comply with legal obligations (tax, accounting, defending legal claims) | Records of communications and transactions | (c) Legal obligation |
4. Who we share your data with
We share your data only with the following categories of recipients, each under appropriate contractual safeguards:
- HubSpot Inc. (acting as our data processor) — for email delivery, CRM, and marketing automation. HubSpot stores EU customer data on servers located in the European Union.
- Santander Open Academy — if you click through to apply to a program, you are redirected to Santander Open Academy’s platform. From that point, Santander is a separate data controller for the data you submit there. Review Santander’s privacy notice before applying.
- Carnegie Mellon University Portugal program partners — limited program-relevant information may be shared with our academic partners (Instituto Superior Técnico, NOVA, Ciências ULisboa, FCT, Belas-Artes) when relevant to your enrolment or participation.
- Tax, accounting, and legal advisors — where strictly required.
- Public authorities — where we are legally compelled.
We do not sell your personal data to third parties.
5. International transfers
Where data is transferred outside the European Economic Area (EEA), we rely on the European Commission’s Standard Contractual Clauses (SCCs) or equivalent safeguards.
HubSpot Inc. is a US company; data transferred to HubSpot is protected under the EU-U.S. Data Privacy Framework or SCCs.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Brochure-request data (email + consent) | 3 years from last interaction with our communications, then deleted or anonymized |
| Marketing list membership | Until you unsubscribe |
| Tax/accounting records | 10 years as required by Portuguese law |
| Website logs and cookies | See Cookie Policy |
7. Your rights
Under the EU General Data Protection Regulation (GDPR) and Portuguese Law No. 58/2019, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data (“right to be forgotten”) where applicable
- Restrict processing in certain situations
- Data portability — receive a copy in a structured, commonly used format
- Object to processing based on legitimate interest
- Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal)
- Lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD): https://www.cnpd.pt
To exercise any of these rights, see our Privacy Center or email info@academy.cmuportugal.org.
We will respond within 30 days, extendable to 90 days in complex cases.
8. Security
We implement appropriate technical and organizational measures to protect your data, including encryption in transit, access controls, vendor due diligence, and regular review of our processing activities. No transmission over the Internet is 100% secure; if a breach affecting your data occurs, we will notify you and the CNPD as required by law.
9. Changes to this Policy
We may update this Policy from time to time. We will publish the updated version on this page and update the “Last updated” date. Material changes will be communicated by email to subscribers.
10. Contact
Questions, requests, or complaints: info@academy.cmuportugal.org or write to: Av. Professor Gama Pinto, 2, 1649-003 Lisboa, Portugal