Respecting your privacy is part of UNEX’s mission and values, and this notice confirms our commitment to security and transparency in the processing of personal data, as provided for in the applicable personal data protection laws.
In this statement you will find, in a simple and clear way, how we handle your personal data and your main rights. And, should any questions or doubts remain after reading this notice regarding what we have presented here, please feel free to contact us through the service channels listed at the end of this document.
By accessing our website and its features, you agree to the practices and policies described in this document. If you do not agree with our terms of use and privacy notice, we ask that you do not continue this access.
- Anonymization: a data processing technique that removes or modifies information that would allow a person to be associated, directly or indirectly, with a piece of information.
- Processing agents: controller and operator.
- Controller: a natural or legal person, governed by public or private law, responsible for decisions regarding the processing of personal data.
- Operator: a natural or legal person, governed by public or private law, that processes personal data on behalf of the controller.
- Personal data: information related to an identified or identifiable natural person.
- Sensitive personal data: personal data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, or genetic or biometric data, when linked to a natural person.
- Data Protection Officer (Encarregado): the person appointed by the controller to act as the communication channel between the controller, the data subjects, the National Data Protection Authority (ANPD) and other supervisory bodies.
- Data subject: the natural person to whom the personal data that is the subject of processing refers.
- Processing of personal data: any operation carried out with personal data, such as those referring to collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction.
- Leads: a person who has provided their contact information (name, e-mail, phone number, etc.) so that UNEX may present its products/services.
- User: people who use our digital platforms, portals and websites.
- Landing pages: in the context of this notice, a web page designed by UNEX with the main purpose of allowing people to sign up for our events, actions or services and to receive communications about our products or services.
This Notice is directed at visitors/users of UNEX’s websites, portals and digital platforms, including leads and candidates for the Institution’s admission selection processes who registered through these means. It is also directed at leads and candidates who registered through our landing pages or physical forms at our in-person actions and events, as well as partners who take part in our promotional campaigns. In this document we will refer to them as “You”.
This Notice does not apply to employees, students, patients of our teaching clinics and those assisted by the Legal Practice Center and their legal guardians, visitors to our physical units, and candidates for selection processes to work or intern at our Institution, since specific notices are made available to these people on our portals. However, this notice will apply to these audiences when they access UNEX’s websites, portals and platforms as a visitor/user. In addition, this notice does not apply to legal entities, given that the LGPD does not apply to that relationship.
We are the Rede UniFTC. Rede UniFTC is made up of IMES – Instituto Mantenedor de Ensino Superior da Bahia, which maintains the units: UniFTC de Salvador, UNEX de Vitória da Conquista, UNEX de Jequié, UNEX de Feira de Santana and UNEX de Itabuna, and by OTE – Organização Tecnológica de Ensino, which maintains the units: UniFTC de Petrolina and Juazeiro. IMES and OTE are the data controllers for their respective units.
With respect to the processing of personal data, we act predominantly as
Controller, since we make the main decisions and define the purpose of the data processing under our custody.
Depending on the type of relationship and how you use our websites, platforms and portals, UNEX may process certain personal data to fulfill specific purposes. This processing is restricted to the minimum necessary, taking into account the nature of each relationship, and is important for us to provide our services, offer our products, comply with legal and regulatory obligations, manage the Institution and maintain communication with you.
Below, we list the situations in which we may process your personal data:
- For you to browse our website, we may identify and process your IP address (with date and time), your device characteristics and cookies. We inform you that this data is processed in compliance with the provisions of Law No. 12,965/2014 (“Marco Civil da Internet”), aiming to identify users on the digital network and help maintain internet security. In addition, we use this data to assess the usability of our website. This allows us to better understand how our visitors interact with the content and what our site’s visit rate looks like. These insights are valuable for improving our platform, enhancing content and providing a more personalized experience to our users.
You can access our cookie policy at this link:
unex.edu.br/politica-de-cookies
- For you to apply to our undergraduate admission processes, we may collect and process your full name, individual taxpayer registration number (CPF), e-mail and phone number (including WhatsApp), academic data, registration data and status, courses applied for, Institution of interest, among other data required for each type of admission process. Collecting this personal data is necessary to verify the identity of the applicant, as well as to contact them to explain how the assessment will be applied, such as sending notices about confirming data, the schedule, the exam location and instructions for taking part in the admission process. We may also collect health data, such as data related to special needs, so that we can make the accommodations permitted in the exams, in accordance with current legislation. Where there is a need to pay registration fees to take part in an admission process, we will also process financial data. In addition, we will process data related to the exam itself, such as the data contained in the tests, academic documents and results, to assess the candidate’s approval. In some types of admission processes, candidates’ personal data may also be checked against public regulatory bodies, following the Ministry of Education’s own instructions. Finally, this data may be used, in the event of approval, to contact you regarding the enrollment process and to complete it as a future student. The details and specific documentation for each admission process can be found in the corresponding notice (edital).
- For you to register for our events: When you register for one of our events, such as lectures, seminars and others, we collect and process your personal data, such as name, e-mail, phone number, course of interest, CPF and institution of interest, in order to complete your registration, guarantee your participation and send you information about the event you registered for.
- For you to contact us through our service center, we may collect and process your full name, phone number (including WhatsApp), e-mail, and occasionally academic and financial data, among others. This information is important to identify you, clearly understand your request and provide proper assistance in resolving your issue. In addition, our team may also promote our services and provide clarification on questions raised by our users through our service center.
- For you to receive communications about our educational services: We may collect and process your personal data such as your full name, education level, city, e-mail, phone number (including WhatsApp), among others, which are necessary to send marketing communications about our educational services and keep you updated on our offers. Communications may be sent by e-mail, WhatsApp, SMS (text messages) or phone calls. We collect this data when you register for admission processes, events, or use features on our website. However, we only use this information for marketing purposes when we have obtained your consent. You therefore have the right to grant or revoke this authorization at any time, controlling the sending of relevant content related to UNEX’s educational services.
It is important to note that, in some situations, consent for sending advertising may not be required. However, even in these situations, you may request that this type of communication be cancelled, since all of our marketing communications include an opt-out option. We reinforce that we adopt the best data protection and information security practices for this type of processing, upholding the principles of transparency, specifically non-discrimination, among others set out in art. 6 of the LGPD.
For access to restricted areas of the websites:
Once enrolled in a course, our website may also be used to access the student portal. To access the portal, the user’s login and password will be collected, which are personal, non-transferable information. This data is necessary to identify the student and guarantee fraud prevention. Within the portal, the student will have access to a wide range of academic and institutional modules needed to carry out educational activities. Throughout this journey, other personal data is collected and processed, and the student can learn more in the student privacy notice, available at:
Student Privacy Notice
We may collect and process your personal data such as: your full name, CPF, e-mail, phone number (including WhatsApp), among others, which are necessary when you apply to admission processes.
We may collect and process your personal data such as: your full name, CPF, address, ID card (RG), e-mail, phone number, unit, course, shift, information on campaign discounts, academic transcript, father’s and mother’s name, among others. From the legal guardian, we may process: full name, CPF, address, RG, e-mail, phone number, relationship to the candidate, among others. From the financial guardian, we may process: full name, CPF, address, RG, e-mail, phone number, among others. In all cases, we will only process the data necessary to complete your enrollment.
- Ombudsman’s Office and Reporting Channels:
To help us through the Ombudsman’s Office and Reporting Channels, we may occasionally process identification, academic, professional, social and sensitive data, depending on the type of request being made. Collecting this type of data is necessary to provide grounds for us to carry out internal investigations or audits. We reinforce that UNEX handles the personal data received through these channels responsibly and securely, with the aim of defending human rights and promoting citizenship.
- Channel for the rights of personal data subjects:
For you to exercise your data protection rights, we may collect your full name, individual taxpayer registration number (CPF), date of birth, e-mail, phone number, complete address and, occasionally, personal data contained in your request. This information is used to confirm your identity and for you to exercise your rights in accordance with the provisions of Law No. 13,709/2018, also known as the LGPD.
To achieve the purposes mentioned in item 4, we share your data internally and with partners. As such, we may share your data with:
- Service providers and other partners: we hire third parties or establish agreements with certain partners to help us carry out activities inherent to the business. This includes technology companies that provide us with systems for storing documents (physical and digital); recording and controlling institutional, academic and administrative activities; companies for preparing and administering admission process exams, and sending communications by message, e-mail or phone call; support systems for handling requests; banks for financial activities and companies that provide payment processing methods; reporting and complaint systems; communications companies to assist us with the Institution’s marketing strategies, among others.
- External consultants (such as lawyers and accountants for legal and accounting services) and audit firms.
- Judicial, administrative and government bodies, in compliance with legislation or legal determination, such as the Brazilian Federal Revenue Service, the Ministry of Education, the Ministry of the Economy, professional class councils, health surveillance agencies, among others.
- With companies in the same economic group: We may share personal data with other companies in the same group, since data processing is carried out centrally with shared teams and systems.
- We may also share your personal data with a third-party company in the event of a sale or merger of companies. In other words, should another organization purchase our company or part of it, it may be necessary to share your data to ensure business continuity.
But don’t worry! Whenever we share this data, especially with private parties, we require the same level of protection that we offer you, observing legal limits and with solid policies of awareness, secrecy, confidentiality and data protection. We emphasize that third parties will only have access to the information necessary for each purpose.
We protect the personal data we process against unauthorized access, unlawful disclosure and unpermitted processing.
Personal data is kept secure through appropriate organizational and technical measures. Information can only be accessed and used by authorized, duly accredited people. We keep records of who has accessed, updated and deleted information.
As such, following industry best practices, and to guarantee the right to privacy of personal data subjects, we adopt the following protections:
- Portals and websites: HTTPS with SSL certificates generated by a certifying authority.
- VPN security: Encryption: AES-256 and AES 128; certificate chain: CA, Certificate, Private Key; user authentication on Active Directory.
- Active Directory: Authentication protocol: KERBEROS V5; Encryption: DES_CBC_CRC, DES_CBC_MD5, RC4_HMAC_MD5, AES128_HMAC_SHA1, AES256_HMAC_SHA1.
- Cloud environment: SSL (HTTPS) encryption; ISO 27001 SOC 2 and SOC 3 protocols; Tier IV Datacenter classification; active monitoring of suspicious activity;
- Access for employees via VPN;
- Access to the administration console with two-factor authentication;
- Access to virtual machine consoles with digital certificates generated by the administration console;
- File storage: ISO 27001 SOC 2 and SOC 3 protocols and TIER 3 Datacenters.
- Data links: VPN for data transport between units, HTTPS for the Web scenario.
In addition, we have information technology security mechanisms in place designed to prevent unauthorized access. We use Firewall, Antivirus and Endpoint systems.
- Firewalls: systems that control network traffic, preventing unauthorized access between computers on internal and external networks.
- Antivirus: computer protection systems that detect, eliminate and prevent the access and spread of malicious programming code, better known as “viruses”.
- Endpoints: systems installed on servers, workstations, laptops and other devices which, by applying rules and policies, monitor environments and seek to identify and correct vulnerabilities even before an attack or unauthorized access takes place.
Lastly, we suggest that you keep your antivirus up to date and never share your username and password with third parties.
We, or our business partners (when authorized), may transfer personal data to other countries, such as when we contract cloud storage services located abroad. In these cases, we observe the requirements established by current legislation and require the contracted partners to guarantee the protection of the data and the security of the transferred information.
As a personal data subject, you have rights established under the LGPD and other legislation. These rights may only be exercised by you or by a legal representative. In addition, we use identity verification mechanisms to guarantee the security of your data. As determined by the LGPD, the personal data subject may:
- Confirm the existence of processing of their personal data;
- Access their personal data;
- Correct personal data that is outdated, incomplete or inaccurate;
- Anonymize, block or eliminate unnecessary or excessive data, or data processed unlawfully;
- Eliminate personal data;
- Request a review of decisions made solely on the basis of automated processing of personal data;
- Carry out the portability of personal data;
- Obtain information on the sharing of personal data;
- Revoke consent given.
These rights may be exercised through the contacts listed in the “Our Channels” section.
We will respond to these obligations in accordance with the specific rules that regulate our activities and within the legal deadline set out in the LGPD. We further inform you that, depending on the situation, we may deny and/or partially fulfill obligations that are not applicable or that conflict with some specific law or rule governing our activities.
For as long as you have a relationship with UNEX, we will process your personal data and, if necessary, that of your legal guardian, in order to fulfill all the rights and obligations already outlined here, in addition to being able to offer and maintain our platforms and services.
Once your relationship with UNEX has ended, we will continue to process the personal data necessary to comply with rules that require or permit the retention of certain documents and data. In addition, we may store your personal data if requested by the authorities, or even to mount a defense in administrative or judicial proceedings.
As such, your personal data will only be retained for as long as necessary to achieve its specific purposes, subject to the deadline for complying with legal and regulatory obligations.
Please be aware, however, that your data will remain well protected. Regardless of whether our relationship has just begun or has already ended, your data will be processed and kept in secure, controlled environments, and only if we have a legal basis for doing so.
Once the necessary data retention period has passed, we will securely delete the data or, when necessary, carry out its anonymization.
You can contact us at: Data Subject Request
You can also contact us directly by e-mail at
[email protected].
Our addresses:
- Salvador:Avenida Luís Viana Filho, 8.812, Paralela. Salvador/Bahia. Zip Code: 41741-590 – Bahia
- Feira de Santana:Rua Artêmia Pires Freitas, SIM. Zip Code: 44085-370 – Bahia
- Itabuna:Praça José Bastos, 55 – Osvaldo Cruz. Zip Code: 45600-080 – Bahia
- Vitória da Conquista:Rua Ubaldino Figueira, 200, Exposição. Zip Code: 45020-510 – Bahia
- Jequié: Av. Adolfo Ribeiro, São Judas Tadeu. Zip Code: 45204-068 – Bahia
- Petrolina:Av. Clementino Coelho, 714, Atrás da Banca. Zip Code 56308-210 – Pernambuco
- Juazeiro: Rua Canadá, 309 Santa Maria Gorete. Zip Code 48904-285 – Bahia
The Data Protection Officer can be contacted by filling out the form: Data Subject Request or directly by e-mail at [email protected].
If you become aware of a security incident involving personal data, you can report the incident by filling out the form:
Report Incident or directly by e-mail at
[email protected].
This Privacy Notice is subject to change at any time, if necessary. We therefore suggest that you check it regularly.
If you have any questions after reading this Privacy Notice or, for any reason, need to contact us about matters related to your personal data, you may do so through the Data Protection Officer’s e-mail.
23/01/2025, 15:48:40 | V12.0
