Privacy notice

This notice explains how UDMS processes personal data in line with the Personal Data Protection Act 2010 (PDPA). Draft for review by the institution's data protection officer.

What we collect

Account data (name, work email, role, faculty/department), documents and metadata you upload, and security records: sign-in times, IP address, approximate location derived from the IP address, device type, operating system and browser.

On the public landing page we record visits using a random visitor identifier stored in your browser, the referring page, time on page and which buttons were clicked. We do not use advertising or third-party tracking cookies.

Why we process it

To provide the document management service, enforce access control, protect accounts against misuse, meet audit and records-retention obligations, and respond to enquiries.

Who can see it

Security logs are visible only to the system owner (Super Admin); a filtered audit trail is available to authorised auditors and administrators. Data is not sold or shared with third parties for marketing.

Where it is stored

In the institution's PostgreSQL database and secure object storage. Location data is approximate (IP Geolocation by DB-IP, db-ip.com).

Retention

Security logs are kept for 365 days by default. Documents follow the institution's retention schedules.

Your rights

You may request access to or correction of your personal data. Contact: new.technology@hotmail.com.