GT-IoTEdu · Official document
Privacy Policy
This document describes how, and under what conditions, the personal data of users of the IoTEdu service are processed: what is collected, for what purposes, for how long, with whom it is shared, and what rights the data subject has.
1 Who we are
IoTEdu is a service for the management and security of Internet of Things devices on academic networks, developed within GT-IoTEdu, a Working Group supported by the Rede Nacional de Ensino e Pesquisa (RNP, Brazil's National Research and Education Network).
This Privacy Policy applies to the reference instance of the service, available at app-unipampa.iotedu.org, operated by Fundação Universidade Federal do Pampa (UNIPAMPA), a federal public-law foundation registered with the CNPJ/MF (Brazil's National Registry of Legal Entities) under No. 09.341.233/0001-22.
This document has been prepared in accordance with Lei nº 13.709/2018 (Lei Geral de Proteção de Dados, or LGPD), with Lei nº 12.965/2014 (Marco Civil da Internet) and with the rules for service providers set forth in the Policy of the Comunidade Acadêmica Federada (CAFE.N.001).
IoTEdu is software installed on the infrastructure of each adopting institution. When another institution begins operating its own instance, that institution becomes the controller of the data processed there and is responsible for its own privacy policy. This policy applies exclusively to the instance identified above.
2 How to contact us
For questions, requests, or the exercise of rights relating to this policy, please contact us through the channels below.
| IoTEdu service | iotedu@unipampa.edu.br |
|---|---|
| Service owner |
Diego Kreutz, GT-IoTEdu coordinator diegokreutz@unipampa.edu.br |
| UNIPAMPA Data Protection Officer (Encarregado, DPO) |
encarregado.lgpd@unipampa.edu.br The name of the designated staff member and the other contact channels are available at sites.unipampa.edu.br/lgpd/contato-encarregado |
3 Definitions
For the purposes of this policy, the following definitions apply.
| Personal data | Information relating to an identified or identifiable natural person, such as a name, an institutional email address, or an account identifier. |
|---|---|
| Processing | Any operation performed on personal data, including collection, use, access, storage, transmission, modification, and erasure. |
| Data subject, user, you | The natural person to whom the processed personal data relate. For the purposes of this policy, any person who accesses the service or who is listed as the person responsible for a registered device. |
| Controller | The natural or legal person responsible for decisions regarding the processing of personal data. |
| Data Protection Officer (Encarregado) | The person appointed by the controller to act as a communication channel between the controller, data subjects, and the ANPD. |
| ANPD | Autoridade Nacional de Proteção de Dados (Brazil's National Data Protection Authority), responsible for safeguarding, implementing, and enforcing compliance with the LGPD. |
| CAFe | Comunidade Acadêmica Federada (CAFe Federation), RNP's identity management service, which brings together teaching, research, and innovation institutions in Brazil. |
| Identity provider (IdP) | The institution responsible for maintaining the user's credentials and for authenticating the user. In practice, the user's home institution. |
| Service provider (SP) | A component that, based on assertions from an identity provider, controls access to a protected service. IoTEdu acts as a service provider in CAFe. |
| Device | Internet of Things equipment registered on the platform, such as a sensor, camera, controller, or laboratory equipment. |
| Device owner | The user who registers the device and to whom it is linked in the institution's inventory. |
| Unit | A campus, department, laboratory, or other institutional subdivision with which devices and administrators are associated. |
4 The IoTEdu service
IoTEdu allows members of the academic community to register, on a self-service basis, the Internet of Things devices they use on the institution's network, and allows the information technology team to maintain an inventory of this equipment, identify the person responsible for each device, monitor its network behavior, and respond to security events.
Authentication is performed using the user's institutional identity through CAFe. The service does not maintain its own passwords for federated users and does not perform authentication: authentication is performed by the user's home institution.
The platform is installed and runs on the institution's infrastructure, on a local server, and monitors a network segment dedicated to Internet of Things devices.
5 Personal data processing agents
The user's home institution, in its capacity as identity provider, maintains the user's credentials and registration data and decides which attributes it releases to the service. With respect to such data, it acts as controller.
UNIPAMPA, in its capacity as operator of the IoTEdu reference instance, makes decisions regarding the processing of data within the service. With respect to such data, it acts as controller.
There are no third-party processors. The service does not use a cloud provider, does not engage external processing services, and does not transfer personal data outside the institution's infrastructure.
6 Data processing carried out by the platform
6.1 Data received from the CAFe Federation
| Personal data processed | Source | Purpose of processing |
|---|---|---|
eduPersonPrincipalName |
Provided by the user's home institution upon authentication | Unique and persistent identification of the account in the service |
mail |
Provided by the user's home institution upon authentication | Account identification and notification of the device owner about events involving their devices |
givenName and sn |
Provided by the user's home institution upon authentication | Display of the device owner's name on inventory screens |
eduPersonAffiliation |
Provided by the user's home institution upon authentication | Assignment of the user's access profile in the service |
The service does not request or receive CPF (Brazilian taxpayer ID), student or employee ID number, identity document, date of birth, address, or telephone number. The service never has access to your password at any time.
6.2 Data on registered devices
| Personal data processed | Source | Purpose of processing |
|---|---|---|
| MAC address, IP address, device name (hostname), and description | Provided by the user upon registration, or obtained from the network itself | Compilation of the institution's device inventory |
| Link between the device and the responsible user, with date and time | Generated by the platform upon registration | Identification of the person responsible for each piece of equipment connected to the network |
| Device status (allowed, pending approval, blocked), reason for blocking, and author of the action | Generated by the platform and by administrators | Control of device access to the network and audit trail of the decisions made |
6.3 Data generated by security monitoring
| Personal data processed | Source | Purpose of processing |
|---|---|---|
| Source and destination IP addresses, ports, protocol, triggered rule signature, severity, date and time, and raw alert data | Generated automatically by the detection sensors (Suricata, Snort, and Zeek) from traffic on the monitored segment | Detection and logging of, and response to, security events on the network, and subsequent investigation of incidents |
| Records of blocks applied and reviews carried out | Generated by the platform and by administrators | Traceability of blocking and unblocking decisions |
Monitoring records describe the network behavior of devices, not the user's personal browsing. Monitoring covers the network segment dedicated to Internet of Things equipment, not the institution's network for personal use. Nevertheless, since each device is linked to a responsible person, these records may be associated with an individual and are therefore treated as personal data.
6.4 Application access data
| Personal data processed | Source | Purpose of processing |
|---|---|---|
| Account identifier, date and time of last access | Generated automatically upon access to the service | Retention of internet application access logs and investigation of incidents |
| Session cookies | Generated by the user's browser upon access to the service | Maintenance of the authenticated session while the user is using the platform |
The service does not use advertising, tracking, or behavioral analytics cookies, and does not employ third-party analytics tools.
7 Legal bases for processing
| Processing | Legal basis |
|---|---|
| User identification, assignment of access profiles, device inventory, and network security monitoring | Execution of public policies by the public administration (LGPD, art. 7º, III), since the management and protection of the institutional network are activities inherent to a federal university |
| Retention of application access logs | Compliance with a legal obligation (LGPD, art. 7º, II), pursuant to art. 15 of the Marco Civil da Internet |
Processing is limited to the minimum necessary for these purposes. The data are not used for commercial purposes, advertising, profiling of personal behavior, or evaluation of academic or professional performance.
Indicators produced for GT reports and for scientific publications are aggregated and anonymous, in the form of counts, averages, and response times. No data that identify individual persons or devices are published.
8 Sharing of personal data
The service does not sell, assign, or share personal data with third parties, companies, or other institutions.
Data may be shared when the service receives a request from a competent authority, to comply with a legal or regulatory requirement, and when a security incident must be reported to the CAFe Federation Operator, in which case sharing is limited to what is necessary to handle the incident.
Internally, access is segmented by profile: end users access only their own devices; unit administrators access the devices and events of their unit; the institutional superuser accesses the institution as a whole.
9 Automated decisions
The platform may automatically block a device's access to the network when the detection sensors identify a high-severity event. The decision is executed by the system without prior human intervention, and the device owner is notified. Lower-severity events do not trigger automatic blocking and are forwarded for triage by the unit administrator.
Pursuant to art. 20 of the LGPD, the data subject may request a review of this decision. The request may be submitted to the unit administrator through the platform itself or through the channels indicated in section 2.
10 Storage and retention periods
Data are stored on a local server, on the infrastructure of the institution operating the instance, within Brazilian territory. There is no storage in third-party clouds and no international data transfer.
| Data | Retention period |
|---|---|
| User account and attributes received from CAFe | For as long as the account exists |
| Device registration and link to the device owner | For as long as the device remains registered |
| Security events, incidents, and blocking records | 12 months, after which they are anonymized or erased |
| Application access logs | 6 months, in accordance with art. 15 of the Marco Civil da Internet |
Upon termination of the user's relationship with the institution, or upon a request for deletion, the personal data associated with the account are erased, except for records whose retention is required by law or necessary for the regular exercise of rights, which may be kept for the corresponding period.
11 Security measures
The following technical and organizational measures are adopted in the service:
- communication exclusively over HTTPS, with a valid certificate;
- federated authentication, with no storage of user passwords;
- dedicated network segmentation for monitored devices;
- profile-based access control, with separation between end user, unit administrator, and institutional superuser;
- audit logging of administrative actions;
- infrastructure maintained within the institution itself, subject to its security policies and network controls.
The reference instance operates in the context of a research pilot. This does not reduce the care taken with the data, but it is relevant information for assessing its use. No system can completely eliminate the possibility of a security breach. If you believe that your data are not being processed properly, or that they are exposed to unauthorized access, loss, destruction, or alteration, please contact us through the channels in section 2.
12 User rights
Data subjects are guaranteed the rights provided for in the LGPD. Requests to exercise these rights will only be fulfilled when submitted by the data subject or by a legally authorized representative.
| Confirmation and access | You may request confirmation of the existence of processing and access to your personal data processed by the service. |
|---|---|
| Rectification | You may request the rectification of incomplete, inaccurate, or outdated data. |
| Anonymization, blocking, or erasure | You may request the anonymization, blocking, or erasure of data that are excessive, unnecessary, or processed in breach of the LGPD. |
| Information on sharing | You may request a list of the entities with which the service has shared your personal data. |
| Review of automated decisions | You may request a review of the automatic device blocking described in section 9. |
| Objection | You may object to processing carried out in breach of the LGPD. |
Some of these rights may be exercised directly on the platform: your account data and your devices are visible on your dashboard, and you may correct the information about a device or remove it from your registration.
Where it is not possible or appropriate to take the requested measures immediately, a response will be sent stating the corresponding factual or legal reasons, as provided for in art. 18, § 4º, of the LGPD.
13 Revision history
This Privacy Policy may be edited, modified, or updated at any time in order to keep it current and consistent with applicable regulations and with privacy and data protection practices.
Changes may occur when there are changes to the data processed, the purposes, or the operations performed, as well as when required by the ANPD or another competent body. Changes affecting the processing of data received from the federation will also be communicated to CAFe.
This document was last updated on September 23, 2026, and takes effect immediately upon publication.