Privacy Policy

This policy is issued by the University of Papua New Guinea (“UPNG”, “the University”, “we”), a body established under the University of Papua New Guinea Act, with its principal campus at Waigani Drive, Port Moresby.

It applies to this website and to the forms, subscriptions and sign-in on it. It does not cover:

• the student information and results systems, which handle your academic record under the University's student records policy;
• the online payment service, which operates under its own payment privacy policy and its provider's terms — read that notice before you pay;
• learning management, library and email systems, which are governed by the University's ICT acceptable use policy;
• other websites we link to, including social media, partner institutions and government sites, each of which has its own policy.

Where information you give this website is passed into one of those systems — an enquiry that becomes an application, for example — the receiving system's policy applies to it from that point on.

You can read almost all of this site without telling us anything. We only hold personal information you actively send:

• Enquiry form. The contact form asks for your name, email address, the subject of your enquiry and your message; a phone number is optional. Submissions are stored in the website's database and emailed to the office that handles that subject.
• Newsletter. Subscribing stores your email address, the date you subscribed and whether the subscription is still active. Nothing else — we do not ask for a name.
• Staff sign-in. Signing in to the staff area uses your University Google account. We receive your name, your @upng.ac.pg email address and the account identifier from Google; we never see or store your password. Sign-in is restricted to @upng.ac.pg addresses, and an account outside that domain is refused.
• Anything you choose to write. If you put a student number, a date of birth, medical details or another person's details into a message field, we hold that too. Please send only what the office you are writing to actually needs.

Like any website, this one records technical information as pages are served. Our hosting and server logs may hold your IP address, the pages you requested, the date and time, the referring page, and your browser and device type. We use these to keep the site running, to diagnose faults and to detect abuse such as automated scraping or attacks.

We also count page views and search terms in aggregate to see which pages are working. Those counts are not tied back to an individual.

This site sets only the cookies it needs to work:

• a session cookie, which keeps you signed in while you are using the staff area and is discarded when your session ends;
• a security token cookie (CSRF), which proves that a form submission came from a page we served and not from another site.

We do not use advertising or cross-site tracking cookies, and we do not sell audience data. If analytics or any other non-essential cookie is introduced, this section will say so and a cookie notice will appear before it is set.

You can block or delete cookies in your browser settings. Blocking the two cookies above will not stop you reading the site, but forms and staff sign-in will not work.

We use what we hold to:

• answer your enquiry, and pass it to the School or division that can answer it;
• send the newsletter you subscribed to;
• give staff access to the staff area and keep that access to the University's own accounts;
• operate, secure, maintain and improve the website;
• produce statistics about how the site is used, in a form that does not identify anyone;
• meet the University's legal, audit and reporting obligations.

We do not use your information to make automated decisions about you, and an enquiry sent through this website is not an application: it does not create, advance or prejudice any admission, employment or examination outcome.

Section 49 of the Constitution of the Independent State of Papua New Guinea gives every person a right to privacy. The University also holds information subject to the University of Papua New Guinea Act, the National Information and Communications Technology Act 2009, the Cybercrime Code Act 2016 and the University's own statutes and policies.

Where we rely on your consent — newsletter subscription is the clearest case — you can withdraw it at any time, and withdrawing it does not affect anything done before you did. Where we hold information because we have to (student records, financial records, records of an enquiry that became a formal matter), we keep it for as long as the relevant law or policy requires.

We do not sell personal information, and we do not rent or trade mailing lists. We share it only:

• inside the University, with the staff and offices who need it to answer you or to administer your matter;
• with service providers who run parts of the service for us — website hosting, email delivery and Google sign-in for staff accounts — and only for that purpose;
• where the law requires it, or in response to a lawful request from a court, a regulator or a law enforcement agency;
• to protect people, where there is a serious and immediate risk to someone's life or safety;
• with your agreement, in any other case.

Some of these providers store data on servers outside Papua New Guinea. Where that happens we require them to protect the information to a standard consistent with this policy.

• Enquiry form submissions — kept for up to two years so the office can trace an earlier exchange, then deleted, unless the enquiry became part of a formal record (an application, a complaint, a contract), in which case that record's own retention rule applies.
• Newsletter subscriptions — kept until you unsubscribe. We keep a record that the address unsubscribed so that we do not add it again by mistake.
• Server and security logs — kept for a short operational period, ordinarily no more than twelve months, unless they are needed for an active security investigation.
• Staff sign-in records — kept while the account is active and for as long afterwards as the University's records policy requires.
• Aggregate statistics — kept indefinitely; they identify no one.

The site is served over an encrypted connection (HTTPS). Administrative access to the website and its content is limited to named accounts held by staff who need it, and forms carry anti-spam and anti-forgery protection.

No website or email system is completely secure, and we cannot guarantee the security of information while it travels to us. Please do not send bank details, passwords, health information or other sensitive material through the enquiry form or by ordinary email; contact the relevant office and ask how to send it safely.

If we become aware of a breach affecting personal information held through this website, we will act to contain it and will notify the people affected and the appropriate authorities where the seriousness of the breach warrants it.

School leavers applying to the University may be under 18. We ask for no more than we need to answer an enquiry, and we do not knowingly seek personal information from a child beyond that.

A parent or guardian who believes a young person has sent us information they should not have can write to us using the details below and ask us to delete it.

You may ask us to:

• tell you what personal information we hold about you from this website;
• correct it if it is wrong or out of date;
• delete it, where we are not required to keep it;
• stop sending you the newsletter — every issue carries an unsubscribe link, and you can also write to us.

Write to the address at the foot of this page. Please tell us enough to find the information — the email address you used and roughly when you contacted us is usually enough — and we may need to confirm your identity before we act, so that we do not hand your details to someone else. We aim to respond within 30 days.

If you are not satisfied with how we have handled a privacy concern, say so in writing to the University Secretary, who will have it reviewed.

We update this policy when the way the website handles information changes. The date it took effect is shown at the top of the page, and the current version always sits at upng.ac.pg/privacy/. Material changes will be announced on the website.