Data protection policy

The Blanquerna Foundation, in the development of its activities, processes personal data in compliance with the General Data Protection Regulation (EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016) and Organic Law 3 / 2018, of 5 December, on the protection of personal data and the guarantee of digital rights.

Who is responsible for the processing of personal data?

The person responsible for processing the data is the Blanquerna Foundation, domiciled at Passeig de Sant Gervasi, 47 in Barcelona (CP 08022), CIF R5800622B, tel. 932 53 30 00, [email protected], registered in the Register of Religious Entities with registration number 000286 (103 / SE / F).
The Blanquerna Foundation is an integral higher education center of the Ramon Llull University Foundation.

What role does the data protection officer play?

The Data Protection Officer (DPD) is the person who oversees compliance with our data protection policy and ensures that people are treated appropriately and that their rights are protected. Its functions include answering any questions, suggestions, complaints or grievances from the data subject. You can contact the Data Protection Officer by writing to our postal address and telephone number or directly to the email address [email protected].

For what purposes do we process the data?

We process personal data at all times with human rights in mind and always in a proportionate manner. This means that in each case we process the appropriate data, relevant and limited to the fulfillment of the explicit purposes that motivated the obtaining. In some cases we ask for more information, such as to find out opinions or ratings of our services. In this case, the answers are treated statistically and dissociated from the identifying data of the respondent.
The Blanquerna Foundation processes personal data mainly to provide academic services, to report on activities and services and to develop business relationships with suppliers.

• Academic management. The Blanquerna Foundation records the data of the people who pre-register and then formalize the registration in order to record it and, accordingly, to provide higher education educational services. The data provided and those resulting from the academic activity allow for monitoring and serve as a basis for evaluation. The management of the student's academic record is the most relevant data processing. Student data is also used for administrative management purposes to identify them as users of the University's services, make it possible to access these services, send information of interest to them, process and issue degrees and, finally, monitor job placement.
• Staff selection. We collect and keep resumes sent to us by people interested in working with us and we also process personal data in the development of staff selection processes in order to analyze the adequacy of the profile of candidates depending on vacancies or newly created . Our criterion is to keep the data of people who do not end up being hired for a maximum period of one year, in case there is a new vacancy or a new job in the short term. However, in the latter case, we immediately delete the data if the person concerned requests it.
• Information on activities and services. With the explicit permission of each student, once the studies are completed we use their contact details to send information about our services and our activities.
• Supplier data management. We record and process the data of the suppliers from whom we obtain services or goods. They can be the data of people who act as self-employed and also data of representatives of legal persons. We obtain the data necessary to maintain the business relationship, use it only for this purpose and make proper use of this type of relationship.
• Video surveillance. Access to our facilities is reported, where applicable, for the existence of video surveillance cameras by means of approved signs. The cameras record images only of the points where it is justified to ensure the safety of property and people and the images are used only for this purpose.
• Economic aid service. We collect and keep the necessary data from students applying for financial aid in order to manage and process these grants. The data will be kept for 4 years to prove the correct performance of the evaluation process and the award or refusal of the corresponding grant.
• Web users. The navigation system and software that enable the operation of our website collect the data that is ordinarily generated in the use of Internet protocols. This data category includes, but is not limited to, the IP address or domain name of the computer used by the person connecting to the website. This information is not associated with specific users and is used for the sole purpose of obtaining statistical information on the use of the website. Our website does not use cookies ("cookies") that allow the identification of specific individuals, users of the site. The use of cookies is reserved to collect technical information to facilitate accessibility and efficient use of the site. Our website uses cookies that facilitate navigation and provide us with information about our users and their interests. Depending on your browser, you can then access the instructions for deleting cookies.

- For Firefox.
- For Chrome.
- For Explorer.
- For Safari.
- For Safari (IOS).
- For Opera.

How do we get the data?

• Data collection channels. We obtain data through face-to-face relationships and other channels such as receiving emails and phone calls. In all cases, the data is intended only for the explicit purposes that justify its collection and processing.
• In most cases, the data comes directly from the interested parties and we obtain them mainly through the forms prepared for this purpose. We obtain an important source of information in the open days, in the informative sessions that we do in educational centers and by means of the participation in fairs where we present our offer.
• In the development of the relationship with students, teachers and service providers, other data are generated that are incorporated into the systems of the Blanquerna Foundation.
• A more limited amount of data may come from competent public administrations in the field of higher education or from other academic institutions.

What is the legal legitimacy for the processing of data?

The data processing we carry out has various legal bases, depending on the nature of each processing. We classify the main data processing that we carry out following the legal bases of article 6.1 of the General Data Protection Regulation.

• For the provision of educational services. Once admitted, our students obtain educational services from the Blanquerna Foundation. The provision of services to the student constitutes a contractual relationship, with obligations of each party, the right of the student to receive good training and the right and obligation of the Blanquerna Foundation to process their data. This treatment has its legal basis in Organic Law 6/2001, of 23 December, on Universities, in Law 1/2003, of 19 February, on Universities in Catalonia and in its development regulations.
• In compliance with a pre-contractual relationship. This is the case of the data of people interested in the teaching offer of the Blanquerna Foundation. For other reasons, but with a similar legitimacy, we process the data of potential customers or suppliers with whom we have relationships prior to the formalization of a contractual relationship. This is also the case for the processing of data from people who have sent us their CVs or who are involved in selection processes.
• In compliance with a contractual relationship. Case of the relations with our customers and suppliers and all the actions and uses of the data that these commercial relations entail.
• In compliance with legal obligations. The provision of the higher education service determines that we have to comply with various rules that involve data processing. In this sense, the Fundació Blanquerna communicates data of its students to the Universitat Ramon Llull Fundació for the procedures of recognition and issuance of the degrees corresponding to the studies taught. It is also in compliance with legal obligations (tax regulations) that we communicate data to the Tax Administration. It would also be in compliance with legal obligations that we will communicate data to judicial bodies or to security bodies and forces, if required.
• Based on consent. When we send information about our activities or services we use contact details with the explicit consent of the person who will receive it. It is also based on the consent that we obtain browsing data from the person visiting our website, which consent can be revoked at any time by uninstalling cookies.
• For legitimate interest. The images we obtain with video surveillance cameras are treated for the legitimate interest of our institution to preserve its assets and facilities. Our legitimate interest also justifies the processing of the data we obtain from the contact forms.

To whom is the data communicated?

• As a general rule, we only report data in compliance with legal obligations. In the previous sections we have explained the communications of data of our students, necessary to make possible the provision of the educational services, and of our clients and suppliers, in the development of the economic and commercial relations. The contact details of the students can be communicated to other institutions of our group as long as the student has authorized it.
• Data transfers are made outside the scope of the European Union (international transfer) for the management of international student mobility and to respond to job offers from non-European companies. In both cases, the treatment is based on the student's consent.
• In another sense, for certain tasks, we obtain the services of companies or people who provide us with their experience and specialization, which sometimes have to access personal data. Under the terms of the General Data Protection Regulation, this is a processing order. At the time of hiring, your confidentiality obligations are formalized and your performance is monitored. This may be the case for server data hosting services, computer support services, or legal, accounting, or tax advice.

How long do we keep the data?

• Data retention time is determined by several factors. Its conservation is mainly due to the fact that the data are still necessary to meet the purposes for which they were collected in each case. Secondly, they are retained to deal with possible responsibilities for the processing of data by the Blanquerna Foundation and to meet any requirements of public administrations or judicial bodies. Accordingly, the data must be kept for the time necessary to preserve its legal or informative value and to prove compliance with legal obligations, but not for a period longer than is necessary for the purposes of the processing (“limitation of the retention period ”requirement of the General Data Protection Regulation).
• In the case of information accrediting the training received by students, the data are kept permanently to preserve the rights of these students.
• In certain cases, such as the data contained in the accounting documentation and in the invoicing, the tax regulations require that they be kept until they prescribe the responsibilities in this matter. The regulations governing foundations specify that some accounting data will be kept for ten years (compliance with Law 10/2010, of 28 April).
• In the case of data that is processed exclusively on the basis of the consent of the person concerned, it is kept until that person revokes that consent.
• Finally, in the case of images obtained by video surveillance cameras, they are kept for a maximum of one month, although in the case of incidents that justify this, the time necessary to facilitate the actions of the security forces is retained. or of the judicial organs.

The regulations governing the conservation of public documentation and the opinions of the qualifying commissions are a decisive reference when deciding on the conservation or disposal of data related to the exercise of services of public interest.

What rights do people have in relation to the data we process?

As provided for in the General Data Protection Regulation, the persons whose data we process have the following rights:

• Whether they are treated. Everyone has, in the first place, the right to know whether we process their data, regardless of whether there has been a previous relationship.
• To be informed in the collection. When personal data is obtained from the same data subject, at the time of providing it must have clear information of the purposes for which it will be used, who will be responsible for the processing and the main aspects arising from such processing.
• To access it. Very broad right, including the right to know exactly what personal data are being processed, what is the purpose for which they are processed, communications to other persons that will be made (if applicable) or the right to obtain a copy or namely the expected shelf life.
• To request rectification. It is our right to have inaccurate data rectified by us processed.
• To request its deletion. In certain circumstances, there is the right to request the deletion of the data when, among other reasons, they are no longer necessary for the purposes for which they were collected and which justified their processing.
• To request the limitation of the treatment. Also in certain circumstances, the right to request the limitation of data processing is recognized. In this case, they will no longer be processed and will only be kept for the exercise or defense of claims, in accordance with the General Data Protection Regulations.
• In portability. It is the right to receive personal data in a structured, commonly used, machine-readable and interoperable format, or to request that it be transferred in this way to another controller. This right is recognized when the data subject has provided the personal data and has given his consent or when the processing is necessary to execute a contract. It is not recognized when the treatment has a legal basis other than consent or contract.
• To oppose treatment. A person may adduce reasons relating to his or her particular situation, which may lead to the data being discontinued to the extent or to the extent that it may cause him or her harm, except for legitimate reasons or the exercise or defense against claims. .
• Not to receive information. We immediately respond to requests not to continue receiving information about our activities and services when these submissions were based solely on the consent of the recipient.

How can rights be exercised or defended?

The rights listed can be exercised by sending a request to the Blanquerna Foundation to the postal address or other contact details indicated in the heading.

If a satisfactory response has not been obtained in the exercise of the rights, it is possible to submit a complaint to the Catalan Data Protection Authority through the forms or other channels accessible from its website www.apd.cat.

In all cases, whether to file a complaint, request clarification or send a suggestion, it is possible to contact the Data Protection Officer by e-mail at [email protected].