Data protection policy

Fundació Blanquerna, in carrying out its activities, processes personal data in compliance with the General Data Protection Regulation (EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016) and with Spanish Organic Law 3/2018 of December 5 on Protection of Personal Data and Guarantee of Digital Rights.

Who is responsible for the processing of personal data?

The data controller is Fundació Blanquerna, whose legal address is Passeig Sant Gervasi, 47, Barcelona (postal code 08122), phone number 932 53 30 00, [email protected], registered in the Register of Religious Entities under registration number 000286 (103/SE/F).

Fundació Blanquerna is a center of higher learning and a part of Universitat Ramon Llull.

What role does the data protection officer play?

The data protection officer (DPO) supervises compliance with our data protection policy and ensures that data are handled properly and that individuals’ rights are protected. One of the functions of the data protection officer is to respond to all inquiries, suggestions, and complaints from individuals whose data are being handled. You can contact the data protection officer in writing via our mailing address, by telephone or via the email address [email protected].

For what purposes do we process the data?

When we process personal data, we have the rights of individuals in mind at all times, and we always apply the principle of proportionality. This means that at all times we process only the data that is sufficient, relevant and limited to the fulfillment of the explicit purposes for which it was collected. In some cases, we may ask for additional data, for example in order to collect users’ opinions or assessments of our services. In such cases, the answers are treated statistically and cannot be connected to the identification data of the person who provides them.

The main purposes for which Fundació Blanquerna handles data are to provide academic services, to provide information about activities and services, and to carry out commercial relations with suppliers.

• Academic management. Fundació Blanquerna stores the data of the people who pre- enroll and subsequently formalize their enrollment for record-keeping purposes and in order to offer higher education services. The data provided by users and those that are created in the context of academic activity allow for monitoring and serve as a basis for assessment. The management of students’ academic records is the most relevant data processing activity. Students' data are also used for administrative and management purposes, including to identify them as users of the University's services, to enable them to access to these services, to send information of interest to them, to process and issue diplomas and, lastly, to monitor their employment placement.
• Human resource selection. We collect and save the CVs of people interested in working with us, and we handle personal data in the context of human resource selection processes in order to analyze the suitability of candidate profiles for job vacancies or new positions. We store the personal data of applicants who are not selected for a maximum period of one year in order to have this information on hand should a new vacancy or job position become available in the short term. However, we immediately delete this data upon request of the person concerned.
• Information about activities and services. Having received the explicit authorization of each student, once their studies are completed, we use their contact information to send them information about our services and activities.
• Management of data on suppliers. We record and handle data on the suppliers from whom we obtain goods or services. This can include data on self-employed individuals and also data on the representatives of legally constituted entities. We gather only the data necessary to maintain our business relationship, and we use these data only for this purpose and in a manner suitable to this kind of relationship.
• Video surveillance. Where appropriate, notice is posted in the form of approved signs at the points of entry to our facilities as to the existence of video surveillance cameras. The cameras record images only of areas where they are needed to ensure the security of individuals and property, and the images are not used for any other purpose.
• Financial aid services. We collect and store the necessary data of students who apply for financial aid in order to make it possible to manage and process these grants. The data is stored for four years as evidence of the proper completion of the assessment process and the granting or denial of the corresponding aid.
• Images. The images and/or videos that may be recorded at activities or events and that may appear on the website or social networks operated by Fundació Blanquerna will be treated in accordance with current legislation on data protection and Organic Law 1/1982 on the Protection of the Right to honor, personal and family privacy and self-image. Any recorded images will be used for the purposes of which individuals will have been previously informed, either to disseminate information about academic or other activities, events or services of any other kind offered by Fundació Blanquerna, or for marketing campaigns for Fundació Blanquerna.
• Web users. The navigation system and the software that allow for the operation of our website collect the kinds of data that are ordinarily generated in the use of Internet protocols. This data includes, among others, the IP address or the domain name of the computer used by the person connecting to the website. This information is not associated with specific users and is used for the sole purpose of obtaining statistical information on the use of the website. Our website does not use cookies that allow for the identification of specific individual users of the site. The use of cookies is limited to the collection of technical information to facilitate the accessibility and efficient use of the site. Our site uses cookies that facilitate navigation and that provide us with information about our users and their interests. Below you can access instructions on how to delete cookies in various browsers.

-For Firefox.
-For Chrome.
-For Explorer.
-For Safari.
-For Safari (IOS).
- For Opera.

How do we gather data?

• Data collection channels: We gather data through face-to-face meetings and other channels such as through emails and phone calls. In all cases, the data is used only for the explicit purposes for which it has been collected and processed.
• In most cases, we collect data directly from the interested parties, and we obtain it mainly through forms prepared for this purpose. An important source of information is the data gathered during open house events, information sessions held at schools and fairs where we present our programs.
• In the course of our relationship with students, teachers and suppliers, other data are generated and are incorporated into the systems of the Fundació Blanquerna.
• A more limited volume of data may come from government entities responsible for higher education or from other academic institutions.

What is the legal basis for our data processing?

We carry out data processing activities based on several different legal frameworks, which vary
depending on the nature of each kind of activity. We classify the main types of data processing
operations we carry out according to the categorization established in article 6.1 of the General
Data Protection Regulation.

• For the provision of educational services. Once admitted, our students receive educational services from Fundació Blanquerna. This provision of services to the student constitutes a contractual relationship, under which rights and obligations are established for each party, including the right of the student to receive a good education and the right and obligation of Fundació Blanquerna to process their data. This processing has its legal basis in Organic Law 6/2001, of 23 December, on universities, in Law 1/2003, of 19
  February, on universities in Catalonia, as well as the regulations implementing said law.
• In the context of a pre-contractual relationship. This is the case of the data of people interested in the educational programs offered by Fundació Blanquerna. For other reasons, but with a similar legal justification, we process the data of potential customers or suppliers with whom we enter into relations prior to the formalization of a contractual relationship. This is also the case with regard to the processing of data of people who have sent us their CVs or who participate in selection processes.
• In compliance with a contractual relationship. This is the case with regard to our relationships with our customers and suppliers and all activities and uses of data that these business relationships entail.
• In order to comply with legal obligations. Providing higher education services entails a need to comply with a range of data processing regulations. For example, Fundació Blanquerna shares data on its students with Ramon Llull University in the context of procedures of certification and the issuing of degrees corresponding to the educational programs completed. Also in compliance with legal obligations (fiscal regulations), we communicate data to the tax authorities. We would also communicate data to judicial bodies or law enforcement agencies in compliance with legal obligations if required.
• Based on prior consent. When we send out information about our activities or services, we use contact data only when we have the explicit consent of the person who will receive the information. It is also on the basis of consent that we obtain navigation data about the person visiting our website, consent that can be revoked at any time by uninstalling cookies. Prior consent is also obtained for the treatment of images for the purposes of which individuals will have been previously informed, either to disseminate information
  about academic or other activities, events or services of any other kind offered by Fundació Blanquerna, or for marketing campaigns for Fundació Blanquerna.
• For reasons of legitimate interest. The images we obtain with video surveillance cameras are processed for the legitimate interest of our institution in maintaining its assets and facilities. Our legitimate interest also justifies the processing of the data we obtain from contact forms.

With whom are data shared?

• As a general rule, we share data only in compliance with legal obligations. In the preceding sections we have identified the situations in which we share our students' data when it is necessary to make possible the provision of educational services, and when we share that of our customers and suppliers in the course of our economic and commercial relations. The students' contact data may be communicated to other institutions in our group, provided that the student has authorized this.
• Data may be transferred outside the European Union (international transfer) for the management of the international mobility of students and to respond to job offers from non-European companies. In both of these cases, the data processing is subject to the student's consent.
• Additionally, for certain tasks we contract the services of companies or individuals who provide us with their experience and expertise, who on some occasions have access to personal data. Under the terms of the General Data Protection Regulation, this is called a data processing order. Upon signature of a contract, these third parties’ confidentiality obligations are formalized, and their compliance with these obligations is monitored. This may be the case of data hosting services on servers, computer support services, or legal, accounting or tax consultancy services.

How long do we store data?

• Data storage time is determined by several factors. The most important factor determining how long data is stored is the extent to which storage continues to be necessary to meet the purposes for which the data has collected. Secondly, data are kept in order to meet any potential liability for the processing of the data by Fundació Blanquerna and to meet requirements made by the public administration or judicial bodies. Therefore, the data must be stored for as long as it has legal or informative value and for the time needed to comply with legal obligations, but not for a longer period than is necessary to fulfill the purposes for which it is being processed (under the "limitation of the storage period" requirement of the General Data Protection Regulation).
• Data certifying the educational records of students are kept permanently in order to preserve the rights of these students.
• Certain data such as that which is featured in accounting and invoicing documents are required under tax regulations to be kept until the statute of limitations expires. The regulations governing foundations specify that certain accounting data must be kept for ten years (in compliance with Law 10/2010 of April 28).
• Data processed exclusively on the basis of the consent of the person concerned can be stored until the person withdraws this consent.
• Images recorded for purposes of which individuals have been previously informed, either to disseminate information about academic or other activities, events or services of any other kind offered by Fundació Blanquerna, or for marketing campaigns for Fundació Blanquerna, can be stored for the period necessary to carry out the above-mentioned purposes and until the person concerned exercises the right of withdrawal of consent, which will not affect the lawfulness of the data processing prior to this withdrawal. However, in the specific case in which personal data are made public on the website or social networks, and by virtue of the data subject's right to their erasure, reasonable measures, including technical measures, will be taken in light of the technology available and the cost of its implementation in order to erase any link to such personal data.
• Finally, images obtained by video surveillance cameras are kept for a maximum of one month, except in the case of incidents that justify a longer period of storage, when they are kept for the time necessary to facilitate the actions of law enforcement or judicial bodies.

Regulations governing the storage of public documentation and the opinions of the document
qualification commissions are sources of important criteria when deciding on the conservation or
deletion of data related to the exercise of services of public interest.

What rights do individuals have regarding the data we process?

As established in the General Data Protection Regulation, individuals about whom we process
data have the following rights:

• To know whether it is being processed. Firstly, individual have the right to know if we are processing their data, regardless of whether there has been a previous relationship.
• To be informed at the time of data collection. When personal data are obtained from the data subject, at the time of providing these data, he/she must be clearly informed of the purposes for which they will be used, who will be responsible for data processing, and the main aspects involved in this processing.
• To access data. This is a very broad right that includes the right to know precisely what personal data is being processed and for what purposes and whether and with whom it will be shared, as well as the right to obtain a copy of the data and to know the expected storage period.
• To request rectification. This is the right to correct any inaccurate data that we have processed.
• To request erasure. Under certain circumstances, there is a right to request the erasure of data when, among other reasons, they are no longer necessary for the purposes for which they were collected and which justified the processing.
• To request the restriction of processing. Also under certain circumstances, the right to request the restriction of data processing is recognized. In this case, they will no longer be processed and will only be stored in order to exercise or defend against a legal claim, in accordance with the General Data Protection Regulation.
• To portability. This is the right to receive personal data in a structured, commonly used, machine-readable and interoperable format, or to request that it be transferred in this form to another data controller. This right is recognized when the data subject has provided the personal data and has given consent or when the processing is necessary for the execution of a contract. It is not recognized when the processing has a legal basis other than consent or contract.
• To object to data processing. An individual may invoke reasons relating to his or her individual situation which require the cessation of the processing of his or her data to the extent or the degree to which it is likely to cause him or her harm, unless this harm occurs for legitimate reasons or in the exercise or defense of legal claims.
• To not receive information. We will immediately respond to requests not to continue receiving information about our activities and services when the sending of this information is based solely on the consent of the recipient.

How can these rights be exercised or defended?

The rights set out above can be exercised via a request to Fundació Blanquerna at the mailing address or through the other means of contact indicated at the top of this page.

If you have not obtained a satisfactory response to the exercise of your rights, you may file a complaint with the Catalan Data Protection Authority using the forms or other channels available on its website www.apd.cat.

In all cases, whether to file complaints, request clarifications or send suggestions, you can contact the Data Protection Officer by sending an e-mail to [email protected].