Legal notice and data protection

The entity responsible for data processing is the Balmes University Foundation, proprietor of the University of Vic - Central University of Catalonia (UVic-UCC), with address at Carrer Perot Rocaguinarda, 17 de Vic (postcode 08500), Tax Identification Code G58020124, telephone (+34 938 861 222), e-mail dpd@uvic.cat, entered as no. 150 in the Register of Foundations of the Government of Catalonia.

The Balmes University Foundation is a partner in the following organisations, which complement its range of services and functions:

• Foundation for Advanced Studies in Health Sciences (FESS);
• Kreas;
• Eumo Editorial;
• Eumo DC;
• Creacció.

The Balmes University Foundation is also responsible for data processing of students and teachers of the Bages University Foundation and the Elisava Foundation, teaching centres that are part of the University of Vic - Central University of Catalonia. And the data of students and teachers of the following affiliate centres:

• BAU;
• ESERP;
• EADA.

The Data Protection Officer (DPD) is the person who oversees compliance with UVic-UCC data protection policy and ensures that user rights are protected. The DPD’s functions include responding to any questions, suggestions, complaints or grievances from data subjects. You can contact the Data Protection Officer in writing at the postal address of the institution, by telephone or at dpd@uvic.cat.

We carry out personal data processing with due regard to the rights of individuals and in a proportionate manner. This implies that we conduct processing of appropriate and relevant data limited to the explicit purpose for which we collected it; we only process the data needed for the educational services that are our mission. In some cases more data is required, for example, to ask you to rate our services. Such answers are treated statistically and separately from data identifying respondents.

We process personal data primarily to provide academic and complementary services, to send communications regarding our activities and services, and for business relationships with our suppliers. Below we list the main purposes for which data is collected.

Academic management

The Balmes University Foundation registers the data of applicants that go on to enrol to keep a record and, on this basis, to provide higher education services. The data provided and resulting from academic activity allows for monitoring and serves as a basis for evaluation. Management of student academic records is the main data processing. Student data is also used for administration, to identify students as users of University services, to facilitate access to these services, to send information of interest, to process and to issue certificates and to monitor job placement.

Contact

The Foundation records data to answer queries from people who use the contact forms on our website. This data is only used for this purpose.

Staff selection

We collect and retain curriculums of those interested in working with us and also process personal data for staff selection processes in order to analyse the suitability of candidates for vacancies. We retain the data of those who are not hired for a maximum period of one year, in case a new position arises in the short term. However, in the latter case we immediately delete data if the person concerned requests it.

Information on activities and services

With the explicit permission of each student, once they have completed their courses, we use their contact details to send them information about our services and activities. With your permission we also send information about activities from other institutions in our group. This information is also sent to those who ask for it, despite not having enrolled at the Balmes University Foundation.

Management of data from our suppliers

We record and process the data of suppliers of goods and services. Such data may be details of self-employed people or company representatives. We only collect the data necessary to maintain the business relationship.

Video surveillance

The existence of video surveillance cameras at points of access to our premises is indicated by means of approved signs. The cameras record images only of spaces where this is needed to ensure the safety of people and property. The images are only used for this purpose.

Users of our website

The navigation system and software that make possible the operation of our website collect data that is ordinarily generated in the use of internet protocols. Among other items in this category is the IP address or domain name of the computer used by the person connecting to the website. This information is not associated with specific users and is used for the sole purpose of obtaining statistical information on the use of the website. Our website uses cookies that facilitate navigation and provide us with information about users and their interests.

Other data collection channels

We also obtain data through face-to-face relationships and other channels such as email, app downloads, blog comments, blog subscriptions or our social media channels. In all cases, the data is only used for the explicit purposes that justify collection and processing.

In the previous section we referred to some of the sources of the data we process. In most cases the data comes directly from the individuals concerned: we obtain it mainly through forms. We also obtain data at open days, during outreach sessions at schools and through participation in trade fairs.

In our relationship with students, teachers and service providers, other data is generated that we incorporate into the information systems of the Balmes University Foundation.

A more limited amount of data may come from public higher education authorities or from other academic institutions.

The data processing we carry out has a variety of legal bases, depending on the nature of the processing. To classify the main data processing we carry out, we follow the legal bases of Article 6.1 of the General Data Protection Regulation.

For the provision of educational services

Once admitted, students at the Balmes University Foundation receive educational services. The provision of services to students is a contractual relationship, with obligations for each party: the student has the right to receive good training and the Balmes University Foundation has the right and obligation to process their data. This treatment has its legal basis in Spanish Organic Law 6/2001, of 23 December, on Universities, Catalan Law 1/2003, of 19 February, on Universities in Catalonia, and regulations giving effect to these two laws.

In fulfilment of a pre-contractual relationship

In this case, we collect data from people interested in the courses of the Balmes University Foundation. For other reasons, with similar legitimacy, we process the data of potential clients or suppliers prior to the formalisation of a contractual relationship. We also process data from people who have sent us their CVs or who are involved in selection processes.

In fulfilment of a contractual relationship

This refers to relationships with our clients and suppliers and to all uses of the data that these business relationships entail.

In fulfilment of legal obligations

The provision of higher education services obliges us to comply with various regulations for data processing. The Balmes University Foundation passes data from its students to public higher education authorities responsible for recognising and issuing degree certificates for courses. In fulfilment of legal obligations (tax regulations) we also communicate data to the tax authorities. In fulfilment of legal obligations, if required, we would also communicate data to judicial bodies or to the security forces.

Consent to data collection

When we send information about our activities we use contact details with the explicit consent of the recipient. We also ask for consent to obtain browsing data from individuals who visit our website, consent that can be revoked at any time by deleting cookies.

Legitimate interest

We treat video surveillance camera images on the basis of the legitimate interest of our institution in preserving our assets and facilities. Our legitimate interest also justifies the processing of the data we obtain through contact forms, and the data of individuals who comment on blogs or install our app.

As a general rule we only communicate data to comply with legal obligations. In previous sections we have outlined the communication of student data that is required for provision of educational services, and of our clients and suppliers in order to carry out commercial activities. Student contact information may be shared with other institutions in our group only if the student has authorised it.

Data transfers are only made outside the European Union (international transfer) to manage international mobility of students and to respond to job offers from non-European companies. In both cases, processing is based on the student's consent.

For certain tasks we obtain the services of companies or individuals who provide us with their experience and specialist skills, and they occasionally have access to personal data. As established in the General Data Protection Regulation, this is not a transfer of data, but a processing order. We only contract services from companies that ensure compliance with these regulations. When the contract is signed, confidentiality obligations are formalised and performance is subsequently monitored. This could be the case for server hosting services, computer support services, or legal, accounting and tax advice. Detailed information on the identity of these companies can be obtained at dpd@uvic.cat.

Data retention time is determined by various factors. Conservation is mainly influenced by whether the data continues to be necessary to fulfil the purposes for which it was collected in each case. Secondly, data is retained to deal with possible responsibilities of the Balmes University Foundation for data processing and to meet any requirements of public authorities or judicial bodies.

Therefore, data must be kept for the time necessary to preserve its legal or informative value and prove compliance with legal obligations, but not for a period longer than necessary for the purposes of processing (the "limitation of the retention period” is also a requirement of the General Data Protection Regulation). In the case of information accrediting training received by students, the data is kept permanently to preserve the rights of the students concerned.

In certain cases, such as the data contained in accounting and invoicing, tax regulations require it to be kept until the institution is no longer liable in this matter. The regulations governing foundations specify that certain accounting data must be kept for ten years (in compliance with Spanish Law 10/2010, of 28 April).

Data treated exclusively upon consent of the person concerned is kept until the person revokes consent.

Images obtained by video surveillance cameras are kept for a maximum of one month, although in the event of of an incident they may be retained for the time necessary to facilitate the actions of the security forces or judicial bodies.

Regulations governing the conservation of public documentation and the decisions of evaluation panels are key factors when deciding on the conservation or elimination of data relating to the exercise of services in the public interest.

As provided for in the General Data Protection Regulation, individuals whose data is processed have the following rights:

• Right to know if their data is being processed. Everyone has the right to know if their data is processed, whether or not they have previously been in a relationship with us.
• Right to be informed about data collection. When data is obtained from the person concerned, they shall be clearly informed at the time they provide the data of its uses, who will be responsible for data processing and the main aspects of this data processing.
• Right of access. This is a broad right that includes knowing exactly what personal data is processed, what the purpose is, what communication of data to others is carried out (if applicable) and the right to obtain a copy or know about the horizon for data retention.
• Right to request rectification. This is the right to rectify inaccurate data that we are processing.
• Right to request deletion. In certain circumstances you have a right to request data deletion when, among other things, it is no longer needed for the purposes for which it was collected and processed.
• Right to request limited data processing. In certain circumstances you have the right to request limitation of data processing. In that case, your data will no longer be processed and will only be stored to deal with allegations, in line with the General Data Protection Regulation.
• Right of data transfer. In the cases provided for in legislation, the person concerned has the right to obtain their own personal data in a structured commonly-used machine-readable format, and transfer it to another data controller if they so wish. 
• Right of opposition to data processing. A person can cite reasons relating to their own situation that lead them to wish to stop data processing if it could be prejudicial for them, except for legitimate use or for the institution to be able to deal with allegations.
• Right to not receive information. Requests to no longer receive information on our activities and services are dealt with immediately, when such communications are based solely on the consent of the recipient.

The rights we have listed can be exercised by sending a request to the Balmes University Foundation by post or by any other means of contact indicated above.

If you do not receive a satisfactory response when exercising your rights, you may lodge a complaint with the Catalan Data Protection Authority, through its forms and other channels on its website (www.apd.cat).

In all cases, whether submitting complaints, requesting clarification or sending suggestions, you may contact the Data Protection Officer at dpd@uvic.cat.