Data protection

Data controller

The data controller for the processing of the interested party's data is Fundació per a la Universitat Oberta de Catalunya (hereinafter, the “UOC”). The contact details of the UOC are as follows:

Address: Rambla del Poblenou, 154-156, 08018, Barcelona
Email address: fuoc_pd@uoc.edu

The interested party is hereby informed that the UOC Group has appointed a Data Protection Officer to deal with any issue relating to the processing of your personal data. The interested party may contact the Data Protection Officer via the following contact details:

Address: Rambla del Poblenou, 154-156, 08018, Barcelona
Email address: dpd@uoc.edu

Purpose

Personal data of the interested party are processed for the following purposes:

To manage the enrolment of the interested party. Enrolment management means the execution of all the administrative procedures necessary for said purpose, such as:
- access, in which the documentation provided by the student is reviewed to ensure the validation that must be carried out by the UOC is correct;
- attention, in which the channels of communication with the UOC are made available to the student;
- certification, in which students may request certifications relating to their academic record, and making the Virtual Campus available to the student.

Student enrolment implies integration within the UOC community.
Furthermore, on completion of their studies, students will automatically be integrated within the Alumni community.

To manage the sending of information to interested parties on the UOC’s course offering within the education sphere they have chosen and to know their opinions on the information we have provided.
To manage the sending of commercial information on other UOC course offerings, as well as academic and institutional information on the acts that are held at the UOC as an institution and on the events and recognitions taking place there. This is done through profiling, both on the part of the UOC and third parties.

With regard to profiling, we inform you that the UOC uses this for the sole purpose of finding persons with a similar conduct or interests in order to send them information regarding the academic offer.

To manage the sending of questionnaires related to research and innovation, among other issues, both by the UOC and third-party suppliers or organizations the University has signed agreements with.
To send questionnaires for the purpose of university quality statistics.
To make international transfers of data in order to manage and fulfil the commitments derived from the enrolment contract.

The personal data provided by the interested party will be kept bearing in mind the following aspects:

Enrolment data are conserved throughout the enrolment period. Subsequently, they are blocked until expiry of the applicable mandatory deadline.
Data corresponding to the management of sending information on the UOC's course offering in the chosen educational sphere will be kept for the period necessary to carry out this activity. Subsequently, they are blocked until expiry of the applicable mandatory deadline.
Data provided by the interested party to subscribe to the information service on the UOC’s course offering is kept until the desire to delete them is declared.

Lawful basis

The lawful basis for the processing of the personal data collected from the interested party is the fulfilment of this contract. In this regard, interested parties are obliged to provide the data necessary to fulfil it, and if they do not provide them, it will not be possible to formalize this contract.

With regard to the following processing, the lawful basis is the consent of the interested party, provided this has been given beforehand:

To manage the sending of information to interested parties on the UOC’s course offering within the education sphere they have chosen and to know their opinions on the information we have provided.
To manage subscriptions to the sending of commercial information on other UOC course offerings, as well as academic and institutional information on the acts that are held at the UOC as an institution and on the events and recognitions taking place there. This is done through profiling, both on the part of the UOC and third parties, and the sending of questionnaires related to subjects such as research and innovation.
To manage the drafting of questionnaires related to subjects such as research and innovation.

Said processing is based on the consent requested from the interested party, and under no circumstances will consent withdrawal affect the fulfilment of the contract in question.

There are also consents whose lawful basis is the fulfilment of a legal obligation, such as the transfer of data for statistical or university quality purposes.

Recipients

The personal data of the interested party may be transferred by the UOC to the following recipients:

UOC Group companies: EducaciOnline, S.L., Oberta UOC Publishing and UOC Corporate.
Public authorities, whenever established by an applicable legal provision.
In cases where the student undertakes or wishes to undertake courses in another education centre, including universities, schools and international centres, this centre may also be the recipient of the interested party's data for the purpose of managing and formalizing the corresponding enrolment or agreement.
In cases where the student undertakes or wishes to undertake practical training in companies or organizations external to the UOC, including international organizations, these companies or organizations may also be the recipient of the interested party's data for the purpose of formalizing and executing the corresponding curricular or extra-curricular practical training.

Students are also informed that their personal data may be transferred to course instructors or third-party entities located outside the European Economic Area (EEA), in order to manage and fulfil the commitments derived from the present contract. Such international transfers of data shall only be made in accordance with Article 49 of the GDPR, if necessary for the execution of the contract signed by the student or, wherever applicable, when the UOC has requested the explicit consent of the student.

In all cases, the UOC shall guarantee that the transfer of data to course instructors or third-party entities located outside the European Economic Area to countries with a level of protection equivalent to the European one is carried out in accordance with European Commission criteria. Whenever it is declared that said jurisdictions do not have a level of protection equivalent to the European one, the UOC shall adopt the applicable safeguards through the use of standard contractual clauses, a requirement of affiliation to the Privacy Shield or contractual clauses previously authorized by the Spanish Data Protection Agency (AEPD), in virtue of which the UOC shall guarantee:

That the processing of the personal data, including the transfer itself, was carried out and will continue to be carried out in accordance with the applicable data protection legislation.
That it has given appropriate instructions so that the processing of the personal data transferred offers sufficient guarantees with regard to technical security and organizational measures and complies with the regulatory framework and internal principles of the UOC.
That such measures are appropriate to protect the personal data transferred against accidental or unlawful destruction or accidental loss, unauthorized alteration, dissemination or access, or against any other form of unlawful processing, while guaranteeing a level of security appropriate to the risks involved in the processing and given the nature of the data that has to be protected, taking into account the state of the technology.
That it will monitor compliance with such measures and guarantee that they are implemented.

Rights of the interested party

In addition, the interested party has the right to receive the personal data they have previously provided to the UOC in a structured, commonly used and machine-readable format, and to transmit them to another controller whenever the processing is based on consent or on a contract and is carried out by automated means.

The interested parties have the right to object, at any moment, for reasons related to their particular situation, to the personal data that concerns them being the object of processing based on the public or legitimate interest pursued by the UOC or a third party, including profiling, in order to stop the UOC or other UOC Group company from processing their data, except where the latter can accredit compelling reasons for the processing to prevail over the interests, rights and freedoms of the interested parties, or they need them for the formulation, exercise or defence of legal claims.

Furthermore, interested parties has the right not to be the object of a decision based solely on automated processing, including profiling, which has legal or similarly significant effects on them, except where this decision is necessary for the formalization or fulfilment of a contract between the UOC or another UOC Group company and the same, is authorized by applicable European Union or member state law or is based on the explicit consent of the interested party.

Finally, the interested party has the right to submit a claim before the Catalan Data Protection Authority.

Origin

The personal data we process at the UOC, in cases where it does not originate from the interested party, is obtained from the following sources:

Companies which manage information on degrees, courses, master’s degrees, postgraduate courses and other studies, which have transferred the data of the interested party to us so that we can provide the information service on our course offering.
Other study centres, universities or schools, including international centres, which have transferred the data of the interested party to us for the purpose of managing and formalizing their enrolment on a UOC degree, course, master's degree or postgraduate course or other studies.

The categories of data that are processed are as follows:

In the case of information management companies: identification data (name, address, telephone number, etc).
In the case of other study centres: identification data (name, address, telephone number, etc), employment data and academic data (education history, etc).