Who is the personal data controller?

Escola Superior de Comerç Internacional (ESCI-UPF)
Q5856335D
Pg. Pujades, 1, 08003 – BARCELONA
+34 932 954 710
rgpd@esci.upf.edu

Contact details for our data protection officer

esci.upf@dpo-profesional.es

Why do we process personal data?

The Escola Superior de Comerç Internacional (ESCI-UPF) processes personal data in order to manage students’ academic and administrative affairs in all areas and at all stages of their course: enrolment, keeping their academic transcript up to date, sending administrative and marketing messages and managing all their academic activities.

How long do we keep personal data?

We keep personal data for as long as students retain their ties to the educational services we offer, notwithstanding any legal obligations to keep academic transcripts and other documentation for a fixed period of time or any other legal obligations to keep data for a fixed period of time.

Recordings made as part of online exams will be kept for one year.

Automated individual decision-making and profiling

We do not make any automated decisions.

What is the lawful basis for processing personal data?

The lawful basis for processing personal data is the need to fulfil the obligations of the educational contract entered into by students when they enrol.

Personal data will be processed for the purpose of sending marketing messages by email or other equivalent electronic means of communication in accordance with Article 21.2 of Act 34/2002 on Information Society Services and Electronic Commerce, which authorises us to send the interested party marketing messages related to products and services similar to those covered by an agreement signed by both parties, until such time as the interested party lets it be known that they no longer wish to receive these messages (for further information see the section on Rights below).

Who will we share personal data with?

Personal data will be shared with the General Treasury of the Social Security in Spain for the purposes of mandatory education insurance; with the Spanish Ministry of Education, Culture and Sport, the Catalan Ministry of Business and Knowledge and the Catalan Agency for Management of University and Research Grants for the purposes of managing grants and financial aid for enrolment; the Universitat Pompeu Fabra and other universities linked to degree courses for statistical purposes; with private organisations with which we have signed agreements for students to carry out their mandatory internships; and with university coordinating organisations and other bodies we are legally obliged to share data with.

Once the interested party has given their consent, their personal data may be shared with private organisations offering grants; with other Spanish and overseas universities for international mobility programmes; with other students going to the same destination as part of an international mobility programme; and with public and private organisations to carry out extracurricular internships or to access offers of employment through the Employment Office.

No recordings made as part of online exams will be shared with any third parties.

In addition, the Escola Superior de Comerç Internacional (ESCI-UPF) may collaborate with third-party service providers, who may require access to users’ personal data in order to provide the service in question. This personal data will be processed under the same legally binding conditions, in accordance with our instructions and the provisions of a previously signed data protection agreement. This agreement will stipulate that personal data be used solely for the agreed purposes, that suitable technical and organisational measures be put in place and that the personal data be erased and returned once the period of service provision is over. We require service providers to have signed up to the EU–US Privacy Shield.

What rights do users have once they have provided us with their personal data?

All users have the right to ask the Escola Superior de Comerç Internacional (ESCI-UPF) whether or not we have processed their personal data.

They may also exercise the following rights:

• Right to request access to their personal data;
• Right to ask for their personal data to be corrected;
• Right to ask for their personal data to be erased;
• Right to ask for the processing of their personal data to be restricted;
• Right to object to the processing of their personal data;
• Right to personal data portability;
• Right to withdraw consent;
• Right to information about personal data processing.

To exercise their rights, users should send a written request, together with a copy of their passport or ID card, to:

ESCOLA SUPERIOR DE COMERÇ INTERNACIONAL (ESCI-UPF)
Exercici de Drets i Protecció de Dades
Pg. Pujades, 1
08003 – BARCELONA

Or send an email to: rgpd@esci.upf.edu

Users may contact the Catalan Data Protection Authority (Autoritat Catalana de Protecció de Dades, https://seu.apd.cat) to request further information or to lodge a complaint if, for example, they feel that their personal data rights have not been respected.

Origin of data on students enrolling for the first time: University Admissions Office, which allocates university places.