GDPR: Contacts
Who is the personal data controller?
Escola Superior de Comerç Internacional (ESCI-UPF)
Q5856335D
Pg. Pujades, 1, 08003 – BARCELONA
+34 932 954 710
rgpd@esci.upf.edu
Contact details for our data protection officer
Why do we process personal data?
The Escola Superior de Comerç Internacional (ESCI-UPF) processes personal data for the following purposes:
1. To keep an up-to-date address book for the following classes of data subject:
a) The data subject is a contact person for the purposes of conducting a relationship with the legal body or organisation where they offer their services.
b) The data subject is an interested party who has contacted us with a query or a request for information.
c) The data subject is a contact person with a direct relationship with us.
2. To send marketing messages concerning our courses and services, as well as related events, provided that the interested party has given their consent for us to do so, including by email or other equivalent electronic means of communication.
How long do we keep personal data?
For Purpose 1, personal data is kept for the following periods of time:
a) If the data subject is a contact person for the purposes of conducting a relationship with the legal body or organisation where they offer their services, personal data will be kept for the duration of our relationship with the legal body or organisation in question, notwithstanding any legal obligations to keep the data for a fixed period of time or any similar legal responsibilities entailed by the relationship with the legal body or organisation.
b) If the data subject is an interested party who has contacted us, personal data is kept for up to six months once we have responded to their request, in order to allow the interested party to follow up on their request or to ask for further information.
c) If the data subject is a contact person with a direct relationship with us, personal data will be kept for the length of the relationship, notwithstanding any legal obligations to keep the data for a fixed period of time.
For Purpose 2, concerning the sending of commercial information, we keep personal data until such time as the interested party informs us that they no longer wish to receive information from us.
Automated individual decision-making and profiling
We do not make any automated decisions.
What is the lawful basis for processing personal data?
The lawful basis for processing personal data for Purpose 1, namely to keep an up-to-date address book:
a) If the data subject is a contact person for the purposes of conducting a relationship with the legal body or organisation where they offer their services, the lawful basis is the need to satisfy the controller’s legitimate interests, in accordance with the provisions of Article 6.1.f of the GDPR.
b) If the data subject is an interested party who has contacted us, the lawful basis is the need to obtain their consent.
c) If the data subject is a contact person with a direct relationship with us, the lawful basis is the need to satisfy the controller’s legitimate interests, in accordance with the provisions of Article 6.1.f of the GDPR.
The lawful basis for processing personal data for Purpose 2, namely to send marketing messages, is to obtain the interested party’s consent.
Who will we share personal data with?
During the period of time when we are processing personal data, the Escola Superior de Comerç Internacional (ESCI-UPF) will not share personal data with any third parties.
Nevertheless, the Escola Superior de Comerç Internacional (ESCI-UPF) may collaborate with third-party service providers, who may require access to users’ personal data in order to provide the service in question. This personal data will be processed under the same legally binding conditions, in accordance with our instructions and the provisions of a previously signed data protection agreement. This agreement will stipulate that personal data be used solely for the agreed purposes, that suitable technical and organisational measures be put in place and that the personal data be erased and returned once the period of service provision is over. We require service providers to have signed up to the EU–US Privacy Shield.
The Escola Superior de Comerç Internacional (ESCI-UPF) selects third-party service providers in accordance with strict criteria designed to ensure that we fulfil our obligations in the field of personal data protection.
What rights do users have once they have provided us with their personal data?
All users have the right to ask the Escola Superior de Comerç Internacional (ESCI-UPF) whether or not we have processed their personal data.
They may also exercise the following rights:
- Right to request access to their personal data;
- Right to ask for their personal data to be corrected;
- Right to ask for their personal data to be erased;
- Right to ask for the processing of their personal data to be restricted;
- Right to object to the processing of their personal data;
- Right to personal data portability;
- Right to withdraw consent;
- Right to information about personal data processing.
To exercise their rights, users should send a written request, together with a copy of their passport or ID card, to:
ESCOLA SUPERIOR DE COMERÇ INTERNACIONAL (ESCI-UPF)
Exercici de Drets i Protecció de Dades
Pg. Pujades, 1
08003 – BARCELONA
Or send an email to: rgpd@esci.upf.edu
Users may contact the Catalan Data Protection Authority (Autoritat Catalana de Protecció de Dades, https://seu.apd.cat) to request further information or to lodge a complaint if, for example, they feel that their personal data rights have not been respected.