Privacy policy

Universia Holding, S.L (hereinafter, "Universia" or the "Responsible") informs users (hereinafter, "Users" or in singular "User"), about its policy of personal data protection, detailing the processing of data that is carried out on the portal accessible through the domain https://www.santanderopenacademy.com (hereinafter, the "Portal").

In case you are a student and your university has offered this to you, you can also access our services through the "Campus" platform. This platform is offered and managed by your University, which will process your personal data as the person responsible for such treatment. However, our services are accessible in the "Espacio Santander " section of the platform, which is offered and managed by Universia.

The Portal is a space created by Universia that brings together Users and universities or other educational institutions or entities that join the Portal (hereinafter, "Institutions") and who publish scholarship programs or courses with limited places. The scholarship programs consist of the awarding of financial aid to fully or partially cover the expenses Users have to support while studying, developing a research work or participating in a project among other contents (hereinafter, the "Programs"). On the other hand, courses with limited places consist of the awarding of free places for participation in courses whose main subjects can be languages, skills, technology, sustainability, among others (hereinafter, the "Courses with Limited Places"). In addition to these Courses with Limited Places, Universia offers Users a free catalog of training courses with unlimited places ("Courses with Unlimited Places") aimed at reinforcing the competencies of Users and complementing their education. Lastly, Users can also access content offered by Universia itself to facilitate learning and reinforce their competences (hereinafter, the "Contents"). The Courses with Unlimited Places and the Content aim to enable Users to access better opportunities for academic and professional development. All of the above functionalities make up, together, the "Service". You can find more details about the Service in the General Conditions of Use.

The Portal has an international character, with Users and Institutions both outside and within the European Union being able to register and/or collaborate in its activity.

Additionally, registration on the Portal can be done directly through the corresponding registration form; through the Campus platform, which is a space that some university applications have to facilitate user access to our services, or from the Employment service. Both the Employment service and the Campus platform are the responsibility of Universia. Likewise, for Users who are clients of Banco Santander, S.A. (Spain), registration on the Portal can be done through the registration form of the app that this entity makes available to its individual clients (hereinafter, "App Santander").

Essentially, Users, who could be students, professors, collaborators, etc., can utilize the Portal to review, enroll in, manage or coordinate Programs, or to evaluate which Programs, courses, or contents might be beneficial to them in their educational process.

In addition to the Institutions, the Programs or Courses with Limited Places may have been funded by third-party entities (the "Promoters"), with whom the Institution may manage the Program or Course with Limited Places jointly or allow access to details about the same, as they have funded said Program or Course with Limited Places.

This Privacy Policy details the purposes for which we process the personal data of Users, the reasons why the processing is legal, the time periods during which we keep the data, the entities with which it is shared, the rights that can be enforced and other issues that we consider relevant so that Users are clear on what we are going to do with their data when they use the Service.

When we talk about "personal data," we refer to all information related to the Users that they provide us directly, that they have generated while using our Service, or that we have inferred about them, as long as they deem it right for us to analyze their profile (hereafter, the "Data"). Specifically protected data or information considered "sensitive" will not be processed.

Universia informs Users that the processing of the Data that Institutions or Promoters carry out for the management of Programs or Courses with Limited Places published on the Portal will be subject to their own privacy policies. Therefore, this Privacy Policy is limited to informing Users about the processing carried out by Universia, including the treatments related to the content that Universia itself directly offers.

Users only need to provide in each case the data marked with an asterisk or indicated as mandatory, as they are considered necessary to enjoy the Service. In this sense, Users can provide this data directly by completing the registration form, either by entering the data manually or through any of the available third-party authentication systems or social connectors, or if Users only want to subscribe to the news newsletter, they can provide the email in the section available without having to register on the Portal. Also, when the User is registered, additional data may be requested in some functionalities, for example, to register for a scholarship or course it may be necessary to request academic and/or employment data.

This Privacy Policy will remain accessible for consultation in the footer of the web version of the Portal.

1. DATA CONTROLLER

Identity of the Data Controller:

Universia Holding, S.L

An entity filed with the Mercantile Registry of Madrid in 2005, at volume 16547, sheet 107, page number M-28189, entry 4, with corporate tax number B82976515 (the “Data Controller”).

Data controller contact details:

Postal address: Ciudad Grupo Santander. Avda de Cantabria s/n, 28660 Boadilla del Monte, Madrid

Contact form for privacy purposes: Contact form

Contact details of data protection officer: dpo@universia.net

2. DATA WE PROCESS AND ORIGIN OF THE DATA

On the Portal, we process the Data that Users have provided us, both in the registration process and afterwards when using our Service, enrolling in Programs, Courses with Limited Places, Courses with Unlimited Places, accessing the Contents or simply browsing the Portal. The collection of Users' Data in the registration process can be done directly if the User has provided that information to Universia by filling out the registration form, or by using the authentication systems or third-party social connectors offered on the Portal. In this case, the provider of the authentication system or corresponding social connector will provide Universia with the Data that the User authorizes, which will be displayed on screen before finalizing the delivery. The User may also check the permissions granted on the third party platform whose social connector they use. If the Data received in this way were insufficient, i.e., if any of the Data marked with an asterisk were not delivered, Universia will request the User to deliver them in order to complete the registration on the Portal and access the Service. Users are informed that the Data received from these third parties will be incorporated into a database owned by Universia and will be used not only for sign up or access to the Portal, but also for the rest of the relevant purposes in accordance with what is described in section 3 of this Privacy Policy.

In some cases, we may obtain the User's registration data from other sources or services provided by Universia or with which Universia is related, such as Banco Santander, S.A. (Spain) for Users who are clients of that company and use the App Santander. For example, if the User wishes to use autocomplete functions of the registration forms, Universia could obtain the necessary data from the account the user has created in another service provided by Universia (e.g., employment services) or a service otherwise related with the Campus platform or the App Santander. Please consult the specific section on autocomplete for more detail.

We specifically obtain the following data: (i) on one hand, data provided directly by the User such as name, surnames, country of residence, email, date of birth, when necessary for unique identification, official identification number according to jurisdiction (ID, NIF, foreigner's ID, etc.), resume, education or qualifications ("Form Data"); and (ii) on the other hand, data related to navigation and use of the Portal (such as IP address, information about the device, registrations in Programs, Courses with Limited Seats and Courses with Unlimited Seats, profile data or favorites contents) ("Navigation Data").

Finally, we inform Users that we obtain information on browsing habits via cookies. For more information in this regard, we recommend Users consult our Cookies Policy.

3. PURPOSES OF AND LEGAL BASIS FOR PROCESSING

Management of the User's registration on the Portal and enjoyment of the Service.

The Responsible party will process the Data of Users who register through the corresponding form to manage their registration on the Portal and so that they can identify themselves. Also, Universia will process the Data for all treatments that are necessary to enable the use of all the functionalities of the Service that the User uses, such as registration in Programs, Courses with Limited Places and Courses with Unlimited Places or the Content offered on the Portal or the sending of notifications about the Service itself, if the User so wishes.

Among other necessary treatments for the provision of the service, when the nature of the Course (whether Limited or Unlimited Seats) requires it, the Responsible Party and/or the corresponding Institution will use the personal data of the Users to certify their attendance or participation in it whenever possible, as it is necessary to demonstrate the training to third parties. For the certification, the Form Data of the User and their attendance or participation in the Course will be processed.

What is the legal basis for this processing?

The legal basis that enables this data processing is the performance of a contract put in place through acceptance of the General Conditions of Use.
Fraud Prevention in Programs and Courses. When required by the nature of the Program or Course (whether Limited or Unlimited Places), the Responsible Party may use the personal data of the Users to prevent fraud in the application, registration, attendance, or participation. For this purpose, the Responsible Party will employ technical and organizational measures to check the operations of the Programs or Courses and identify behaviors that could be considered fraudulent (e.g., multiple registrations; identity impersonation in registration, application, or participation)
For the verification and prevention of fraud, data such as the User's Form Data and the necessary Navigation Data will be processed, as well as their attendance or participation in the Program or Course.

What is the legal basis that legitimizes this processing?

This processing is based on the legitimate interest of Universia and the Institutions in preventing fraud in the Programs and Courses to which they provide access. Fraud prevention is necessary to maintain the quality and value of the Programs and Courses, thereby benefiting the Users themselves. We have conducted a balancing analysis to assess whether we could indeed carry out this processing based on our legitimate interest. Users can request this through the contact details provided. However, we advance some of the main conclusions of this analysis below: fraud prevention represents a real interest for both us and the Institutions and the rest of the Users; it is entirely lawful; it is proportionate as there are no less invasive measures that allow us to pursue our interest without unlawfully processing the Users' data; it does not harm the User (on the contrary, it ensures the quality and value of the Programs and Courses in which they participate); data processing is not disproportionate and is also a common practice in the sector.
Autocomplete of information in the User registration process. When required, the Responsible Party may process the User's Data to pre-fill some of the data requested during the registration process, which is the creation of an account and registration as a User. The treatment aims to facilitate User registration in the services offered by the Responsible, in those cases where the Responsible already has pertinent information. The User may modify any data that is pre-filled in the registration forms, before its submission to the Responsible for the creation of the User's account. The processed data will only be those indicated in the registration form of the portal. Depending on the context in which the user registration process is carried out, the Responsible Party may obtain the data from a different source:

- Registration from the "Campus" platform

When the User registers for the Service through the "Campus" platform, specifically through the "Santander Space" section managed by the Responsible Party, the Responsible Party will obtain the data from the account that the User had previously created when registering with the "Campus" application. This section of “Santander Space” is also the responsibility of Universia, as is this Portal.

- Registration from the Employment service.

When the User registers for the Service through any other channel offered by the Responsible Party, the Responsible Party will obtain the data from the account the User has previously created in another service offered by the Responsible Party (e.g., Jobs, see its specific privacy policy here).

- Registration from the App Santander of Banco Santander, S.A. (Spain)

When a User who is a client of Banco Santander, S.A. (Spain) registers for the Service through the App Santander, Universia will obtain the data directly from that User's account in the app (see the specific privacy policy of the App Santander)

No transfer or communication of personal data occurs either in the registration from the Campus platform or in the registration from the Employment service, because the personal data processing of the involved services is the responsibility of the same entity, that is, the Responsible Party. However, in cases where the User registers from the App Santander, it will be necessary for Banco Santander, S.A. (Spain) to communicate the personal data (name, country of residence, date of birth, and email) so that the Responsible party can manage the User's registration and access to the Portal.

Universia will always request the consent of Users for the autofill of their data.

What is the legal basis for this processing?

The basis for the legitimation of this data processing is the express consent of the User.

If the User does not give his consent initially or having given it, revokes it in the future, will not result in the loss of his condition as User nor will this affect the enjoyment of the Service.

It should be noted that consent to the autocomplete in the context of the "Campus" platform implies that the user consents to the University communicating the User's registration data to the Responsible Party, as it is necessary for the purpose.

Transfer of data to Institutions and Promoters for proper implementation of the Programme or Course with Limited Places. When Users register for a Program or Course with Limited Places, the Responsible party will transfer certain Data to the Institution that grants the corresponding Program or Course with Limited Places, as well as to the Promoter who has sponsored, promoted or financed it, if different, in order for it to be carried out (each own Program or Course with Limited Places will identify the Institution and the Promoter who will receive the User's data from the Responsible party), including its Evaluators and Judges they appoint, solely for the purpose of allowing you to participate in it. In addition, in some instances, Programs or Courses with Limited Places involve the training being pursued in an Institution different from the one granting it, to which Universia will also transfer the Data for the purpose of managing the necessary procedures to be able to study the Program or Course with Limited Places. In short, the following cases can occur:

- Case I: There is a Promoter who finances a Program or a Course with Limited Places and an Institution that grants the Program or Course with Limited Places and simultaneously where the User takes the training, so Universia will transfer the data to the Promoter and to the Institution in question.

Case II: There is a Promoter who finances the Program or Course with Limited Places, on the other hand, there is an Institution that grants the same, and finally, a third Institution where the User takes the course. In this case, Universia will transfer the data to the Promoter, to the Institution that grants the Program or Course with Limited Places, and to the Institution where the User carries it out.

We inform Users that these Data transfers are necessary in order to participate in the Programs and Courses with Limited Places and, thereby, to execute the General Conditions of Use and the specific conditions of the corresponding Program or Course with Limited Places. Sometimes the Institutions are located outside the European Union or in countries not approved by the European Commission.

There are occasions when, even after data has been transferred to the Promoter and the Institutions involved in a specific Program or Course, Users must register in the systems or platforms of these entities. This may be due to technological and operational needs or to requirements imposed by the regulations applicable to the corresponding entity (e.g., when an Institution, for example public ones, are subject to specific processing requirements for the granting of a scholarship or the delivery of educational content).

The data that would be transferred are the User's Form Data.

What is the legal basis for this processing?

The legal basis that allows this processing is the execution of a contract that materializes with the acceptance of the General Conditions of Use and the specific conditions of the corresponding Program or Course with Limited Places provided by the Institution in question. Also, we consider that the transfers to Institutions in whose Programs or Courses with Limited Places the Users enroll are occasional transfers, as we will only do this when the Users decide to register for them. Both issues justify the international transfers that we may carry out when transferring the data of such Users to Institutions located outside the country they are in, in countries not recognized as safe by data protection authorities.
Sending, by any means, of own communications of an academic nature that are personalised on the basis of the User profile. Our intention is to provide Users with interesting content at all times. For this purpose, we will create a profile of the User using factors such as the data they have provided us and their navigation and usage data on our Portal (IP address, registrations in Programs, Courses with Limited Places and Courses with Unlimited Places, favorites contents) or on third-party platforms that belong to the same network (in the latter case, only when you have accepted the installation of cookies or other tracking devices when accessing the Platform).

We will use this profile to send them customised, exclusively academic communications, which may be in relation to courses, grants, employment, training, contents, workshops and others.

What is the legal basis for this processing?

The legal basis that enables this personal data processing is that it is of legitimate interest of the Data Controller. Specifically, the Data Controller wishes its Users to have knowledge of the various functions and opportunities available on the Portal, and similar opportunities, and to interact and use the Portal as much as possible, to help Universia remain relevant in the academic sector. The Data Controller also wishes to draw up a profile on Users, since we have no interest in sending generic communications that do not match what we have found to be the interests of each User, and also to make the Portal useful and precise, and for users to use it as much as possible.

At Universia we have conducted a weighting analysis to determine whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this analysis through the contact data indicated. However, there follow a few of the main conclusions obtained from the analyses performed: the profiling and the sending of customised communications represent a genuine interest on our part which is totally lawful; it is proportionate because there are no less invasive measures to enable us to implement our desire for you to familiarise yourself with the opportunities we are offering and for our Portal to not be generic, but rather useful and relevant; it has no adverse impact on you, and in fact enables us to send you offers, calls or academic content which we believe will facilitate your training and improve your job prospects; you may opt out of these communications at any time, right from the outset; and this is also a habitual practice in the sector.
Transfer of the Data to the Santander Group entities domiciled in the User's place of residence ("Banco Local*" and "Universia Local*"), to enable them to send, by any means, including electronic media, their own customised commercial communications and those of third parties.The Data Controller will transfer Data belonging to Users that have given their express consent to the Local Bank and the Local Universia concerned so that they may separately send own and third-party marketing communications and/or communications of an academic nature that may refer, for example, to banking products, insurance products, telecommunications, education, leisure, research, vehicles, consumer goods, employment, culture, professional opportunities, textile, transport, insurance, catering, technology, food, television, radio, portals and Internet comparison tools. The commercial communications will be customised (because those parties are not interested in sending generic communications) and based on the profile of the User, which will comprise (i) Data we give them (these may be consulted below) and (ii) any data they already had on the User that the User had already supplied to them outside the Portal, if any.

In case of being a resident of the United Kingdom, as long as you have given your consent, the Data Controller will send you only commercial communications about our own products or services with the intention of providing you with information of interest at all times.

The data that would be transferred are the User's Form Data and the necessary Navigation Data.

What is the legal basis for this processing?

The legal basis for this processing is the express consent provided by the User. If the User does not initially provide their consent, or has provided it but then revokes it in the future, they will still be considered a User and their enjoyment of the Service will not be affected. Consent also covers transfer of data that would be carried out by the Data Controller if the User resides in an "insecure country". More information on international transfers can be found in section 5 of this Privacy Policy.

*Users may consult the identity of the Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence, by clicking here
Profiling for marketing purposes and sending via any channel, including digital ones, of marketing communications regarding own and third-party services and products.

Our intention at all times is to offer you content that we believe will interest you. If you are registered and have given your consent. Universia may send you own and third-party marketing communications regarding products and services that may, for example, relate to banking products, insurance products, telecommunications, education, leisure, research, vehicles, consumer goods, employment, culture, professional opportunities, textile, transport, insurance, catering, technology, food, television, radio, and Internet comparison tools and portals.

Commercial communications will be personalized based on your profile, as we are not interested in sending you generic communications. This profile would be developed using factors such as (i) your Data (including your basic identification data and your browsing habits on our Platform, such as the type of Programs, Courses with Limited Places or Courses with Unlimited Places in which you enroll, etc.), or (ii) data about you that originates from third-party platforms that belong to the same advertising network as us (in the latter case, only when you have accepted the installation of cookies or other tracking devices when accessing the Platform).

If you are not registered and have subscribed to the newsletter by providing your consent, Universia may send you a personalized newsletter regarding the content you have selected (new scholarship program announcements o courses).

What is the legal basis that allows us to do this?

The legal basis for enabling this data processing is your express consent. In the event that you do not give your consent initially or, having given your consent, you revoke it in the future, this will not entail the loss of your status as a User nor will this affect your participation in the Platform".
Conducting contests, promotions, sweepstakes and other events through the Portal or through social networks.

The Controller publishes, through the Portal or through social networks and with certain regularity, contests, promotions, sweepstakes and other events so that Users can participate and benefit from the possible prizes offered.

What is the legal basis for this processing?

This processing will only take place upon acceptance of the legal terms for each promotion, draw, contest or event, and this will be the contract that legitimises the processing of data.
Statistical surveys on the functioning of the technology that supports the Service in order to make technical improvements or improvements to security, to operation and usability and commercial improvements.

The Data Controller will process all information obtained through the interaction of Users with the Portal and the Service, in order to generate metrics and aggregate information with which to assess the status and utility of the Service, correct errors, make it more secure and user-friendly, and improve it.

What is the legal basis for this processing?

The legal basis that legitimizes this data processing is the Responsible party's legitimate interest. Our interest lies in being able to use the Service usage information in an aggregate manner to understand the impact and utility of the Programs, Courses with Limited Places, Courses with Unlimited Places, and Content, as well as being able to correct and improve the Service, make it user-friendly and safe for our Users, and so it meets their actual needs. We inform Users that we have carried out a weighting analysis to assess whether we could actually carry out this treatment on the basis of our legitimate interest. Users can request this through the contact information indicated. However, we anticipate some of the main conclusions of this analysis as follows: the performance of statistical analysis represents a genuine interest for us that is entirely lawful, is proportionate because there are no less invasive measures that would allow us to pursue our interest, does not represent harm to you and, moreover, is a common practice in the sector.
Resolution of consultations by Users.Universia will process the Data to manage and administer requests for information, doubts or other queries sent by the User (registered or not registered) through the contact form, and any actions and operations that may arise from these.

Universia offers Users the possibility of a conversational assistant, based on an Artificial Intelligence system, to help them resolve their doubts or queries about the platform and its content. In addition to answering specific queries, this assistant also has the capacity to act as a search engine and content recommender available on the platform, allowing Users to find information or relevant suggestions according to their needs or interests. This system is configured through parameters, patterns, and models that help the assistant respond in an automated and agile manner, attending to the information provided by the User.

The conversational assistant is limited to answering questions or queries and recommending related content, for example, regarding Program or course calls. This conversational assistant has been designed to facilitate interaction with Users without the need to process personal data.

Universia does not process personal data or other personal information that the User may enter when interacting with the conversational assistant. In this regard, we inform you that if you enter any personal data or other information that may be considered personal and/or confidential, it will not be processed for any specific purpose.

The conversational assistant is limited to resolving the question, query, or search posed, beyond the fact that the information entered to interact with the conversational assistant may be stored as indicated in the following paragraphs.

It is important that you follow these recommendations and that under no circumstances you provide us with personal data or other information that could be considered personal and/or confidential as we warn in the notice or disclaimer that you will find when using the conversational assistant.

The conversational assistant is configured to learn from individual conversations with Users and improve its responses through the analysis of previous interactions with other Users. For this reason, Universia needs to retain Users' conversations to improve its functioning and the recommendation or response system.

These conversations will be retained for a period of 6 months from the date the User interacted with the conversational assistant and, in any case, will be deleted from our information systems once this period has expired.

What is the legal basis for this processing?

The processing of data to manage information requests, content searches, and/or the resolution of queries is carried out on the basis of the legitimate interest of Universia in properly resolving any concerns of Users and improving satisfaction with the Service, and, where applicable, in meeting any legal obligations that may be applicable in relation to customer service.

We have conducted a weighting analysis to assess whether we could effectively carry out this processing based on our legitimate interest. Users can request this from us through the indicated contact details. However, we advance some of the main conclusions of this analysis below: the resolution of doubts and queries, as well as the search and recommendation of content, represents a real interest for us that is completely lawful, is provided because there are no less invasive measures that allow us to develop our interest without processing User data lawfully, does not cause harm to you (on the contrary, it allows for smooth communication with Universia), the processing of data is not unbalanced, and, furthermore, it is a common practice in the sector.

Transfer of Data to the Local Bank* and to Banco Santander, S.A. (Spain) to enable them to contact data subjects for potential selection processes.
When Users specifically grant consent, the Data Controller will transfer the Data of Users who have given their express consent to the Local Bank to enable the latter to contact them to take part in its selection processes. Likewise, the Data will also be sent to Banco Santander, S.A. (Spain), as parent of the Group, for global recruitment processes. Thus, for example, if the User is resident in Brazil, their data will be transferred to the Local Bank in Brazil and to Banco Santander, S.A. (Spain).

The Data that would be transferred are: name, surname, country of residence, e-mail, date of birth, curriculum vitae, training or qualification data, and data related to the navigation and use of the Portal (IP address, registrations in Programs, Courses with Limited Places and Unlimited Place Courses, or favorites contents).

What is the legal basis for this processing?

The legal basis for carrying out this processing is the express consent provided by the User. If the User does not initially provide their consent, or has provided it but then revokes it in the future, they will still be considered a User and their enjoyment of the Service will not be affected. Consent also covers transfer of data that would be carried out by the Data Controller if the User resides in an "insecure country". More information on international transfers can be found in section 5 of this Privacy Policy.

*Users may consult the identity of the specific Local Bank to which Universia will transfer their Data, depending on their country of residence, by clicking here
Profiling for use in behaviour patterns to suggest products and recommendations.

When users accept the processing of personal data obtained from online identifiers, such as analytical and advertising cookies, the data controller may carry out profiling of their behaviour, in which the information generated by the users in their profile will also be taken into account.

This profiling will be performed using a tool that automatically executes an analysis of behaviour patterns to allow recommendations to be shown to users, in the Portal, on acquiring products and/or services that may better match their interests, according to the behaviour patterns. For more information, go to this link, where the details are given of the data processing that will be carried out based on this tool.

Specifically, for the realization of this activity, the Responsible will process the data obtained from observing the browsing habits of Users on the Portal, as well as from the tracking and analysis of the behavior of these Users when browsing this web environment (in particular, we will process their IP address, registrations in Programs Limited Slots and Courses with Unlimited Places, profile data, participation or favorites contents, browsing habits through cookies).

The controller will also process the following categories of data: full name, country of residence, e-mail, date of birth, curriculum vitae, training and qualifications.
With this information, the controller will analyse users' interests to determine which of our products and services best match their profile, so that we can show them, in the portal, recommendations that match their preferences.

What is the legal basis for this processing?

This processing involves acceptance of the terms and conditions of cookies consent and the automated profiling based on legitimate interest:

(i)            Consent for the use of behavioural parameters:
Universia will process the personal data obtained from the use of analytical and advertising cookies, as long as the user has given express consent for such purposes on the cookie configuration panel. For more information, see our Cookies Policy.

(ii)           Legitimate interest to carry out automated profiling:
This processing is necessary to satisfy the legitimate interests of Universia. However, users have the option to object to this processing of their personal data.

We inform you that Universia's predominant interest in carrying out this data processing is to improve the offer of content and adapt it to the user's profile, thus offering information about products that may be of interest on the portal.

In particular, Universia has an interest in its users being able to access the content that interests them more easily and for searches on the portal to be more agile and personalised, so that they can find the product they are looking for, according to its characteristics, more quickly.

In accordance with the provisions of data protection regulations, Universia has carried out the corresponding weighting analysis to confirm that the legitimate interest of the Data Controller does not harm the interests of Users. As a conclusion of these tests, we understand that the legitimate interest of the Controller presents a truly lawful interest since this activity seeks to achieve a higher level of conversion, a more personalised value offer and an improvement in the User's experience on the Portal. Therefore, we understand that this processing does not constitute an impediment to the normal exercise of the rights and freedoms of the Users, and is also standard practice in the sector.
Anonymisation of Personal Data.

We will anonymise User Data and analyse it in aggregate form with many other anonymised data to understand patterns and extract insights and intelligence on training trends, improve the security of our technology and for other purposes.

What is the legal basis for this processing?

The legal basis of this purpose is the legitimate interest of Universia in improving the security of our Service and in generating intelligence that helps us and third parties to ascertain trends in training, and in using this knowledge for other purposes. Any perceptions and lessons we obtain from the aggregate analysis of anonymous information will not affect Users directly.

We have conducted a weighting analysis to ascertain whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this analysis through the contact channels indicated. However, there follow some of the main conclusions obtained from the analyses performed: anonymisation represents a genuine interest on our part which is totally lawful, it is proportionate because there are no less invasive measures to enable us to implement our interest, it has no adverse impact on you, and it is also a habitual practice in the sector.
Fulfilment of legal obligations.

Lastly, Universia may process Data to fulfil any applicable legal obligations. For example, fulfilment of tax obligations, fulfilment of instructions received from courts of justice etc.

What is the legal basis for this processing?

The legal basis for this processing is that we need to process your Data to be able to fulfil obligations imposed by law.

4. DATA RETENTION PERIOD

The Data will be retained for as long as the contractual relationship that binds us to Users is in place, as regulated by the General Conditions of Use.

Nonetheless, for the purposes for which we have requested the consent of the User, or which the User has the option of challenging, we will stop processing your Data beforehand if the User withdraws their consent or objects to us continuing to process them, provided our legitimate interests, in the last case, no longer prevail. If the User withdraws their consent or exercises the right of erasure, their personal data will be blocked for the periods laid down in law to respond to any liability that may arise from their processing, for the formulation, the exercise and/or the defence of potential claims, provided this is permitted by applicable legislation, or in order to make the Data available to judges and courts or to the competent public authorities. During this additional period, Universia shall retain the Data of the User in blocked format. That means we will not use it for the initial purposes, but solely for those described in this paragraph and until the statute of limitations expires on any possible lawsuits that may be brought. At the end of this extra period, we undertake to stop processing all the Data.

In cases where the data subjects on particular Programmes accept the transfer of their CV data to the Local Bank and to Banco Santander, S.A., in relation to recruitment processes, the entity receiving these data shall retain them for a period of one year only. At the end of this period, the data will remain blocked for the legally established period prior to their erasure.

Additionally, for those Users who have only subscribed to the news newsletter, Universia will cease processing their Data for that purpose when the user revokes their consent or finally registers in the Portal.

5. DATA RECIPIENTS

Data concerning Users will be shared with the entities mentioned below:

Institutions, as well as their Evaluators and Judges. The Data will be provided by the Responsible Party to the Institution that has granted or has to grant the corresponding Limited Enrollment Program or Course and/or where the training takes place, as well as to their Evaluators and Judges, who are part of these Institutions or collaborate with them on their own account, solely for the purpose of enabling your participation in it. Likewise, in those Programs that include a voting system and require the publication of Users' Data on the Platform, the data will be shared with the general public, that is, with any user who visits the Platform.
Santander Group entities. Also, the Data of any Users that have previously granted consent by means of the consents set out in the User register will be sent to the Local Banks and/or to the Local Universias to enable them to send their own commercial communications and those of third parties, if the User has granted consent in accordance with point 3 of this Privacy Policy. As previously mentioned, in the case of the United Kingdom, they can only send commercial communications about their own products or services.

Users may consult the identity of the specific Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence for the purposes of commercial communications, by clicking here

Subject to consent by the User, the Data Controller will likewise send Data to the Local Banks and to Banco Santander, S.A. (Spain), to enable them to contact the User in connection with selection and recruitment processes to fill positions within Santander Group.

Users may consult the identity of the specific Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence for the purposes of HR selection processes, by clicking here

There are entities within the Santander Group that are located outside the European Union, even in territories not currently considered adequate by the European Commission. In this regard, the User is informed that the processing of data outside the European Union may entail a security risk concerning these data, which would no longer be protected by the safeguards required under European regulations in the absence of a Commission decision concerning adaptations with respect to the third country concerned. Therefore, unless otherwise specified, we will exclusively transfer the Data of Users in accordance with standard contractual clauses approved by the European Commission, and if need be these will be enhanced by additional measures. The Data Controller will not be held responsible for and cannot guarantee the security of the transferred data.
Public bodies and authorities for the performance of their duties. On occasion, applicable legislation may require information to be shared with public bodies or authorities, so that they may perform their duties. For example, tax authorities or courts of justice, who would use your Data for their own purposes.

Service providers. They are entities that help us with different matters relating to management of the Service, such as technological infrastructure, storage, or sending marketing communications or services for Users. At Universia we ensure that all of our service providers that might have access to your Data act in confidence and in compliance with applicable data protection regulations. We have signed agreements with them to regulate and restrict their use of your Data to the provision of the Service and to establish the security measures they must adopt to protect the Data. These providers never use your Data for their own purposes, but simply to help us provide you with the Service.

Some of these service providers are located or may access Data of Users outside the European Economic Area. We have therefore adopted appropriate safeguards to ensure that the Data is processed with a level of protection equivalent to that afforded in the European Economic Area. In particular, these transfers may be pursuant to the adoption of standard contractual clauses approved by the European Commission, and where required these have been enhanced by additional measures.

Users can see which specific Data are sent to the aforementioned Recipients in section 3 of this Privacy Policy.

In relation to international data transfers to territories outside the European Union that have not been considered adequate by the European Commission, Users may request additional information in relation to international transfers of Data and on the risks involved. They may likewise obtain a copy of the safeguards and protection measures to have been adopted by writing to the postal address provided in section 1.

6. RIGHTS OF DATA SUBJECTS

Users have the right to access their Data, and to request the rectification of any inaccurate data, that the processing be restricted, or request they be erased when, among other reasons, the data are no longer necessary for the purposes for which they were gathered, as well as not to be subject to automated individual decisions. In certain circumstances and for reasons relating to their own specific situation, data subjects may oppose the processing of their data. The Data Controller shall cease to process the Data, except in the event of compelling legitimate reasons, or the exercise of claims or defence of claims.

Users will also have the right to request the portability of their data where this is technically possible.

For the purposes of exercising their rights, data subjects may use the following Contact Form, or write a letter to Ciudad Grupo Santander. Avda de Cantabria s/n, Santander Universities, 28660 Boadilla del Monte, Madrid, Spain, attaching a copy of their identity document.

Data subjects have the right to lodge a complaint with the Spanish Data Protection Agency at Calle Jorge Juan 6, 28001, Madrid or its online address www.aepd.es

We wish to remind you that as a User you have the right to withdraw your consent for marketing purposes at any time by writing to the above addresses.

7. AMENDMENT TO THE PRIVACY POLICY OF END USERS

We may amend this Privacy Policy at any time, pursuant to applicable legislation, but we will inform Users with sufficient notice of any important changes that may have a significant impact on their privacy. We will also publish the amended Privacy Policy on our Portal, where Users will be able to check the date it was last updated. If necessary, depending on the nature of the amendment we make, we may ask Users to grant their consent again.

Last modification date: 15/10/2024