This Privacy Policy has been developed taking into account the provisions of the current regulations on data protection: the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the movement of such data, (hereinafter RGPD); and the Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter LOPDyGDD).
The purpose of this Privacy Policy is to inform the owners of the data of the specific aspects related to the processing of the same, in compliance with the principle of transparency and the duty of information, regulated both in Article 13 of the RGPD and Article 11 of the LOPDyGDD.
Responsible for the treatment: INSTITUTO TECNOLÓGICO DE ARAGÓN
VAT number: Q5095008H
Address: Calle María de Luna 7-8, 50018 Zaragoza, Spain.
DPO contact information: dpo@itainnova.es
By virtue of the relationship established with ITAINNOVA, the storage of your data, the treatment we carry out on them and the purpose pursued varies. In this sense, there are different categories of stakeholders: customers, suppliers, students, candidates and contacts.
The following are the purposes of processing and their legitimacy for each of the processing carried out:
| Purpose of treatment | Legitimacy of the treatment | |
| PROCESSING OF CUSTOMER DATA | Management of clients and invoicing; management of sales and collections; conclusion of contracts, agreements and preparation of budgets; development of projects or provision of services; obtaining sales statistics and commercial history; storage of data required by tax and commercial regulations and data pertaining to the commercial relationship. | Processing necessary for the performance of a contract to which the data subject is a party (Article 6.1.b of the GDPR), and satisfaction of legitimate interests in the processing of data of contact persons (Article 6.1.f of the GDPR, in conjunction with Article 19 of the LOPDyGDD). |
| Sending information about our services and activities and invite you to conferences and / or events promoted or participated by ITAINNOVA. | Consent expressly requested (Article 6.1.a of the RGPD, in relation to Article 6 of the LOPDyGDD). |
| Purpose of treatment | Legitimacy of the treatment | |
| SUPPLIER DATA PROCESSING | to carry out the management of purchases, payments and suppliers; and to obtain the history of commercial relations. | Processing necessary for the performance of a contract to which the data subject is a party (Article 6.1.b) of the GDPR) and satisfaction of legitimate interests in the processing of data of contact persons (Article 6.1.f of the GDPR, in conjunction with Article 19 of the LOPDyGDD). |
| Purpose of treatment | Legitimacy of the treatment | |
| PROCESSING OF STUDENT DATA | Manage the course in which you may participate (pre-registration, enrollment, development, invoicing, etc.). | Unequivocal consent of the data subject when registering for the course once the purposes of processing are known (Article 6.1.a of the RGPD, in relation to Article 19 of the LOPDyGDD). |
| Send you information (including by electronic means: mailing and SMS) about other courses, activities and events promoted or participated by the Instituto Tecnológico de Aragón, whenever they may be of interest to you. | Consent expressly requested (Article 6.1.a of the RGPD, in relation to Article 19 of the LOPDyGDD). | |
| Capture of images of the course and treatment and use of the image for the edition and publication of corporate documents and any other kind of document or promotional support of ITAINNOVA, whether written or electronic (including the corporate website and the profiles that ITAINNOVA has in social networks), which will be disseminated among ITAINNOVA’s own employees, its clients and suppliers, third party collaborators of ITAINNOVA, local, regional, national or international Public Administrations, as well as the general public. | Legitimate interest of ITAINNOVA (Article 6.1.f of the GDPR) after weighing the interests and rights of data subjects, and the measures adopted to comply with the obligations in terms of proportionality and transparency, and concludes that: 1.- the impact on public rights and freedoms is reduced; 2.- such processing can be reasonably foreseen by the data subject; 3.- the processing of data for the above purposes does not give rise to exclusion, discrimination, defamation, or situations that jeopardize the reputation of the data subject. |
| Purpose of treatment | Legitimacy of the treatment | |
| PROCESSING OF APPLICANT DATA | To manage the selection processes carried out in the Institute, respecting the principles of publicity, merit and competition. | Unambiguous consent of the data subject when sending their data once the purposes of processing are known (Article 6.1.a of the RGPD, in relation to Article 19 of the LOPDyGDD). |
| Communication of CVs to other companies related to ITAINNOVA for the sole purpose of being able to participate in the selection processes it deems appropriate. | Consent expressly requested (Article 6.1.a of the RGPD, in relation to Article 19 of the LOPDyGDD). |
| Purpose of treatment | Legitimacy of the treatment | |
| CONTACT DATA PROCESSING | To be able to contact people of interest for the development of the entity’s activity. | Legitimate interest of ITAINNOVA (Article 6.1.f of the RGPD, in relation to Article 19 of the LOPDyGDD) which has weighed the interests and rights of the data subjects, and the measures adopted by the responsible party to comply with its general obligations in terms of proportionality and transparency, and has concluded that: 1.- the impact on the fundamental rights and public liberties of individuals is reduced; 2.- such processing can be reasonably foreseen by the data subject; 3.- the processing of data for the above purposes does not give rise to exclusion, discrimination, defamation, or situations that jeopardize the reputation of the data subject and/or bargaining power. |
| Sending information about our services and activities and invite you to conferences and / or events promoted or participated by ITAINNOVA. | Consent expressly requested (Article 6.1.a of the RGPD, in relation to Article 19 of the LOPDyGDD). |
| Purpose of treatment | Legitimacy of the treatment | |
| IMAGE PROCESSING OF THE ACTIVITIES CARRIED OUT AT ITAINNOVA | Capture of images of any activity that takes place in ITAINNOVA and treatment and use of the image for the edition and publication of corporate documents and any other kind of document or promotional support of ITAINNOVA, whether written or electronic (including the corporate website and the profiles that ITAINNOVA has in social networks), which will be disseminated among ITAINNOVA’s own employees, its clients and suppliers, third party collaborators of ITAINNOVA, local, regional, national or international Public Administrations, as well as the general public. | Legitimate interest of ITAINNOVA (Article 6.1.f of the RGPD, in relation to Article 19 of the LOPDyGDD) which has weighed the interests and rights of the data subjects, and the measures adopted by the responsible party to comply with its general obligations in terms of proportionality and transparency, and has concluded that: 1.- the impact on the fundamental rights and public liberties of individuals is reduced; 2.- such processing can be reasonably foreseen by the data subject; 3.- such treatment is protected by the freedom of information 4.- the processing of data for the above purposes does not give rise to exclusion, discrimination, defamation, or situations that jeopardize the reputation of the data subject and/or bargaining power. |
| Purpose of treatment | Legitimacy of the treatment | |
| PROCESSING OF DATA FOR THE CONCLUSION OF AGREEMENTS AND/OR ARRANGEMENTS | Subscription with any public and/or private entity of collaboration agreements or agreements that may be necessary for the fulfillment of the purposes and functions that legally correspond to ITAINNOVA in accordance with its regulatory law, and which are made possible by article 31 of the Statutes of the Instituto Tecnológico de Aragón. Manage the development of the agreement and carry out the tasks and purposes related to it: administrative, dissemination, external publication and justification. | Treatment necessary for the execution of the Agreement of collaboration or AgreementThe data subject is a party (Article 6.1.b) of the GDPR) and satisfaction of legitimate interests in the processing of data of contact persons (Article 6.1.f) of the GDPR, in connection with Article 19 of the LOPDyGDD). |
| Purpose of treatment | Legitimacy of the treatment | |
| PROCESSING OF DATA COLLECTED THROUGH FORMS | To be able to contact people of interest for the development of the entity’s activity. | Legitimate interest of ITAINNOVA (Article 6.1.f of the GDPR) which has weighed the interests and rights of the data subjects, and the measures adopted by the responsible party to comply with its general obligations in terms of proportionality and transparency, and has concluded that: 1.- the impact on the fundamental rights and public liberties of individuals is reduced; 2.- such processing can be reasonably foreseen by the data subject; 3.- the processing of data for the above purposes does not give rise to exclusion, discrimination, defamation, or situations that jeopardize the reputation of the data subject and/or bargaining power. |
| Sending information about our services and activities and invite you to conferences and / or events promoted or participated by ITAINNOVA. | Consent expressly requested (Article 6.1.a of the GDPR) | |
| Tracking of your activity on the website to provide information and advertising services of interest to the user. Developing a user profile based on the motorization of your web activity to better understand your preferences and interests, predict your browsing behavior and tailor our marketing communications to your profile. Under no circumstances will automated decisions be made on the basis of such a profile. | Consent expressly requested (Article 6.1.a of the GDPR) |
| Purpose of treatment | Legitimacy of the treatment | |
| DATA PROCESSING INFORMATION CHANNEL-COMPLAINTS. | To collect all those communications on actions or omissions that could constitute a serious or very serious criminal or administrative offence, that infringe European Union law when they affect the matters indicated in Annex I of Directive (EU) 2019/1937, or affect the financial interests of the Union or affect the internal market and/or are contrary to the internal rules of the Entity. The Channel will collect anonymously for the Instituto Tecnológico de Aragón the contact details guaranteeing the confidentiality of the data of the person filing the complaint, keeping them anonymous unless their identification is a necessary and proportionate obligation imposed by EU or national law in the context of an investigation carried out by national authorities or in the context of a judicial process, in which case it must be communicated to the competent authorities in the matter, or else, in which case, the procedure may not be anonymous in any case, although it is guaranteed that the information and documentation that has been the subject of complaint, communication and consultation through this means will be kept confidential and that the personal data of the persons involved will be treated in accordance with the provisions of the applicable regulations on data protection. | Compliance with a legal obligation (Article 6.1.c) of the RGPD) contained in Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption. Legitimate interest of ITAINNOVA (Article 6.1.f) of the RGPD) in avoiding conduct that may entail liability for the Entity. |
Regarding the processing whose legitimate basis is consent, we inform you that you can withdraw your consent at any time.
Data retention time: The data will be kept for the years necessary to comply with the legal obligations arising from the processing, such as the need for justification of competitive public funding projects, and the justification of destination of public Funds received (ERDF, ESF, etc.).
In the case of data collected through the information-complaints channel: Data will be retained within the system for a period of 3 months. Once this period has elapsed, they will be destroyed and may remain blocked when necessary to demonstrate the operation of the internal information system itself. It shall be mandatory to keep, outside the System tool, all those documents or files that may serve as evidentiary support of the conduct (action or omission) or facts object of the communication as long as there is a legal obligation or may be required by the body in charge of the investigation of the reported facts, and in any case, when an investigation is initiated by an administrative, judicial or similar body or body with investigative functions.
AddresseesThe data will not be communicated to any third party unless there is a legal obligation to do so, in the case of public bodies that require it for the purposes of intervention, audits, certifications, etc. or in the cases of entities with which we have a relationship and under contracts of data processors concluded with them.
International data transfersActiveCampaign: For sending information about services and activities, invitations to conferences and events and monitoring your activity on the website, creating a profile to understand your interests and preferences, we use the ActiveCampaign tool, whose servers are hosted in the USA. This involves an international transfer of data.
In this regard, Active Campaign provides adequate safeguards and data subjects have effective legal rights and remedies, as it is included in the “Data Privacy Framework List” (https://www.dataprivacyframework.gov/s/participant-search) and, according to the European Data Protection Committee (https://edpb.europa.eu/system/files/2023-07/edpb_informationnoteadequacydecisionus_en.pdf) transfers to organizations
of the U.S. on the said List shall be deemed to fall within the scope of Article 45.
of the GDPR.
Your rights: You have the right to access, rectification, opposition, deletion, portability and limitation of processing of your personal data, which you can exercise by contacting the data controller, INSTITUTO TECNOLÓGICO DE ARAGÓN at Calle María de Luna 7-8, 50018 Zaragoza or at lopd-ita@itainnova.es.
You also have the possibility to file a complaint with the Spanish Data Protection Agency in the event that you consider that the processing of your data is not being adequate.
