1. Data Controller
The data controller for the processing of the interested party's data is Fundació per a la Universitat Oberta de Catalunya (hereinafter, the “UOC”). The contact details of the UOC are as follows:
Address: Avinguda del Tibidabo, 39-43, 08035, Barcelona
Email address: email@example.com
The interested party is hereby informed that the UOC Group has appointed a Data Protection Officer to deal with any issue relating to the processing of your personal data. The interested party may contact the Data Protection Officer via the following contact details:
Address: Avinguda del Tibidabo, 39-43, 08035, Barcelona
Email address: firstname.lastname@example.org
2. Purpose of the processing
The UOC informs its users that the Personal data they will provide will be processed by the UOC in accordance with the provisions of the aforementioned GDPR.
The purposes of data processing are the following:
- To carry out research development and innovation studies, works or projects in gender and science. In particular, but without limitation, the data is processed for the purpose of providing and managing the ACT services, communicating with ACT users regarding activities of the site and the ACT research project, managing the users’ accounts, putting users in contact with each other, providing notices, newsletters and other electronic communications, and for any administrative and legal / judicial purposes.
- To attend and resolve the requests or queries required through the contact form.
We do not process your personal data for any purpose other than the ones described here, except in the case of a legal obligation or a court order.
3. Personal Data
The UOC may collect the following personal data categories for the purposes of the processing:
- Identity data: includes name.
- Contact information: includes e-mail address.
4. Lawful basis
The data processing of your data carried out by the UOC as the Data Controller shall be on the following lawful basis:
- The execution of a contract with the registered user.
- Our legitimate interest in knowing our users and their preferences, thus ensuring the correct functioning of the platform. We make sure to consider and balance any possible impact on you (both positive and negative) and your rights before processing your personal data for our legitimate interests. We do not use your personal data for activities in which our interests are nullified by the impact such use has on you (unless we have your consent, or the law requires or otherwise permits). You can learn more about how we evaluate our legitimate interests in order to avoid any potential impact on you, with respect to specific activities, by making any queries you deem appropriate in the following email account email@example.com.
- Complying with a legal or regulatory obligation means processing your personal data when necessary to comply with a legal or regulatory obligation to which we are subject.
- Express informed consent, particularly for the sending newsletters.
The UOC, as the Data Controller, may transfer your personal data to its third party suppliers located outside the European Economic Area, always guaranteeing the adequate levels of protection required by European legislation. Your data may also be transferred if necessary to comply with a legal obligation to judges and courts that request it through the courts or in the framework of a police investigation.
6. Data Retention
The UOC will only retain your personal data for as long as is necessary to fulfil the purposes for which have been collected, including complying with legal, or reporting requirements. In determining the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we treat your personal data, whether we can achieve those purposes through other means and the applicable legal requirements.
You have some rights under the General Data Protection Regulation in relation to your personal data. Specifically, you have the right to:
- Request access to your personal data (commonly known as "data subject request "). This allows you to receive a copy of the personal data we have about you and verify that we are processing them legally.
- Request the correction of the personal data we have about you. This allows you to correct any incomplete or inaccurate information we have about you, although we may have to verify the accuracy of the new data you provide us.
- Request the deletion (cancellation) of your personal data. This allows you to ask us to delete your personal data when there is no good reason for us to continue processing them. You also have the right to ask us to delete your personal data when you have successfully exercised your right to object to the treatment (see below), when we may have processed your information illegally or when we must delete your personal data in compliance with local law. However, please note that we may not always be able to comply with your request for removal for specific legal reasons that will be notified, if applicable, at the time of your request.
- Objecting to the processing of your personal data when we have a legitimate interest (or a third party has) and there is something about your particular situation that makes you want to oppose the processing, or it has an impact on your rights and fundamental freedoms. You also have the right to object when we process your personal information for direct marketing purposes. In some cases, we can show that we have legitimate interests to deal with your information that prevails over your rights and freedoms.
- Request the restriction of the processing of your personal data. This allows you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the accuracy of the data; (b) when our use of the data is illegal but you do not want us to delete it; (c) when you need us to retain the data, even if we no longer need it to exercise or defend legal claims; or (d) you have opposed our use of your data, but we must verify if we have legitimate reasons to use them.
- Request the transfer of your personal data to you or a third party. We will provide you, or a third party that has chosen, your personal data in a structured, commonly used and readable format. Please note that this right only applies to the automated information that you authorized us with consent to use, as well as the information necessary to enter into any contract with you.
- Withdraw consent at any time that we depend on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
To exercise these rights interested parties can contact us via email at firstname.lastname@example.org or also are entitled to submit a claim to the controlling authority if they consider that their data protection rights have been violated (http://apdcat.gencat.cat/en/inici/index.html).
Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the varying risks of probability and seriousness to the rights and freedoms of natural persons, UOC shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, to prevent the accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or the unauthorised communication of or access to such data.