Data protection policy

The Blanquerna Foundation, in carrying out its activities, processes personal data in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

Who is the data controller responsible for processing personal data?

The data controller is the Blanquerna Foundation, located at Passeig de Sant Gervasi, 47, Barcelona (Postal Code 08022), with Tax ID R5800622B, phone number +34 932 53 30 00, email [email protected], registered in the Registry of Religious Entities under number 000286 (103/SE/F).

The Blanquerna Foundation is a higher education institution part of the Ramon Llull University Foundation.

What is the role of the Data Protection Officer?

The Data Protection Officer (DPO) is responsible for overseeing compliance with our data protection policy and ensuring that personal data is processed appropriately while protecting individuals' rights. Their duties include addressing any questions, suggestions, complaints, or claims from individuals whose data is processed. The DPO can be contacted in writing at our postal address, by phone, or directly via email at [email protected].

For what purposes do we process data?

The only personal data the entity will access is that voluntarily provided by the user.

We process personal data with individuals' rights in mind, always in a proportionate manner. This means we process only the data that is adequate, relevant, and limited to fulfilling the explicit purposes for which it was collected. In some cases, additional data may be requested, such as for gathering opinions or evaluations of our services. In these cases, responses are processed statistically and dissociated from the respondent’s identifying information.

Consequently, users should be aware that accessing certain services offered through the website may require providing personal data and completing mandatory forms. Failure to provide required data may prevent registration, hinder request processing, or restrict access to the aforementioned services and content, unless the form includes optional fields.

If the provided data relates to third parties, the user guarantees that they have obtained prior consent from those third parties for the disclosure of their data and have informed them, prior to providing it, of the purposes of the processing, disclosures, and other terms outlined in the data protection information section.

The Blanquerna Foundation primarily processes personal data to provide academic services, inform about activities and services, and manage commercial relationships with suppliers:

• Academic Management. The Blanquerna Foundation records the data of individuals who pre-register and subsequently enroll to document and, in accordance with this, provide higher education services. The provided data and data generated from academic activities enable monitoring and serve as the basis for evaluation. Managing students’ academic records is the most significant data processing activity. Student data is also used for administrative purposes, such as identifying users of university services, enabling access to these services, sending relevant information, processing and issuing degrees, and tracking employment outcomes. In the context of teaching activities, images and/or voices may be processed.
• Personnel Selection. We collect and store resumes from individuals interested in working with us and process personal data during personnel selection processes to assess candidates’ suitability for vacant or newly created positions. Similarly, we retain the data of non-hired candidates for a maximum of one year in case new vacancies arise. However, in the latter case, we will immediately delete the data if the person concerned asks us for it.
• Information on Activities and Services. With explicit authorization from each student, we use their contact details after graduation to send information about our services and activities. With consent, we may also send information about activities or services from other institutions with which we have collaboration agreements or group affiliations that may be of interest. Information about services and activities may also be sent to non-enrolled individuals who have requested it or provided authorization.
• Supplier Data Management. We record and process supplier data for services or goods received. This may include data from self-employed individuals or representatives of legal entities. We collect only the essential data to maintain the commercial relationship, using it solely for this purpose and in accordance with this type of relationship.
• Video Surveillance. Where applicable, signs indicate the presence of video surveillance cameras at our facility entrances. Cameras record images only in areas justified for ensuring the safety of property and individuals, and these images are used exclusively for this purpose.
• Financial Aid Service. We collect and store necessary data from students applying for financial aid to process and manage these applications. Data is retained for four years to demonstrate proper evaluation and granting or denial of the corresponding aid.
• Images. Images and/or videos obtained during activities, events, or appearing on the Blanquerna Foundation’s website or social media are processed in accordance with current data protection regulations and Organic Law 1/1982 on Civil Protection of the Right to Honor, Personal and Family Privacy, and Image. These are used for the purposes communicated at the time, such as promoting academic activities, events, or services, or for marketing campaigns. Consent for image processing authorizes the Blanquerna Foundation to capture, reproduce, and publish images (photographs, videos, or other methods, including digital) for the stated purposes, with rights to use granted free of charge and indefinitely within the Foundation’s territorial scope.
• Website Users. Our website’s navigation system and software collect data typically generated through internet protocols. This category of data includes, among other aspects, the IP address or domain name of the computer used by the person connecting to the website. This information is not associated with specific users and is used for the sole purpose of obtaining statistical information on the use of the website. Our website does not use cookies that allow the identification of specific individuals who are users of the website. Cookies are used to gather technical information to improve accessibility and efficient use of the website. Our website uses cookies that facilitate navigation and provide us with information about our users and their interests. Depending on your browser, you can access instructions for deleting cookies below.
• Other Channels. We process data to address inquiries from individuals using our website’s contact forms, social media, or blog subscriptions. We use this data solely for these purposes. By providing personal data through these channels, users expressly consent to its processing to address their service requests.
• Donations. We process personal data to manage and record donations and, where applicable, issue certificates in accordance with regulations.

- For Firefox
- For Chrome
- For Explorer
- For Safari
- For Safari (iOS)
- For Opera

How do we obtain data?

• Data Collection Channels. We obtain data through in-person interactions and other channels, such as emails and phone calls. In all cases, data is used only for the explicit purposes justifying its collection and processing.
• Most data comes directly from the data subjects, primarily through forms designed for this purpose. Significant sources include open days, informational sessions at educational institutions, and participation in fairs where we present our offerings.
• Additional data is generated through relationships with students, faculty, and service providers and incorporated into the Blanquerna Foundation’s systems.
• A smaller volume of data may come from competent public administrations in higher education or other academic institutions.

What is the legal basis for data processing?

The data processing we conduct is based on various legal grounds, depending on the nature of the processing. We classify the main data processing operations we carry out in accordance with the provisions of Article 6.1 of the General Data Protection Regulation.

• Educational Services. Once admitted, students receive educational services from the Blanquerna Foundation. This service provision to students constitutes a contractual relationship with obligations for both parties: the student’s right to quality education and the Foundation’s right and obligation to process their data. This processing is legally based on Organic Law 6/2001, of December 23, on Universities, Law 1/2003, of February 19, on Universities of Catalonia, and their implementing regulations.
• Pre-contractual Relationships. This applies to data from individuals interested in the academic offerings of the Blanquerna Foundation. For other reasons, but with similar legal basis, we process the data of potential clients, or suppliers prior to formalizing a contractual relationship, as well as data from individuals submitting resumes or participating in selection processes.
• Contractual Relationships. This includes relationships with clients and suppliers and all actions and data uses arising from these commercial relationships.
• Legal Obligations. Providing higher education services requires compliance with regulations involving data processing. In this regard, the Blanquerna Foundation shares student data with the Ramon Llull University Foundation for the recognition and issuance of the degrees corresponding to these studies. Furthermore, in compliance with legal obligations (tax regulations), we disclose data to the Tax Administration, as well as for the management and issuance of certificates in the case of donations. Similarly, and also in compliance with legal obligations, we will disclose data to judicial bodies or law enforcement agencies, if required.
• Consent. When we send information about our activities or services, we use contact details with the explicit consent of the person who will receive it. Navigation data from website visitors is also obtained with consent, which can be revoked by deleting cookies. Similarly, we use data based on consent for image processing for the purposes informed at the time, either to publicize the academic activity, events, or activities of any kind of the Blanquerna Foundation and its services, or for its marketing campaigns.
• Legitimate Interest. The images we obtain from video surveillance cameras are processed for the legitimate interest of our institution in preserving its property and facilities. Our legitimate interest also justifies the processing of the data we obtain from contact forms.

To whom is the data disclosed?

• As a general rule, we only disclose data to comply with legal obligations. In the preceding sections, we have explained the communication of data relating to our students, which is necessary to enable us to provide educational services, and to our customers and suppliers, in the course of our economic and commercial relations. Students' contact details may be communicated to other institutions within our group provided that the student has given their consent.
• International data transfers outside the EU occur for managing student international mobility and responding to job offers from non-European companies, based on student consent. In both cases, the processing is based on the student's consent.
• In other words, for certain tasks, we engage service providers (companies or individuals) with experience and expertise who may access personal data. These are considered data processors under the General Data Protection Regulation. Their confidentiality obligations are formalized at hiring and their activities are monitored. Examples include data hosting, IT support, or legal, accounting, or tax advisory services.

How long do we retain data?

• Data retention periods depend on several factors. Primarily whether the data remains necessary for the purposes for which it was collected. Secondly, data is also retained to address potential Blanquerna Foundation liabilities from processing and to respond to requests from public administrations or judicial bodies. Consequently, data must be kept for the time necessary to preserve its legal or informational value and demonstrate compliance with legal obligations, but not beyond the period required for the processing purposes (“storage limitation” under the General Data Protection Regulation).
• Data proving the education received by students is retained permanently to safeguard their rights.
• In certain cases, such as for accounting and billing data, tax regulations require retention until related responsibilities expire. Foundation regulations mandate retaining certain accounting data for ten years (in compliance with Law 10/2010, of 28 April).
• Data processed solely based on consent is retained until consent is revoked.
• Images used for the stated purpose, either to publicize the academic activity, events, or activities of any kind of the Blanquerna Foundation and its services, or for its marketing campaigns, are retained for the necessary period to fulfill those purposes or until the right to revocation is exercised, without affecting the lawfulness of prior processing. However, in this specific case, for publicly available data on the website or social media, and by virtue of the data subject's right to erasure, reasonable measures, including technical measures, are taken to delete links to such data, considering available technology and implementation costs.
• Finally, video surveillance images are retained for a maximum of one month, unless incidents justify longer retention, they will be kept for the time necessary to facilitate the actions of the security forces or judicial bodies.

Regulations governing public document retention and decisions by evaluation commissions guide decisions on data retention or deletion related to public interest services.

What rights do individuals have regarding their data?

Under the General Data Protection Regulation, individuals whose data we process have the following rights:

• Right to Know if Data is Processed: Individuals can inquire whether we process their data, regardless of prior interactions.
• Right to Information at Collection: When personal data is obtained from the data subject, they must be clearly informed of the purposes for which it will be used, who will be responsible for processing it, and key aspects of the processing.
• Right of Access: This is a very broad right that includes the right to know precisely what personal data is processed, the purpose for which it is processed, any disclosures that will be made (if applicable) to other persons, and the right to retain a copy or to know the expected retention period.
• Right to Rectification: Individuals can request correction of inaccurate data.
• Right to Erasure: In certain circumstances, individuals have the right to request the erasure of data when, among other reasons, it is no longer necessary for the purposes for which it was collected and which justified its processing.
• Right to Restriction of Processing: In certain circumstances, the right to request the restriction of data processing is also recognized. In this case, the data will cease to be processed and will only be retained for the exercise or defense of claims, in accordance with the General Data Protection Regulation.
• Right to Data Portability: Individuals can receive their data in a structured, commonly used, machine-readable, and interoperable format or request its transfer to another data controller. This right is recognized when the data subject has provided the personal data and has given their consent or when the processing is necessary for the performance of a contract. It is not recognized when the processing has a legal basis other than consent or contract.
• Right to Object: A person may invoke reasons relating to their particular situation, which will result in their data no longer being processed to the extent that it could cause them harm, except for legitimate reasons or the exercise or defense of claims.
• Right to Not Receive Information: We immediately respond to requests to stop receiving information about our activities and services when these communications are based solely on the consent of the recipient.

How can rights be exercised or defended?

The rights listed above can be exercised by submitting a request to the Blanquerna Foundation via its postal address or other contact channels provided in the header.

If the response is unsatisfactory, a complaint can be filed with the Catalan Data Protection Authority through forms or channels available at www.apd.cat.

In all cases, whether to file complaints, request clarifications, or make suggestions, individuals can contact the Data Protection Officer at [email protected].