Privacy Policy
This document explains the data protection policy of the Fundació Universitària del Bages, holder of higher education centers federated to the University of Vic – Central University of Catalonia. It is based on the principles of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (General Data Protection Regulation). We fully embrace the spirit of this European Regulation because it strengthens rights and provides more guarantees to individuals regarding the processing of their data, an objective that fully aligns with our commitment to the continuous improvement of our educational services. Below, we summarize the key aspects of our data protection policy.
Who is responsible for the processing of personal data?
What is the role of the Data Protection Officer?
For what purposes do we process the data?
How do we obtain the data?
What is the legal basis for the processing of the data?
To whom are the data communicated?
How long do we retain the data?
What rights do individuals have regarding the data we process?
How can rights be exercised or defended?
Specific data protection policies
Who is responsible for the processing of personal data?
The data controller is the Fundació Universitària del Bages, located at Avinguda Universitària, 4 – 6, Manresa (CP – 08242), CIF G-59330795, tel. 938 774 179, email address umanresa@umanresa.cat, registered in the Register of Foundations of the Generalitat de Catalunya with number 286.
The Foundation offers educational services under the brand UManresa.
The Fundació Universitària del Bages owns the University Clinic, a teaching-assistance facility used by students of various Health Sciences degrees at UManresa, as well as by continuing education, postgraduate, and master’s students.
What is the role of the Data Protection Officer?
The Data Protection Officer (DPO) is the person who supervises compliance with our data protection policy, ensuring that data is processed appropriately and that individuals’ rights are protected. Among their functions is to address any questions, suggestions, complaints, or claims from individuals whose data is being processed. The Data Protection Officer can be contacted by writing to our postal address and phone number or directly via email at dpd@umanresa.cat.
For what purposes do we process the data?
We process personal data with a constant focus on individuals’ rights and always in a proportional manner. This means that we process, in each case, the data that is adequate, relevant, and limited to the fulfillment of the explicit purposes that motivated its collection; only the data necessary to enable the provision of the educational services that are our mission. In some cases, more data is requested, for example, to know opinions or evaluations of our services. In such cases, the responses are processed statistically and dissociated from the identifying data of the respondent.
The Fundació Universitària del Bages processes personal data mainly to provide academic and extracurricular services, to send communications related to our activities and services, and to develop commercial relationships with our suppliers. Below, we enumerate the main purposes.
Academic management. The Fundació Universitària del Bages records the data of individuals who pre-register and subsequently formalize their enrollment, in order to keep a record and, based on this, provide higher education services. The data provided and the data resulting from academic activity allow for monitoring and serve as a basis for evaluation. The management of the student’s academic record is the most relevant data processing. The students’ data is also used for administrative management purposes, to identify them as users of the University’s services, to enable access to these services, to send information of interest, to process and issue degrees, and finally, to monitor job placement.
Contact. We process data to address inquiries from individuals who use the contact forms on our website. The data is used solely for this purpose.
Personnel selection. We collect and store the resumes sent to us by individuals interested in working with us and also process personal data in the development of personnel selection processes, with the aim of analyzing the suitability of candidates’ profiles based on vacant or newly created positions. Our criterion is to retain the data of individuals who are not hired for a maximum period of one year, in case a new vacancy or new job position arises in the short term. However, in this latter case, we immediately delete the data if the interested person requests it.
Information on activities and services. With the explicit authorization of each student, once their studies are completed, we use their contact data to send information about our services and activities. Also, with their authorization, we send them information about activities or services from other institutions in our group. This information is also sent to those who, even if they have not enrolled at the Fundació Universitària del Bages, request it.
Management of our suppliers’ data. We record and process the data of suppliers from whom we obtain services or goods. This may include data of individuals acting as freelancers and data of representatives of legal entities. We obtain the essential data to maintain the commercial relationship, use it solely for this purpose, and make the appropriate use of this type of relationship.
Video surveillance. At the entrance to our facilities, information is provided, when applicable, about the existence of video surveillance cameras through approved signs. The cameras record images only of the areas where it is justified to ensure the security of property and individuals, and the images are used solely for this purpose.
Users of our website. The navigation system and software that enable the operation of our website collect data that is ordinarily generated in the use of Internet protocols. This category of data includes, among others, the IP address or domain name of the computer used by the person connecting to the website. This information is not associated with specific users and is used solely to obtain statistical information about the use of the website. Our website uses cookies that facilitate navigation and provide us with information about our users and their interests (more information about the cookie policy).
Other data collection channels. We also obtain data through face-to-face relationships and other channels such as receiving emails, registering those who download our app, participating in our blogs with comments, subscribing to the blog, or through our profiles on social networks. In all cases, the data is used only for the explicit purposes that justify its collection and processing.
How do we obtain the data?
In the previous section, we referred to some of the sources of the data we process. In most cases, the data comes directly from the individuals concerned, and we obtain it mainly through the forms prepared for this purpose. We also obtain data during open house events, informational sessions held at educational centers, and through participation in fairs where we present our offerings.
In the development of the relationship with students, teachers, and service providers, other data is generated and incorporated into the systems of the Fundació Universitària del Bages.
A smaller volume of data may come from public administrations competent in higher education or other academic institutions.
What is the legal basis for the processing of the data?
The data processing we carry out has different legal bases, depending on the nature of each processing. We classify the main data processing we perform according to the legal bases of Article 6.1 of the General Data Protection Regulation.
For the provision of educational services. Once admitted, our students receive educational services from the Fundació Universitària del Bages. The provision of services to the student constitutes a contractual relationship, with obligations from each party, the student’s right to receive a good education, and the right and obligation of the Fundació Universitària del Bages to process their data. This processing has its legal basis in Organic Law 6/2001, of December 23, on universities, in Law 1/2003, of February 19, on universities of Catalonia, and in its development regulations.
In compliance with a pre-contractual relationship. This is the case for data from individuals interested in the educational offerings of the Fundació Universitària del Bages. For other reasons but with similar legitimacy, we process data from potential clients or suppliers with whom we have relationships prior to the formalization of a contractual relationship. It is also the case for the processing of data from individuals who have sent us their resumes or who participate in selection processes.
In compliance with a contractual relationship. This is the case for relationships with our clients and suppliers and all actions and uses of the data that these commercial relationships entail.
In compliance with legal obligations. The provision of higher education services requires us to comply with various regulations that involve data processing. In this regard, the Fundació Universitària del Bages communicates data from its students to the Fundació Universitària Balmes for the procedures of recognition and issuance of the corresponding degrees for the studies provided. It is also in compliance with legal obligations (tax regulations) that we communicate data to the tax administration. It would also be in compliance with legal obligations that we would communicate data to judicial bodies or law enforcement agencies if required.
Based on consent. When we send information about our activities or services, we use contact data with the explicit consent of the person who will receive it. It is also based on consent that we obtain navigation data from the person visiting our website, consent that can be revoked at any time by uninstalling the cookies.
For legitimate interest. The images we obtain with surveillance cameras are processed for the legitimate interest of our institution to preserve its property and facilities. Our legitimate interest also justifies the processing of data obtained from contact forms, as well as from individuals who register to comment on blogs or install our app.
To whom are the data communicated?
As a general criterion, we only communicate data in compliance with legal obligations. In the previous sections, we have explained the data communications of our students, necessary to enable the provision of educational services, and of our clients and suppliers, in the development of economic and commercial relationships. The contact data of students may be communicated to other institutions within our group, provided the student has authorized it.
Data transfers outside the European Union (international transfer) are carried out for the management of students’ international mobility and to respond to job offers from non-European companies. In both cases, the processing is based on the student’s consent.
In another sense, for certain tasks, we obtain the services of companies or individuals who provide their expertise and specialization, which sometimes require access to personal data. In the terms of the General Data Protection Regulation, this is not strictly a data transfer but a processing assignment. Services are only contracted from companies that guarantee compliance with this regulation. At the time of contracting, their confidentiality obligations are formalized, and their performance is monitored. This may include data hosting services on servers, IT support services, or legal, accounting, or tax advisory services. Detailed information on the identity of these companies can be obtained by contacting cgti@umanresa.cat.
How long do we retain the data?
The retention period of the data is determined by various factors. Primarily, data is retained as long as it remains necessary to fulfill the purposes for which it was collected in each case. Secondly, data is retained to address potential liabilities for data processing by the Fundació Universitària del Bages and to respond to any requests from public administrations or judicial bodies.
Consequently, data must be retained for the time necessary to preserve its legal or informational value and to demonstrate compliance with legal obligations, but not for a period longer than necessary for the purposes of the processing (“limitation of retention period” requirement of the General Data Protection Regulation). In the case of information that certifies the education received by students, data is retained permanently to preserve the rights of these students.
In certain cases, such as data included in accounting documentation and invoicing, tax regulations require retention until the liabilities in this matter expire. The regulatory framework for foundations specifies that some accounting data must be retained for ten years (compliance with Law 10/2010, of April 28).
In the case of data processed solely based on the consent of the interested person, it is retained until this person revokes their consent.
Finally, in the case of images obtained by surveillance cameras, they are retained for a maximum of one month, although in the case of incidents that justify it, they are retained for the necessary time to facilitate actions by law enforcement agencies or judicial bodies.
The regulatory framework for the retention of public documentation and the opinions of qualifying commissions are a determining reference when deciding the retention or deletion of data related to the exercise of public interest services.
What rights do individuals have regarding the data we process?
As provided by the General Data Protection Regulation, individuals whose data we process have the following rights:
To know if their data is being processed. Any person has the right to know if their data is being processed, regardless of whether there has been a prior relationship.
To be informed at the time of collection. When personal data is obtained from the individual concerned, they must be clearly informed of the purposes for which the data will be used, who will be responsible for the processing, and the main aspects derived from this processing.
To access their data. A very broad right that includes knowing precisely what personal data is being processed, the purpose for which it is processed, any communications to other parties (if applicable), the right to obtain a copy, or to know the expected retention period.
To request rectification. The right to request the correction of inaccurate data being processed by us.
To request deletion. In certain circumstances, there is the right to request the deletion of data when, among other reasons, it is no longer necessary for the purposes for which it was collected and justified the processing.
To request the limitation of processing. Also, in certain circumstances, the right to request the limitation of data processing is recognized. In this case, the data will no longer be processed and will only be retained for the exercise or defense of claims, in accordance with the General Data Protection Regulation.
To data portability. In cases provided by the regulation, the right to obtain one’s personal data in a structured, commonly used, machine-readable format, and to transmit it to another data controller if the individual so decides.
To object to processing. An individual may cite reasons related to their particular situation, which will result in their data no longer being processed to the extent that it may cause them harm, except for legitimate reasons or the exercise or defense against claims.
To not receive information. We immediately address requests to stop receiving information about our activities and services when these communications were based solely on the consent of the recipient.
How can rights be exercised or defended?
The rights listed above can be exercised by submitting a request to the Fundació Universitària del Bages at the postal address or other contact details indicated in the header.
If a satisfactory response has not been obtained in the exercise of rights, it is possible to file a complaint with the Catalan Data Protection Authority, through forms or other channels accessible from their website (www.apd.cat).
In all cases, whether to file complaints, request clarifications, or make suggestions, it is possible to contact the Data Protection Officer via email at dpd@umanresa.cat.
Specific data protection policies
Enrollment process
Information sending
Cookies policy
Management of the University Clinic