Privacy policy

Universia Holding, S.L (hereinafter, "Universia" or the "Data Controller") informs users (hereinafter, "Users" or in singular "User"), about its personal data protection policy, which details the data processing carried out on the portal accessible through the domain https://www.santanderopenacademy.com (hereinafter, the "Portal").

The Portal is a space created by Universia that brings together Users and universities or other educational institutions or entities that adhere to the Portal (hereinafter, "Institutions") and that publish scholarship programmes, events or courses with limited places. Scholarship programmes consist of the granting of financial aid to pay all or part of the expenses that Users have to bear when studying a course, carrying out a research project or participating in a project, among other content (hereinafter, the "Programmes"). On the other hand, the events consist of face-to-face, virtual or hybrid activities related to training, employability, professional development or other subjects of interest to Users (hereinafter, the "Events"). On the other hand, the courses with limited places consist of the granting of free places for participation in courses whose main subjects may be languages, skills, technology, sustainability, among others (hereinafter, the "Courses with Limited Places"). In addition to these Courses with Limited Places, Universia offers Users a free catalogue of training courses with unlimited places ("Courses with Unlimited Places") aimed at strengthening the Users' skills and completing their training. Finally, Users can also access content offered by Universia itself aimed at facilitating learning and strengthening their skills (hereinafter, the "Content"). The Courses with Unlimited Places and the Content are intended to enable Users to access better opportunities for academic and professional development. All the above functionalities together make up the "Service". You can consult more details about the Service in the General Terms and Conditions of Use.

The Portal is international in nature, and Users and Institutions located outside and within the European Union may register and/or collaborate in its activity.

In addition, registration on the Portal can be done directly through the corresponding registration form; through the Campus platform, which is a space available to some university applications to facilitate the entry of users into our services, or from the Employment service. Both the Employment service and the Campus platform are the responsibility of Universia. Likewise, for Users who are customers of Banco Santander, S.A. (Spain), registration on the Portal can be done from the registration form of the app that this entity makes available to its private customers (hereinafter, "Santander App").

Basically, Users, who may be students, teachers, collaborators, etc., can use the Portal to review, register, manage or coordinate Programs, Events or evaluate which Programs, Events, courses or content may be useful to them in their training process.

In addition to the Institutions, Limited Space Programmes, Events or Courses may have been funded by third parties (the "Promoters"), with whom the Institution may jointly manage the Limited Place-Limited Programme, Event or Course or allow access to details about it, because they have funded such Limited Programme, Event or Course.

This Privacy Policy details the purposes for which we process Users' personal data, the reasons why the processing is lawful, the periods of time for which we keep the data, the entities with which it is shared, the rights they can assert and other issues that we consider relevant so that Users are clear about what we are going to do with their data when they use the Service.

When we talk about "personal data", we mean any information related to Users that they provide us directly, that they have generated when using our Service or that we have inferred about them, provided that they are happy for us to analyze their profile (hereinafter, the "Data"). Specially protected data or information considered "sensitive" will not be processed.

Universia informs Users that the processing of Data carried out by the Institutions or Promoters for the processing of the Programmes, Events or Courses with Limited Places published on the Portal will be subject to its own privacy policies. Therefore, this Privacy Policy is limited to informing Users about the processing carried out by Universia, including the processing related to the content offered directly by Universia itself.

Users should only provide in each case the data marked with an asterisk or indicated as mandatory, as they are considered necessary to enjoy the Service. In this sense, Users may provide this data directly by completing the registration form, either by entering the data manually or through one of the authentication systems or third-party social connectors available, or if Users only want to subscribe to the news newsletter, providing the email address in the available section without the need to register on the Portal. Likewise, when the User is registered, additional data may be requested in some functionalities, for example, to register for a scholarship, event or course, academic and/or employment data may be requested.

This Privacy Policy will remain accessible for consultation in the footer of the web version of the Portal.

1. DATA CONTROLLER

Identity of the Data Controller:

Universia Holding, S.L

Entity registered in the Mercantile Registry of Madrid in 2005, Volume 16547, Folio 107, Page number M-28189, Registration: 4th and with CIF: B82976515. (Hereinafter, the "Responsible Party").

Contact details of the Data Controller:

Postal address: Ciudad Grupo Santander. Avda de Cantabria s/n, 28660 Boadilla del Monte (Madrid)

Contact form for privacy purposes: Contact form

Contact Data Protection Officer: [email protected]

2. DATA WE PROCESS AND WHERE IT COMES FROM

On the Portal we process the Data provided to us by Users, both in the registration process and subsequently when using our Service, registering for Programmes, Events, Courses with Limited Places, Courses with Unlimited Places, accessing the Content or simply browsing the Portal.

User Data may be collected in the registration process directly, if the User has provided this information to Universia by completing the registration form, or by using the authentication systems or third-party social connectors offered on the Portal. In this case, the provider of the corresponding authentication system or social connector will provide Universia with the Data that the User authorises, which will be displayed on the screen before completing the delivery. The User will also be able to consult the permissions granted on the platform of the third party whose social connector they use. If the Data received in this way is insufficient, i.e. if any of the Data marked with an asterisk has not been delivered, Universia will ask the User to provide it in order to complete the registration on the Portal and access the Service. Users are informed that the Data received from these third parties will be incorporated into Universia's own database and will be used not only for registration or access to the Portal, but also for other relevant purposes in accordance with the provisions of section 3 of this Privacy Policy.

In some cases, we may obtain the User's registration process data from other sources or services provided by Universia or with which Universia is related, such as, for example, Banco Santander, S.A. (Spain) for Users who are customers of that company and use the Santander App. For example, if the User wishes to use auto-fill features of the registration forms, Universia may obtain the necessary data from the account that the user has created in another service provided by Universia (e.g. Employment service), from a service related in another way, such as the Campus platform or the Santander App. Please refer to the specific section on auto-completion for more details.

In particular, we obtain the following data: (i) on the one hand, data provided directly by the User such as name, surname, country of residence, e-mail, date of birth, when necessary for unambiguous identification, official identification number according to the jurisdiction (DNI, NIF, NIE, etc.), curriculum vitae, training or qualifications ("Form Data"); and, (ii) on the other hand, data relating to browsing and use of the Portal such as IP address, device information, registrations for Programmes, Events, Courses with Limited Places and Courses with Unlimited Places, profile data or content ("Browsing Data").

Finally, we inform Users that we obtain information on browsing habits through cookies. For more information on this matter, we recommend Users to consult our Cookies Policy.

3. PURPOSES AND LEGITIMACY OF THE PROCESSING

Management of the User's registration on the Portal and enjoyment of the Service.

The Data Controller will process the Data of Users who register through the corresponding form to manage their registration on the Portal and who can identify themselves. Likewise, Universia will process the Data for all the processing that is necessary to allow the use of all the functionalities of the Service that the User uses, such as registration for the Programmes, Events, Courses with Limited Places and Courses with Unlimited Places or the Content offered on the Portal or the sending of notifications about the Service itself, if the User so wishes.

Among the rest of the processing necessary for the provision of the service, when required by the nature of the Course or Event (whether Limited or Unlimited Places), the Responsible Party and/or the corresponding Institution will use the personal data of the Users to certify their attendance or participation in it whenever possible, being necessary to evidence the training in front of third parties. For the certification, the User's Form Data and their attendance or participation in the Course or Event will be processed.

Likewise, the User may, on a voluntary basis, register in directory services in order to publish a public file with basic data (e.g., name and surname, link to LinkedIn and, where appropriate, photograph) and manage its registration, modification or deletion from said directory at any time. The legal basis for this functionality is the execution of the contract (provision of the Service).

What is the legal basis that legitimises this processing?

The legal basis that allows this processing to be carried out is the execution of a contract that materialises with the acceptance of the General Conditions of Use.

Prevention of fraud in Programs, Events and Courses.

When required by the nature of the Program, Event or Course (whether Limited or Unlimited Places), the Data Controller may use the Users' personal data to prevent fraud in the application, registration, attendance or participation in them. To this end, the Data Controller will use technical and organizational measures to verify the operation of the Programs, Events or Courses and identify conduct that could be considered fraudulent (e.g., multiple registrations; identity theft in registration, application or participation).

For the verification and prevention of fraud, data such as the Form Data and the necessary Navigation Data of the User will be processed, as well as their attendance or participation in the Program, Event or Course.

What is the legal basis that legitimises this processing?

This processing is carried out based on the legitimate interest of Universia and the Institutions in preventing fraud in the Programmes, Events and Courses to which it offers access. Fraud prevention is necessary to maintain the quality and value of the Programmes and Courses, so it is of benefit to the Users themselves.

We have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. Users can request it from us through the contact details indicated. However, we advance some of the main conclusions of this analysis below: fraud prevention represents a real interest, both for us and for the Institutions and the rest of the Users, which is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest without processing the Users' data in a lawful way, it does not represent damage to the User (on the contrary, it allows us to guarantee the quality and value of the Programs, Events and Courses in which they participate), the processing of data is not unbalanced, and, in addition, it is a common practice in the sector.

Auto-completion of information in the User registration process.

When requested, the Data Controller may process the Users' Data in order to fill in some of the data requested during the registration process, i.e. account creation and registration as a User. The purpose of the processing is to facilitate the User's registration in the services offered by the Data Controller, in those cases in which the Data Controller already has the relevant information. The User may modify any data in the registration forms that is filled in advance, before sending it to the Data Controller for the creation of the user account. The data processed will only be those indicated in the registration form of the Portal. Depending on the context in which the User's registration process is carried out, the Data Controller may obtain the data from a different source:

Registration from the "Campus" platform.

When the User registers for the Service through the "Campus" platform, specifically through the "Espacio Santander" section managed by the Data Controller, the Data Controller will obtain the account details that the User has previously created when registering in the "Campus" application. This section of "Espacio Santander" is also the responsibility of Universia, as is this Portal.

Registration from the Employment Service.

When the User registers for the Service through any other channel offered by the Controller, the Controller will obtain the account data that the User has previously created in another service offered by the Controller (e.g. Employment, see its specific privacy policy here).

Registration from the Santander App of Banco Santander, S.A. (Spain)

When the User who is a customer of Banco Santander, S.A. (Spain) registers for the Service through the Santander App, Universia will obtain the data directly from that User's account in the app (see the specific privacy policy of the Santander App).

There is no transfer or communication of personal data either in the registration from the Campus platform or in the registration from the Employment service because the processing of personal data from the services involved is the responsibility of the same entity, i.e. the Data Controller. However, in cases where the User registers from the Santander App, it will be necessary for Banco Santander, S.A. (Spain) to communicate the personal data (name, country of residence, date of birth and email) so that the Data Controller can manage the User's registration and access to the Portal.

Universia will always request the consent of Users for the auto-completion of their data. What is the legal basis that legitimises this processing?

The legal basis for carrying out this data processing is the express consent of the User.

In the event that the User does not give their consent initially or, having given it, revokes it in the future, it will not imply the loss of their status as a User nor will this affect the enjoyment of the Service.

It should be borne in mind that consent for auto-completion in the context of the "Campus" platform implies that the User consents to the University communicating the User's registration data to the Controller, as necessary for the purpose.

Transfer of data to the Institutions and Promoters, organising or collaborating entities for the proper development of the Programme, Event or Course with Limited Places.

When Users register for a Programme, Event or Course or participate in the Event with Limited Places, the Data Controller will transfer certain Data to the Institution, organising entity or collaborator that grants the corresponding Programme, Event or Course with Limited Places, as well as to the Promoter that has sponsored, promoted or financed it, if different, so that they can be carried out (each Programme, Event or Course with Limited Places itself will identify the Institution and the Promoter who would receive the User's data from the Controller), including their Evaluators and Juries that they designate, with the sole purpose of allowing you to participate in it. In addition, on some occasions the Programmes, Events or Courses with Limited Places imply that the training is taken at an Institution other than the one that has granted it, to which Universia will also transfer the Data in order to manage the necessary procedures to be able to take the Programme, participate in the Event or Course with Limited Places. In summary, the following cases can occur:

Case I: There is a Promoter that finances a Programme, Event or a Course with Limited Places and an Institution that grants the Programme, Event or Course with Limited Places and simultaneously where the User takes the training, so that Universia will transfer the data to the Promoter and the Institution in question.

Case II: There is a Promoter that finances the Programme, Event or Course with Limited Places, on the other hand an Institution that grants it, convenes or organises the Event and finally a third Institution where the User takes it, in this case Universia will transfer the data to the Promoter, to the Institution that grants the Programme or Course with Limited Places and to the Institution where the User carries it out or in which he participates.

We inform Users that these Data transfers are necessary to be able to participate in the Programmes, Events, Events and Courses with Limited Places and, with this, to execute the General Conditions of Use and the specific conditions of the corresponding Programme or Course with Limited Places. On some occasions, the Institutions are located outside the European Union or in countries not approved by the European Commission.

There are occasions when, even if there has been a transfer of data to the Promoter and to the Institutions, organising or collaborating entities involved in a specific Programme, Event or Course, Users must carry out a registration in the systems or platforms of these entities. This may be due to technological and operational needs, or to requirements imposed by the regulations applicable to the corresponding entity (e.g., when an Institution, for example public ones, is subject to specific processing requirements for the granting of a scholarship or the provision of training content or the organization of an Event).

The Data that would be transferred are the Form Data necessary to manage registration and participation in the Program, Event or Course with Limited Places.

What is the legal basis that legitimises this processing?

The legal basis that allows this processing to be carried out is the execution of a contract that materializes with the acceptance of the General Conditions of Use and the specific conditions of the corresponding Program, Event or Course with Limited Places provided by the Institution in question. In addition, we consider that the transfers to Institutions in whose Programs, Events or Courses with Limited Places the Users enroll are occasional transfers, since we will only do so when the Users decide to register for them. Both issues justify the international transfers that we can make when transferring the data of such Users to Institutions located outside the country in which they are located, in countries not recognized as safe by the data protection authorities.

Sending of its own academic communications, by any means and personalized based on the User's profile.

Our intention is to provide Users with content of interest at all times. To this end, we will build a profile about the User using factors such as the data you have provided us with and your browsing and usage data on our Portal (IP address, registrations for Programs, Events, Courses with Limited Places and Courses with Unlimited Places, content marked as favorites) or on third-party platforms that belong to the same network (in the latter case, only when you have accepted the installation of cookies or other tracking devices when accessing the Platform)

We will use this profile to send you personalised communications, exclusively of an academic nature, which may deal with courses, scholarships, employment, training, content, workshops, among others.

What is the legal basis that legitimises this processing?

The legitimate basis that enables the processing of personal data is the legitimate interest of the Data Controller. In particular, the Data Controller has an interest in its Users being aware of the different functionalities or opportunities offered on the Portal, as well as similar opportunities, and interacting with and using the Portal as much as possible, so that Universia's position in the academic sector retains its relevance. In addition, the Data Controller also has an interest in creating a profile of the Users, since we are not interested in sending generic communications that do not correspond to what we have detected that is of most interest to each User, also in order for the Portal to be useful and accurate and for users to use it as much as possible.

At Universia we have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. Users can request it from us through the contact details indicated. However, some of the main conclusions of this analysis are advanced below: profiling and sending personalised communications represents a real interest for us that is totally lawful; it is proportionate because there are no less invasive measures that allow us to develop our interest in making you aware of the opportunities we offer and in our Portal not being generic, but useful and relevant; it does not represent detriment to you, but rather results in us sending you offers, calls or academic content that we believe will facilitate your training and employability; you can object to us doing so at any time, from the beginning; and, in addition, it is a common practice in the sector.

Transfer of the Data to the entities of the Santander Group domiciled in the User's place of residence ("Banco Local*" and "Universia Local*"), so that they may send, by any means, including electronically, their own and third-party personalised commercial communications.

The Data Controller will communicate the Data of the Users who expressly express their consent to the Local Bank and the corresponding Local University so that they can, separately, send them their own commercial and/or academic communications and those of third parties that may deal, by way of example, with banking products, insurance products, telecommunications, education, leisure, research, automotive, mass consumption, employment, culture, professional opportunities, textiles, transport, insurance, catering, technology, food, television, radio, portals and internet comparators. Commercial communications will be personalised (given that they are not interested in sending generic communications) based on the User's profile, which will be made up of (i) the Data we provide them (can be consulted below) and (ii) the data they already have about the User, which they may have provided outside the Portal, if they have any.

In the case of being a resident of the United Kingdom, provided that you have given your consent, the Data Controller may only send you commercial communications about its own products or services with the intention of providing you with information of interest at all times.

The Data that would be transferred are: the Form Data and the necessary Navigation Data of the User.

What is the legal basis that legitimises this processing?

The legal basis for carrying out this data processing is the express consent of the User. In the event that the User does not give their consent initially or, having given it, revokes it in the future, it will not entail the loss of their status as a User nor will this affect the enjoyment of the Service. This consent also covers the performance of data transfers that would be carried out by the Data Controller if the User resides in a "non-secure" country. More details on international transfers can be found in section 5 of this Privacy Policy.

*Users can consult the identity of the Local Bank and the Local University to which Universia will transfer their Data, depending on their country of residence, at this link.

Profiling for marketing purposes and sending by any means, including electronically, our own commercial communications and about third-party products or services.

Our intention is to provide you with content of interest at all times. If you are registered and have given your consent. Universia may send you its own commercial communications and/or those of third-party products or services that may deal, by way of example, with banking products, insurance products, telecommunications, education, leisure, research, automotive, mass consumption, employment, culture, career opportunities, textiles, transport, insurance, catering, technology, food, television, radio, internet portals and comparators.

Commercial communications will be personalized based on your profile, as we are not interested in sending you generic communications. This profile would be created using factors such as (i) your Data (including your basic identification data and your browsing habits on our Platform, such as the type of Programs, Events, Courses with Limited Places or Courses with Unlimited Places in which you enroll, etc.) or (ii) data about you that originates from third-party platforms that belong to the same advertising network as us (in the latter case, only when you have agreed to the installation of cookies or other tracking devices when accessing the Platform).

If you are not registered and have subscribed to the newsletter with your consent to do so, Universia may send you a personalised newsletter in relation to the content you have selected (new calls for grant programmes, events, courses, content or articles of interest).

What is the legitimizing basis that allows us to do so?

The legal basis for enabling this data processing is based on your express consent. If you do not give your consent initially or, having given it, revoke it in the future, it will not mean the loss of your status as a User nor will this affect your participation in the Platform."

Holding contests, promotions, raffles and other events through the Portal or through social networks.

The Data Controller publishes through the Portal or through social networks and with certain regularity, contests, promotions, raffles and other events so that Users can participate and benefit from the possible prizes offered.

What is the legal basis that legitimises this processing?

This processing will only be carried out by accepting the legal bases of each promotion, raffle, contest or event, this being the contract that legitimizes the processing of the data.

Carrying out statistical studies on the operation of the Portal and the Service in order to extract metrics on their functionalities and use by Users.

The Data Controller will process the information obtained through the Users' interaction with the Portal and the Service in order to generate metrics that allow the status and usefulness of the Service to be assessed, to correct errors, to improve its security and to facilitate its use, as well as to introduce improvements. Likewise, it may communicate this information to other entities of the Santander Group for internal administrative purposes, in particular to know the activity of the Service and to prepare global metrics.

What is the legal basis that legitimises this processing?

The legal basis that legitimises this data processing is the legitimate interest of the Data Controller. Our interest lies in being able to use the information on the use of the Portal to know the impact and usefulness of the Programmes, Courses with Limited Places, Courses with Unlimited Places and the Contents, as well as to be able to correct and improve the Service, which is easy to use and secure for our Users and to know their activity through global metrics. . We inform Users that we have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. Users can request it from us through the contact details indicated. However, we advance some of the main conclusions of this analysis below: the performance of statistical analyses represents a real interest for us that is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest, it does not represent damage to you and, in addition, it is a common practice in the sector.

Resolution of User queries.

Universia will process the Data to process and manage the request for information, doubts or other queries sent by the User (registered or not) through the contact form provided, as well as the actions and operations that may arise from them.

Universia offers Users the possibility of having a conversational assistant, based on an Artificial Intelligence system, help them resolve their doubts or queries about the platform and its content. In addition to answering specific queries, this assistant also has the ability to act as a search engine and recommender of content available on the platform, allowing Users to find relevant information or suggestions according to their needs or interests. This system is configured through parameters, patterns and models that help the assistant to respond in an automated and agile way, taking into account the information provided by the User.

The conversational assistant is limited to answering questions or queries, and recommending related content, for example, regarding calls for Programs, Events or courses. This conversational assistant has been designed to facilitate interaction with Users without the need to process personal data.

Universia does not process personal data or other personal information that the User may enter when interacting with the conversational assistant. In this regard, we inform you that if you enter any personal data or other information that may be considered personal and/or confidential, it will not be processed for any specific purpose. The conversational assistant is only limited to resolving the doubt, query or search raised, beyond the fact that the information entered to interact with the conversational assistant may be stored as indicated in the following paragraphs.

The information on the use of the conversational assistant may be subject to statistical analysis and improvement of the service in an aggregated and anonymised form, without user identifiers or elements that allow direct or indirect identification.

It is important that you follow these recommendations and that under no circumstances do you provide us with personal data or other information that could be considered personal and/or confidential.

What is the legal basis that legitimises this processing?

The processing of data to manage requests for information, search for content and/or the resolution of queries is carried out based on Universia's legitimate interest in adequately resolving the concerns raised by Users and increasing satisfaction with the Service, as well as, where appropriate, in compliance with legal obligations that may be applicable in terms of customer service.

We have carried out a weighting analysis to assess whether we could indeed carry out this processing based on our legitimate interest. Users can request it from us through the contact details indicated. However, we advance some of the main conclusions of this analysis below: the resolution of doubts and queries, as well as the search and recommendation of content, represents a real interest for us that is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest without processing the Users' data in a lawful way, it does not represent damage to you (on the contrary, it allows fluid communication with Universia), the processing of data is not unbalanced, and, in addition, it is a common practice in the sector.

Transfer of the Data to Banco Local* and Banco Santander, S.A. (Spain) so that they can contact the interested parties for possible selection processes.

When the Users expressly consent to it, the Data Controller will transfer the Data of the Users who expressly express their consent to the Local Bank so that it can contact them to participate in the entity's own selection processes. Likewise, the Data will also be transferred to Banco Santander, S.A. (Spain), as the Group's parent company, for global position selection processes. Thus, for example, if the User is a Brazilian resident, their data would be communicated to the Local Bank located in Brazil and to Banco Santander, S.A. (Spain).

The Data that would be transferred are: name, surname, country of residence, e-mail, date of birth, curriculum vitae, training or qualification data and data relating to browsing and use of the Portal (IP address, registrations in Programmes, Events, Courses with Limited Places and Courses with Unlimited Places or content marked as favourites).

What is the legal basis that legitimises this processing?

The legal basis for carrying out this processing is the User's express consent. In the event that the User does not give their consent initially or, having given it, revokes it in the future, it will not entail the loss of their status as a User nor will this affect the enjoyment of the Service. This consent also covers the performance of data transfers that would be carried out by the Data Controller if the User resides in a "non-secure" country. More details on international transfers can be found in section 5 of this Privacy Policy.

*Users can consult the identity of the specific Local Bank to which Universia will transfer their Data, depending on their country of residence, at this link.

Personalised recommendations on Universia products and services based on the User's profile.

The Data Controller may carry out the creation of User profiles in relation to their personal data and other personal information included in the "Personalisation" section of their private profile or the Universia products and services enjoyed (Programmes, Events, Courses with Limited Places, Courses with Unlimited Places and job offers).

This profiling will be carried out through a tool that automatically carries out an analysis of the information provided and generated by the User that allows them to be shown, within the Portal itself, recommendations on Universia's own products and/or services that may be more appropriate to their interests.

For more information, you can consult this link, which provides details regarding the data processing carried out by this tool for the recommendation of Universia products and services.

The Data Controller will process the following categories of data: name, surname, country of residence, e-mail, date of birth, curriculum vitae, education or qualifications, university (data and information contained in the User's private profile), IP address, registrations in Programmes, Events, Courses with Limited Places, Courses with Unlimited Places, job offers, participation or favourite content and other information related to the User's browsing habits on the Portal collected through cookies, provided that the User authorises us to do so.

With this information, the Responsible Party will carry out an analysis of the interests of the Users to determine which of our products and services best fit their profile, in order to show them recommendations that best suit their preferences within the Portal.

What is the legal basis that legitimises this processing?

Consent to the processing of the User's browsing habits on the Portal. Universia will process the personal data obtained from the use of analytical and advertising cookies, provided that the User has given their express consent for this purpose through the cookie configuration panel. For more information, you can consult our Cookies Policy.
Legitimate interest for automated profiling. This processing is necessary for the satisfaction of Universia's legitimate interest. However, the User has the possibility of objecting to this processing of their personal data.

We inform you that Universia's predominant interest in carrying out this data processing is to improve the offer of content and adapt it to the User's profile, thus offering them information on products that may be of interest to them.

In addition, the User may object to being shown personalized content based on their personal information. To do this, they must deactivate the option "View personalized content and enjoy a more relevant and useful experience" enabled in their private profile in the "Personalization" section.

In accordance with the provisions of data protection regulations, Universia has carried out the corresponding weighting analysis, to confirm that the legitimate interest of the Controller does not harm the interests of the Users. As a conclusion to these tests, we understand that the legitimate interest of the Controller presents a truly lawful interest since this activity seeks to achieve a higher level of conversion, a more personalized value offer and an improvement of the User's experience on the Portal. Therefore, we understand that this processing does not constitute an impediment to the normal exercise of the rights and freedoms of the Users, and is also a common practice in the sector.

Anonymization of Personal Data.

We will anonymize User Data and analyze it in aggregate form with many other anonymized data to learn patterns and extract insights and intelligence from training trends, improve the security of our technology, and other purposes.

What is the legal basis that legitimises this processing?

The legitimate basis for this purpose is Universia's legitimate interest in improving the security of our Service and in generating intelligence that allows us and third parties to know about training trends, as well as to take advantage of this knowledge for other purposes. The perceptions and learnings we obtain from the aggregate analysis of anonymous information will not affect Users directly.

We have carried out a weighting analysis to assess whether we could effectively carry out this processing based on our legitimate interest. Users can request it from us through the contact details indicated. However, we advance some of the main conclusions of this analysis below: anonymisation represents a real interest for us that is totally lawful, it is proportionate because there are no less invasive measures that allow us to develop our interest, it does not represent damage to you and, in addition, it is a common practice in the sector.

Compliance with legal obligations.

Finally, at Universia we may process the Data to comply with any applicable legal obligations. For example, tax obligations, compliance with requirements of the Courts of Justice, etc.

What is the legal basis that legitimises this processing?

The legal basis for this processing is that we need to process your Data in order to comply with the obligations imposed on us by law.

4. DATA RETENTION PERIOD

The Data will be kept for as long as the contractual relationship that unites us with the Users is maintained, regulated by the General Conditions of Use.

However, for the purposes for which we request the User's consent or on which the User has the possibility of objecting, we will stop processing the Data sooner if the User withdraws their consent or if they object to us continuing to process them, in the latter case as long as our legitimate interests do not continue to prevail. If the User revokes their consent or exercises the right to erasure, their personal data will be kept blocked for the periods established by law to meet the possible liabilities arising from the processing of the same, for the formulation, exercise and defence of potential claims, provided that this is permitted by applicable legislation, or to make the Data available to judges and courts or to the competent public authorities. During this additional period, Universia will keep the User's Data in a blocked form. This means that we will not use them for the initial purposes, but only for those described in this paragraph and during the limitation periods for any liability actions that may exist. At the end of this extra period, we undertake to cease processing all Data.

For those cases in which the interested parties in certain Programmes accept the transfer of their curricular data to Banco Local and Banco Santander, S.A., in relation to selection processes, the entity receiving said data will only keep them for a period of 1 year. Once this period has expired, the data will be blocked for the established legal period until its subsequent deletion.

Likewise, for those Users who have subscribed only to the news newsletter, Universia will stop processing their Data for this purpose when the user revokes their consent or finally registers on the Portal.

5. RECIPIENTS OF THE DATA

Data relating to Users will be shared with the entities indicated below:

Institutions, organising or collaborating entities, as well as their Evaluators and Juries The Data will be transferred by the Data Controller to the Institution that has granted or has to grant the corresponding Programme, Event or Course with Limited Places and/or where the training is taken or the activity is carried out, as well as to its Evaluators and Juries, who are part of these Institutions, or collaborate with them on their own behalf, with the sole purpose of enabling their participation in it.

We inform Users that the Portal is international in nature, and Institutions located outside and within the European Union may register with it. If the User joins a Programme, Event of an Institution located outside the European Union, the User is aware that their data will be transferred both to that Institution and, in the event that it is different, to the Institution in which the Programme or Event is developed. In this regard, the User is informed that the processing of data outside the European Union may pose a risk to the security of their data, which would no longer be covered by the guarantees required by European regulations, due to the absence of an adequacy decision by the Commission with respect to the third country in question. We remind Users that these transfers are legal because they are necessary for the execution of the General Conditions of Use and because they are occasional, as they will only occur when Users decide to register for their Programmes, Events or Courses with Limited Places.

Santander Group entities. Likewise, the Data of Users who have previously consented through the consents enabled in the User Register will be communicated to the Local Banks and/or Local Universia so that they can send commercial communications, their own and those of third parties, if the User has given their consent in accordance with the provisions of point 3 of this Privacy Policy. As reflected above, in the case of the United Kingdom, only commercial communications of its own products or services may be sent.

Users can consult the identity of the specific Local Bank and Local Universia to which Universia will transfer their Data, depending on their country of residence for the purposes of commercial communications, at this link

Likewise, also subject to the User's consent, the Data Controller will transfer Data to the Local Banks and to Banco Santander, S.A. (Spain) in order to contact the User within the framework of the selection and recruitment processes to fill positions in the Santander Group.

Universia may also communicate the Data to the entities of the Santander Group for internal administrative purposes in order to know the activity of the Service and to prepare global metrics.

There are entities of the Santander Group that are located outside the European Union, including in territories that have not yet been considered suitable by the European Commission. In this regard, the User is informed that the processing of data outside the European Union may pose a risk to the security of their data, which would no longer be covered by the guarantees required by European regulations, due to the absence of an adequacy decision by the Commission with respect to the third country in question. Therefore, unless otherwise provided, we will exclusively transfer User Data in accordance with Standard Contractual Clauses approved by the European Commission, which, if necessary, have been supplemented by means of additional measures. The Data Controller is not responsible for and cannot guarantee the security of the data transferred.

Public authorities and bodies for the performance of their functions. In some cases, applicable regulations require sharing information with public authorities or bodies in order for them to carry out their functions. For example, tax authorities or courts of law, which would use your Data for their own purposes.

Service providers. These are entities that help us with different issues related to the management of the Service, such as technological infrastructure, storage, sending commercial communications or customer service. At Universia we ensure that all our service providers who may have access to your Data act confidentially and comply with the applicable regulations on data protection. We have signed agreements with them that regulate the use of your Data limited to the provision of the Service and the security measures they must adopt to protect it. These providers never use your Data for their own purposes, but simply to help us provide you with the Service.

Some of these service providers are located in or may access User Data from outside the European Economic Area, so we have put in place appropriate safeguards to ensure that the Data is treated with a level of protection equivalent to that which exists in the European Economic Area. In particular, these transfers may be supported by the adoption of Standard Contractual Clauses approved by the European Commission, which have been supplemented by additional measures if necessary.

Users can consult what specific Data is transferred to the above Recipients in section 3 of this Privacy Policy.

In relation to international transfers of Data to territories outside the European Union that have not been deemed appropriate by the European Commission, Users may request additional information in relation to international transfers of personal data and the risks involved, as well as obtain a copy of the safeguards adopted and the relevant protection measures implemented, via the email address indicated in section 1.

6. RIGHTS OF DATA SUBJECTS

Users have the right to access their Data, as well as to request the rectification of inaccurate data, the limitation of their processing or, where appropriate, request their deletion when, among other reasons, the data is no longer necessary for the purposes for which they were collected, as well as not to be subject to automated individual decisions. In certain circumstances and for reasons related to their particular situation, the interested parties may object to the processing of their data. The Data Controller will stop processing the data, except for compelling legitimate reasons, or the exercise or defence of possible claims.

Likewise, Users will have the right to request the portability of their data in cases where it is technically possible.

Data owners may use the following contact form to exercise their rights or send a letter by post to Ciudad Grupo Santander. Avda de Cantabria s/n, Santander Universidades, 28660 Boadilla del Monte (Madrid), Spain.

Data subjects have the right to contact the Spanish Data Protection Agency at Calle Jorge Juan 6, 28001, Madrid or its electronic headquarters www.aepd.es

We remind you that the User has the right to withdraw their consent for commercial purposes at any time by contacting the addresses indicated above.

7. MODIFICATION OF THE END USER PRIVACY POLICY

We may amend this Privacy Policy in accordance with applicable law at any time, but we will inform Users of any significant modifications that have a relevant impact on their privacy well in advance. In addition, we will post the amended Privacy Policy on our Portal, where Users will be able to check the date of last update. In case it is necessary depending on the nature of the modification we make, we may ask Users to grant us new consents.

Last modification date: 07/10/2025