Who is responsible for the processing of your data?

The data controller is the Universidad Francisco de Vitoria (UFV).

Contact details: Universidad Francisco de Vitoria. Secretaría General. Ctra. M-515 Pozuelo-Majadahonda Km. 1.800; 28223, Pozuelo de Alarcón (Madrid).

Contact details of the Data Protection Delegate: dpd@ufv.es

For what purposes will we process your personal data?

At UFV, we will process your personal data in order to attend to and manage notifications you make regarding COVID-19, including those related to illness, suspicious symptoms, and close contact, among others.

What is the legal basis for the processing of your data?

The legal basis for data processing is compliance with a legal obligation applicable to the Data Controller (in the case of PAS-PROF personnel) or the public interest (in the case of students and other individuals):

• For PAS-PROF personnel, the one described in Article 9.2.(b) of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR): “processing is necessary for the purposes of the performance of obligations and the exercise of specific rights of the controller or of the data subject in the field of employment law and social security and social protection, insofar as this is authorized by Union law of the Member States or a collective agreement under the law of the Member States which provides adequate safeguards to ensure respect for the fundamental rights and interests of the data subject” and Law 31/1995 of November 8,1995 on the Prevention of Occupational Risks.
• For students and other individuals, the aforementioned description applies. 9.2.g of the GDPR states that processing is necessary for reasons of essential public interest, on the basis of Union or Member State law, which must be proportionate to the aim pursued, respect in substance the right to data protection, and provide for adequate and specific measures to protect the interests and fundamental rights of the data subject. This must be done in compliance with the provisions of The guidelines published by the Ministry of Health and the Ministry of Health of the Community of Madrid are based on the provisions of Organic Law 3/1986, of April 14, 1986, on Special Public Health Measures (modified by Royal Decree-Law 6/2020). The measures were adopted on March 10, 2020, in order to address urgent economic concerns and protect public health. They were published in the Official State Gazette on March 11, 2020.
  Other relevant legislation includes Law 33/2011, of October 4, 2011, General Law on Public Health.

How long will we keep personal data?

Your data will be retained for one year from the date of case notification, or until the case is no longer active, in order to facilitate effective monitoring and support of University-wide COIVD-19 cases in accordance with the recommendations set forth in the Community of Madrid’s STRATEGY FOR EARLY DETECTION, SURVEILLANCE, AND CONTROL OF COIVD-19.

To which recipients will your data be communicated?

The Universidad Francisco de Vitoria has a number of suppliers of applications and computer support, who may have access to personal data when executing such contracts. The Universidad Francisco de Vitoria will always have a data access contract signed with the relevant third parties in accordance with the requirements of Article 28 of the General Data Protection Regulation. This will provide sufficient guarantees in respect of the processing carried out by these providers. Some of the providers are located outside the European Union, so the Universidad Francisco de Vitoria requests additional guarantees in line with the international transfer provisions set out in the General Data Protection Regulation.

Furthermore, the data may be transferred to the external service of Health Surveillance of the university (in the case of UFV employees), to the Ministry of Health of the Community of Madrid, and to the Ministry of Health.

What are your rights in relation to data processing?

Any individual has the right to request information regarding the processing of their data, access their personal data, request the rectification of inaccurate data, or, when applicable, request deletion. This right is exercised when the data are no longer necessary for the purposes for which they were collected or when the data subject withdraws their consent.

In certain cases, the interested party may request the limitation of the processing of their data. In such instances, we will only retain the data in accordance with the applicable regulations.

In certain cases, you may exercise your right to data portability. This will be provided in a structured, commonly used, or machine-readable format to you or the new data controller you designate.

You have the right to withdraw your consent at any time for any of the processing activities for which you have provided consent.

To exercise your rights, you must submit the appropriate written document, signed electronically or accompanied by a photocopy of your ID card. If you are acting through a representative, the letter must be accompanied by a duly executed power of attorney, as well as a copy of your ID card or an electronically signed document.

All written materials must be submitted in person at the University Registry or via mail to the address listed in the “Responsible” section.

As a data subject, you have the right to contact our data protection officer regarding all matters relating to the processing of your personal data and the exercise of your rights under the General Data Protection Regulation of the European Union 2016/679 of 27 April 2016. Should you consider that the exercise of your rights has not been adequately addressed, you may lodge a complaint with the competent supervisory authority.

The maximum term for resolution is one month from the receipt of your request. In the event that the complexity of the request or the number of requests received necessitates an extension, the period may be extended for a further two months.

Should any changes be made to your data, we kindly request that you inform us in writing so that we can ensure your data is kept up to date.