UPM Privacy Policy

The Universidad Politécnica de Madrid (UPM) is an institution firmly committed to respecting the fundamental freedoms and rights of individuals.

The application, as of May 25, 2018, of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), represents a significant advance in the recognition of every person’s right to the protection of their personal data, and provides us with the opportunity to update our Privacy Policy and inform you of its main aspects through this statement.

Who is responsible for the processing of your personal data?

At the Universidad Politécnica de Madrid, we are responsible for all personal data processing activities we conduct, and we are committed to making public and keeping updated a Register of Personal Data Processing Activities, containing the information indicated in Article 30 of the GDPR.

How is your personal data processed at the UPM?

At the UPM, we strive to process your personal data in strict compliance with the obligations derived from current Data Protection regulations, adopting the principle of proactive responsibility, as set forth in the GDPR, as a fundamental pillar of our operations.

Based on this commitment, your personal data will be:

• Processed lawfully, fairly, and transparently.
• Collected for specified, explicit, and legitimate purposes.
• Adequate, relevant, and limited to what is necessary.
• Accurate and kept up to date where necessary.
• Kept only for the time necessary.
• Protected by appropriate technical and organizational measures.

For what purpose do we process your personal data?

The main purpose of the processing carried out by the UPM is the fulfillment of the functions entrusted by the Organic Law 6/2001 on Universities, related to the provision of the public service of higher education.

Each processing activity has a specific purpose that is communicated to the data subject at the time of data collection.

Is the processing of your personal data by the UPM lawful?

Each processing activity carried out by the UPM complies with at least one of the legal bases provided for in Article 6 of the GDPR, including:

• Compliance with a legal obligation.
• Mission carried out in the public interest.
• Exercise of public powers.
• Consent of the data subject.
• Performance of a contract.
• Protection of vital interests.
• Legitimate interests.

Consent must be freely given, specific, informed, and unambiguous.

To which recipients may we disclose your personal data?

The UPM may disclose personal data to public or private institutions, bodies, or entities when there is a legal obligation or a relationship as a data processor.

International data transfers may also occur with adequate safeguards.

Assignments or transfers are reflected in the Register of Processing Activities.

How long will we keep your personal data?

Personal data will be kept only for the time necessary for the purposes of the processing and any potential derived liabilities.

They may be kept longer for:

• Archiving in the public interest.
• Scientific or historical research.
• Statistical purposes.

What are your rights in relation to the personal data provided?

You have the right to:

• Be informed about the processing.
• Access your personal data.
• Rectify inaccurate data.
• Request the deletion of data (right to be forgotten).
• Restrict the processing.
• Obtain data portability.
• Object to the processing.
• Not be subject to automated individual decision-making.

How can you exercise your rights?

You may contact the UPM Data Protection Officer:

proteccion.datos@upm.es

You may also file a complaint with the Spanish Data Protection Agency:

Agencia Española de Protección de Datos (AEPD)

Is the UPM Privacy Policy reviewed and updated?

The UPM will periodically review its data protection policy to adapt it to regulatory changes.

The update of this policy was approved on September 27, 2018.