Privacy policy

Universia Holding, S.L. (hereinafter, "Universia" or the "Controller") informs users (hereinafter, "Users" or in singular "User"), about its personal data protection policy, which details the data processing carried out on the portal accessible through the following domains: https://www.becas-santander.com, www.santander-grants.com and www.bolsas-santander.com and through the mobile applications called "Learning Room Santander " available for iOS and Android (hereinafter, jointly or independently, the "Portal").

The Portal is a space created by Universia that brings together Users and universities or other institutions (hereinafter, "Institutions") that publish grants (hereinafter, the "Programmes"), in addition to other functionalities described in the General Terms of Use. Basically, Users, who may be students, teachers, collaborators, etc., may use the Portal to review, register, manage or coordinate Programmes, evaluate which Programmes may be useful to them in their training process (hereinafter, the "Service"). Users may also access content offered by Universia itself aimed at facilitating learning and reinforcing their skills. The Portal has an international character, and Users and Institutions located outside and inside the European Union can register and/or collaborate in its activity.

This Privacy Policy sets out the purposes for which we process the personal data of Users, the reasons why the processing is lawful, how long we store the data, the entities with which we share them, the rights that may be exercised and other matters that we consider important in order for Users to clearly understand what we are going to do with their data when they use the Service.

When we say "personal data", we mean all information related to Users which they provide us with directly, which they have generated by using our Service or which we have inferred concerning them, provided they feel it is appropriate for us to analyse their profile (the "Data"). Specially protected data or information considered "sensitive" will not be processed.

Universia informs Users that the processing of Data carried out by the Institutions or Promoters to implement the Programmes posted on the Portal will be subject to their own privacy policies. This Privacy Policy therefore merely informs Users on the processing carried out by Universia, including processing concerning contents offered directly by Universia.

Users must only provide in each case the data marked with an asterisk or marked as obligatory, as they are considered necessary to enjoy the Service. In this sense, Users can provide these data directly by completing the registration form, either by entering the data manually or through one of the available third-party authentication systems or social connectors, or if the Users only want to subscribe to the news newsletter, providing the email in the available section without the need to register in the Portal. Additionally, when the User is registered, it is possible that additional data may be requested in some functionalities, for example, to enroll in a scholarship, academic and/or employment data may be requested.

This Privacy Policy will remain accessible for consultation in the footer of the web version of the Portal and on the home page of the mobile application.

1. DATA CONTROLLER

Identity of the Data Controller:

Universia Holding, S.L

An entity filed with the Mercantile Registry of Madrid in 2005, at volume 16547, sheet 107, page number M-28189, entry 4, with corporate tax number B82976515 (the “Data Controller”).

Data controller contact details:

Postal address: Ciudad Grupo Santander. Avda de Cantabria s/n, 28660 Boadilla del Monte, Madrid

Contact form for privacy purposes: Contact form

Contact details of data protection officer: dpo@universia.net

2. DATA WE PROCESS AND ORIGIN OF THE DATA

On the Portal we process the Data provided to us by Users, both in the registration process and subsequently when using our Service, registering for Programmes, accessing content and browsing the Portal. The collection of User Data in the registration process may be carried out directly, if the User has provided this information to Universia by completing the registration form, or by using third party authentication systems or social connectors offered on the Portal. In this case, the provider of the relevant authentication system or social connector will provide Universia with the Data that the User authorises, which will be displayed on screen before completing the submission. The User may also consult the permissions granted on the platform of the third party whose social connector he/she uses. If the Data received in this way are insufficient, i.e. if any of the Data marked with an asterisk have not been provided, Universia will ask the User to provide them in order to complete the registration on the Portal and access the Service. Users are informed that the Data received from these third parties will be incorporated into Universia's own database and will be used not only for registration or access to the Portal, but also for all other relevant purposes as described in section 3 of this Privacy Policy.

In particular, we obtain the following data: name, surname, country of residence, e-mail, date of birth, curriculum vitae, education or qualifications and data relating to browsing and use of the Portal (IP address, information about the device in the case of using the Learning Room Santander app, registrations in Programmes, profile data or content marked as favourites).

Finally, we inform Users that we obtain information on browsing habits via cookies. For more information in this regard, we recommend Users consult our Cookies Policy.

3. PURPOSES OF AND LEGAL BASIS FOR PROCESSING

Management of the User's registration on the Portal and enjoyment of the Service. The Data Controller will process the Data of Users who register through the corresponding form in order to manage their registration on the Portal and who can identify themselves. Universia will also process the Data for all processing that is necessary to allow the use of all the functionalities of the Service that the User uses, such as registration in the Programmes or access to content offered in the Portal's Learning Room or the sending of notifications about the Service itself, if desired.

What is the legal basis for this processing?

The legal basis that enables this data processing is the performance of a contract put in place through acceptance of the General Conditions of Use.
Transfer of data to Institutions and Promoters for proper implementation of the Programme. When Users register for a Programme, the Controller will transfer certain Data to the Institution that grants the corresponding Programme, as well as to the Promoter that has sponsored, promoted or financed it, if different, so that the Programme can be carried out (each Programme itself will identify the Institution and Promoter that would receive the User's data from the Controller). In addition, on some occasions the Programmes imply that the training is taken at an Institution other than the one that has granted the programme, to which Universia will also transfer the Data for the purpose of managing the necessary procedures to be able to take the Programme. In summary, the following cases may arise:

- Case I: There is a Promoter that finances the Programme and an Institution that grants the Programme and simultaneously where the User takes the training, so that Universia will transfer the data to the Promoter and to the Institution in question.

Case II: There is a Promoter that finances the Programme, on the other hand an Institution that grants the Programme and lastly a third Institution where the User is taking the Programme, in this case Universia will transfer the data to the Promoter, to the Institution that grants the Programme and to the Institution where the User is going to take the Programme.

We wish to inform Users that transfer of these Data is necessary to take part in the Programmes, and to execute the General Conditions of Use and the specific conditions of the Programme concerned. Occasionally, the Institutions are located in countries that are not secure or are outside the European Union.

The Data that will be sent are as follows: full name, country of residence, e-mail, date of birth and data concerning browsing and use of the Portal (IP address, enrolment on Programmes or contents marked as favourites).

What is the legal basis for this processing?

The legal basis that enables this processing is the performance of a contract put in place through acceptance of the General Conditions of Use and any specific conditions of the Programme concerned stipulated by the Institution concerned. We also consider that transfers to Institutions with Programmes on which Users enrol qualify as occasional transfers, as we will only transfer the Data when Users decide to enrol. Both instances justify the international transfers we may perform when transferring the Data of these Users to Institutions located outside the country in which the Users are located, in countries not recognised as secure by the data protection authorities.
Sending, by any means, of own communications of an academic nature that are personalised on the basis of the User profile.Our intention at all times is to provide Users with content that may interest them. To this end we will draw up a profile on the User, employing factors such as the data they have supplied to us and data on their browsing and use of our Portal (IP address, enrolment on Programmes, content marked as favourites) or on third-party platforms forming part of the same network (in the last-mentioned case, only when the User has granted their consent to the installation of cookies or other tracking devices when accessing the Platform).

We will use this profile to send them customised, exclusively academic communications, which may be in relation to courses, grants, employment, training, contents, workshops and others.

What is the legal basis for this processing?

The legal basis that enables this personal data processing is that it is of legitimate interest of the Data Controller. Specifically, the Data Controller wishes its Users to have knowledge of the various functions and opportunities available on the Portal, and similar opportunities, and to interact and use the Portal as much as possible, to help Universia remain relevant in the academic sector. The Data Controller also wishes to draw up a profile on Users, since we have no interest in sending generic communications that do not match what we have found to be the interests of each User, and also to make the Portal useful and precise, and for users to use it as much as possible.

At Universia we have conducted a weighting analysis to determine whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this analysis through the contact data indicated. However, there follow a few of the main conclusions obtained from the analyses performed: the profiling and the sending of customised communications represent a genuine interest on our part which is totally lawful; it is proportionate because there are no less invasive measures to enable us to implement our desire for you to familiarise yourself with the opportunities we are offering and for our Portal to not be generic, but rather useful and relevant; it has no adverse impact on you, and in fact enables us to send you offers, calls or academic content which we believe will facilitate your training and improve your job prospects; you may opt out of these communications at any time, right from the outset; and this is also a habitual practice in the sector.
Transfer of the Data to the Santander Group entities domiciled in the User's place of residence ("Banco Local*" and "Universia Local*"), to enable them to send, by any means, including electronic media, their own customised commercial communications and those of third parties.The Data Controller will transfer Data belonging to Users that have given their express consent to the Local Bank and the Local Universia concerned so that they may separately send own and third-party marketing communications and/or communications of an academic nature that may refer, for example, to banking products, insurance products, telecommunications, education, leisure, research, vehicles, consumer goods, employment, culture, professional opportunities, textile, transport, insurance, catering, technology, food, television, radio, portals and Internet comparison tools. The commercial communications will be customised (because those parties are not interested in sending generic communications) and based on the profile of the User, which will comprise (i) Data we give them (these may be consulted below) and (ii) any data they already had on the User that the User had already supplied to them outside the Portal, if any.

What is the legal basis for this processing?

The legal basis for this processing is the express consent provided by the User. If the User does not initially provide their consent, or has provided it but then revokes it in the future, they will still be considered a User and their enjoyment of the Service will not be affected. Consent also covers transfer of data that would be carried out by the Data Controller if the User resides in an "insecure country". More information on international transfers can be found in section 5 of this Privacy Policy.

*Users may consult the identity of the Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence, by clicking here

The Data that will be sent are as follows: full name, country of residence, e-mail, date of birth and data concerning browsing and use of the Portal (IP address, enrolment on Programmes or contents marked as favourites).
Profiling for marketing purposes and sending via any channel, including digital ones, of marketing communications regarding own and third-party services and products.

Our intention at all times is to offer you content that we believe will interest you. If you are registered and have given your consent. Universia may send you own and third-party marketing communications regarding products and services that may, for example, relate to banking products, insurance products, telecommunications, education, leisure, research, vehicles, consumer goods, employment, culture, professional opportunities, textile, transport, insurance, catering, technology, food, television, radio, and Internet comparison tools and portals.

Commercial communications will be personalised based on your profile, as we are not interested in sending you generic communications. This profile would be created using factors such as (i) your Data (including your basic identification data and your browsing habits on our Platform, such as the type of calls you sign up for, etc.) or (ii) data about you that originate from third party platforms that belong to the same advertising network as us (in the latter case, only when you have accepted the installation of cookies or other tracking devices when accessing the Platform).

If you are not registered and have subscribed to the news newsletter giving your consent for it, Universia can send you a personalized newsletter regarding the content you have selected (new calls for scholarship programs, Learning room or articles of interest).

What is the legal basis that allows us to do this?

The legal basis for enabling this data processing is your express consent. In the event that you do not give your consent initially or, having given your consent, you revoke it in the future, this will not entail the loss of your status as a User nor will this affect your participation in the Platform".
Conducting contests, promotions, sweepstakes and other events through the Portal or through social networks. The Controller publishes, through the Portal or through social networks and with certain regularity, contests, promotions, sweepstakes and other events so that Users can participate and benefit from the possible prizes offered.

What is the legal basis for this processing?

This processing will only take place upon acceptance of the legal terms for each promotion, draw, contest or event, and this will be the contract that legitimises the processing of data.
Statistical surveys on the functioning of the technology that supports the Service in order to make technical improvements or improvements to security, to operation and usability and commercial improvements.The Data Controller will process all information obtained through the interaction of Users with the Portal and the Service, in order to generate metrics and aggregate information with which to assess the status and utility of the Service, correct errors, make it more secure and user-friendly, and improve it.

What is the legal basis for this processing?

The legal basis that legitimises this data processing is the legitimate interest of the Data Controller. Our interest lies in being able to use the information on the use of the Service in aggregate form in order to know the impact and usefulness of the Programmes and contents, as well as to be able to correct and improve the Service, to make it easy to use and safe for our Users and to respond to their real needs. We inform Users that we have carried out a weighting analysis to assess whether we could indeed carry out this processing on the basis of our legitimate interest. Users may request us to do so through the contact details indicated. However, we advance some of the main conclusions of this analysis as follows: the performance of statistical analysis represents a real interest for us that is entirely lawful, is proportionate because there are no less invasive measures that allow us to develop our interest, does not represent harm to you and, moreover, is standard practice in the industry.
Resolution of consultations by Users.Universia will process the Data to manage and administer requests for information, doubts or other queries sent by the User (registered or not registered) through the contact form, and any actions and operations that may arise from these.

What is the legal basis for this processing?

The processing is carried out on the basis of the legitimate interest of Universia in properly resolving any concerns of Users and improving satisfaction with the Service, and, where applicable, in meeting any legal obligations that may be applicable in relation to customer service. Users may ask Universia to provide them with a copy of the weighted judgment generated from the contact data already supplied.

We have conducted a weighting analysis to ascertain whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this through the contact data indicated. However, there follow some of the main conclusions obtained from the analyses performed: the resolution of doubts and queries represents a genuine interest on our part which is totally lawful, it is proportionate because there are no less invasive measures to enable us to implement our interest without processing the data of Users lawfully, it has no adverse impact on you (on the contrary, in fact, for it propitiates fluid communication with Universia), the processing of data is not imbalanced, and it is also a habitual practice in the sector.
Transfer of Data to the Local Bank* and to Banco Santander, S.A. (Spain) to enable them to contact data subjects for potential selection processes.When Users specifically grant consent, the Data Controller will transfer the Data of Users who have given their express consent to the Local Bank to enable the latter to contact them to take part in its selection processes. Likewise, the Data will also be sent to Banco Santander, S.A. (Spain), as parent of the Group, for global recruitment processes. Thus, for example, if the User is resident in Brazil, their data will be transferred to the Local Bank in Brazil and to Banco Santander, S.A. (Spain).

What is the legal basis for this processing?

The legal basis for carrying out this processing is the express consent provided by the User. If the User does not initially provide their consent, or has provided it but then revokes it in the future, they will still be considered a User and their enjoyment of the Service will not be affected. Consent also covers transfer of data that would be carried out by the Data Controller if the User resides in an "insecure country". More information on international transfers can be found in section 5 of this Privacy Policy.

*Users may consult the identity of the specific Local Bank to which Universia will transfer their Data, depending on their country of residence, by clicking here

The Data that will be sent are as follows: full name, country of residence, e-mail, date of birth, curriculum vitae, data on training or qualifications and data concerning browsing and use of the Portal (IP address, enrolment on Programmes, profile data, participation or content marked as favourites).
Profiling for use in behaviour patterns to suggest products and recommendations. When users accept the processing of personal data obtained from online identifiers, such as analytical and advertising cookies, the data controller may carry out profiling of their behaviour, in which the information generated by the users in their profile will also be taken into account.

This profiling will be performed using a tool that automatically executes an analysis of behaviour patterns to allow recommendations to be shown to users, in the Portal, on acquiring products and/or services that may better match their interests, according to the behaviour patterns. For more information, go to this link, where the details are given of the data processing that will be carried out based on this tool.

Specifically, to carry out this activity, the controller will process data obtained by observing the browsing habits of users on the portal, and by monitoring and analysing these users' behaviour when they browse this web environment (in particular, we will process your IP address, enrolment in programmes, profile data, participation or content marked as favourite and browsing habits through cookies).

The controller will also process the following categories of data: full name, country of residence, e-mail, date of birth, curriculum vitae, training and qualifications.
With this information, the controller will analyse users' interests to determine which of our products and services best match their profile, so that we can show them, in the portal, recommendations that match their preferences.

What is the legal basis for this processing?

This processing involves acceptance of the terms and conditions of cookies consent and the automated profiling based on legitimate interest:

(i)            Consent for the use of behavioural parameters:
Universia will process the personal data obtained from the use of analytical and advertising cookies, as long as the user has given express consent for such purposes on the cookie configuration panel. For more information, see our Cookies Policy.

(ii)           Legitimate interest to carry out automated profiling:
This processing is necessary to satisfy the legitimate interests of Universia. However, users have the option to object to this processing of their personal data.

We inform you that Universia's predominant interest in carrying out this data processing is to improve the offer of content and adapt it to the user's profile, thus offering information about products that may be of interest on the portal.

In particular, Universia has an interest in its users being able to access the content that interests them more easily and for searches on the portal to be more agile and personalised, so that they can find the product they are looking for, according to its characteristics, more quickly.

In accordance with the provisions of data protection regulations, Universia has carried out the corresponding weighting analysis and weighing tests to confirm that the legitimate interest of the Data Controller does not harm the interests of Users. As a conclusion of these tests, we understand that the legitimate interest of the Controller presents a truly lawful interest since this activity seeks to achieve a higher level of conversion, a more personalised value offer and an improvement in the User's experience on the Portal. Therefore, we understand that this processing does not constitute an impediment to the normal exercise of the rights and freedoms of the Users, and is also standard practice in the sector.
Anonymisation of Personal Data. We will anonymise User Data and analyse it in aggregate form with many other anonymised data to understand patterns and extract insights and intelligence on training trends, improve the security of our technology and for other purposes.

What is the legal basis for this processing?

The legal basis of this purpose is the legitimate interest of Universia in improving the security of our Service and in generating intelligence that helps us and third parties to ascertain trends in training, and in using this knowledge for other purposes. Any perceptions and lessons we obtain from the aggregate analysis of anonymous information will not affect Users directly.

We have conducted a weighting analysis to ascertain whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this analysis through the contact channels indicated. However, there follow some of the main conclusions obtained from the analyses performed: anonymisation represents a genuine interest on our part which is totally lawful, it is proportionate because there are no less invasive measures to enable us to implement our interest, it has no adverse impact on you, and it is also a habitual practice in the sector.
Fulfilment of legal obligations.Lastly, Universia may process Data to fulfil any applicable legal obligations. For example, fulfilment of tax obligations, fulfilment of instructions received from courts of justice etc.

What is the legal basis for this processing?

The legal basis for this processing is that we need to process your Data to be able to fulfil obligations imposed by law.

4. DATA RETENTION PERIOD

The Data will be retained for as long as the contractual relationship that binds us to Users is in place, as regulated by the General Conditions of Use.

Nonetheless, for the purposes for which we have requested the consent of the User, or which the User has the option of challenging, we will stop processing your Data beforehand if the User withdraws their consent or objects to us continuing to process them, provided our legitimate interests, in the last case, no longer prevail. If the User withdraws their consent or exercises the right of erasure, their personal data will be blocked for the periods laid down in law to respond to any liability that may arise from their processing, for the formulation, the exercise and/or the defence of potential claims, provided this is permitted by applicable legislation, or in order to make the Data available to judges and courts or to the competent public authorities. During this additional period, Universia shall retain the Data of the User in blocked format. That means we will not use it for the initial purposes, but solely for those described in this paragraph and until the statute of limitations expires on any possible lawsuits that may be brought. At the end of this extra period, we undertake to stop processing all the Data.

In cases where the data subjects on particular Programmes accept the transfer of their CV data to the Local Bank and to Banco Santander, S.A., in relation to recruitment processes, the entity receiving these data shall retain them for a period of three years only. At the end of this period, the data will remain blocked for the legally established period prior to their erasure.

Additionally, for those Users who have only subscribed to the news newsletter, Universia will cease processing their Data for that purpose when the user revokes their consent or finally registers in the Portal.

5. DATA RECIPIENTS

Data concerning Users will be shared with the entities mentioned below:

Institutions. The Data will be transferred by the Data Controller to the Institution that has granted or has to grant the corresponding Programme and/or where the training is taken.

We wish to inform Users that the Portal is international in scope, meaning Institutions located both inside and outside the European Union may register on it. If the User goes on a Programme by an Institution located outside the European Union, the User is aware that their data will be sent to this Institution and to the Institution at which the Programme is carried out, if this is different. In this regard, the User is informed that the processing of data outside the European Union may entail a security risk concerning these data, which would no longer be protected by the safeguards required under European regulations in the absence of a Commission decision concerning adaptations with respect to the third country concerned. We wish to remind Users that such transfers are lawful because they are necessary for the performance of the General Conditions of Use and because they are occasional, as they will only take place when Users decide to enrol on the Programmes.
Santander Group entities. Also, the Data of any Users that have previously granted consent by means of the consents set out in the User register will be sent to the Local Banks and/or to the Local Universias to enable them to send their own commercial communications and those of third parties, if the User has granted consent in accordance with point 3 of this Privacy Policy.

Users may consult the identity of the specific Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence for the purposes of commercial communications, by clicking here

Subject to consent by the User, the Data Controller will likewise send Data to the Local Banks and to Banco Santander, S.A. (Spain), to enable them to contact the User in connection with selection and recruitment processes to fill positions within Santander Group.

Users may consult the identity of the specific Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence for the purposes of HR selection processes, by clicking here

There are Santander Group entities located outside the European Union, even in territories classified as "unsecure" according to the European Commission. In this regard, the User is informed that the processing of data outside the European Union may entail a security risk concerning these data, which would no longer be protected by the safeguards required under European regulations in the absence of a Commission decision concerning adaptations with respect to the third country concerned. Therefore, unless otherwise specified, we will exclusively transfer the Data of Users in accordance with standard contractual clauses approved by the European Commission, and if need be these will be enhanced by additional measures. The Data Controller will not be held responsible for and cannot guarantee the security of the transferred data.
Public bodies and authorities for the performance of their duties. On occasion, applicable legislation may require information to be shared with public bodies or authorities, so that they may perform their duties. For example, tax authorities or courts of justice, who would use your Data for their own purposes.
Service providers. They are entities that help us with different matters relating to management of the Service, such as technological infrastructure, storage, or sending marketing communications or services for Users. At Universia we ensure that all of our service providers that might have access to your Data act in confidence and in compliance with applicable data protection regulations. We have signed agreements with them to regulate and restrict their use of your Data to the provision of the Service and to establish the security measures they must adopt to protect the Data. These providers never use your Data for their own purposes, but simply to help us provide you with the Service.

Some of these service providers are located or may access Data of Users outside the European Economic Area. We have therefore adopted appropriate safeguards to ensure that the Data is processed with a level of protection equivalent to that afforded in the European Economic Area. In particular, these transfers may be pursuant to the adoption of standard contractual clauses approved by the European Commission, and where required these have been enhanced by additional measures.

Users can see which specific Data are sent to the aforementioned Recipients in section 3 of this Privacy Policy.

Users may request additional information in relation to international transfers of Data to non-secure territories and on the risks involved. They may likewise obtain a copy of the safeguards and protection measures to have been adopted by writing to the postal address provided in section 1.

6. RIGHTS OF DATA SUBJECTS

Users have the right to access their Data, and to request the rectification of any inaccurate data, that the processing be restricted, or request they be erased when, among other reasons, the data are no longer necessary for the purposes for which they were gathered, as well as not to be subject to automated individual decisions. In certain circumstances and for reasons relating to their own specific situation, data subjects may oppose the processing of their data. The Data Controller shall cease to process the Data, except in the event of compelling legitimate reasons, or the exercise of claims or defence of claims.

Users will also have the right to request the portability of their data where this is technically possible.

For the purposes of exercising their rights, data subjects may use the following Contact Form, or write a letter to Ciudad Grupo Santander. Avda de Cantabria s/n, Santander Universities, 28660 Boadilla del Monte, Madrid, Spain, attaching a copy of their identity document.

Data subjects have the right to lodge a complaint with the Spanish Data Protection Agency at Calle Jorge Juan 6, 28001, Madrid or its online address www.aepd.es

We wish to remind you that as a User you have the right to withdraw your consent for marketing purposes at any time by writing to the above addresses.

7. AMENDMENT TO THE PRIVACY POLICY OF END USERS

We may amend this Privacy Policy at any time, pursuant to applicable legislation, but we will inform Users with sufficient notice of any important changes that may have a significant impact on their privacy. We will also publish the amended Privacy Policy on our Portal, where Users will be able to check the date it was last updated. If necessary, depending on the nature of the amendment we make, we may ask Users to grant their consent again.

Last modification date: 28/03/2023