Privacy policy

Universia Holding, S.L. ("Universia" or the "Data Controller") wishes to inform users ("Users" or "User" in singular) concerning its personal data protection policy, which sets out the processing of data on the portal accessible via the following domains: https://www.becas-santander.com, www.santander-grants.com and www.bolsas-santander.com (jointly or separately, "the Portal").

The Portal is a space created by Universia to bring together Users and universities or other institutions ("Institutions") which post scholarships and/or courses (the "Programmes"), and other functions described in the General Conditions of Use. Basically, Users, who may be students, teachers, associates etc., may use the Portal to review, enrol, manage or coordinate Programmes, participate in specific communities for some of the Programmes or ascertain which Programmes may be useful to them in their training process (the "Service"). Users may also take up courses offered by Universia. The Portal is international in scope, meaning Users and Institutions located both inside and outside the European Union may register and/or participate in its activities. In addition to the Institutions, the Programmes may have been financed by third-party organisations (the "Promoters"), with which the Institution may jointly manage the Programme or to which it may provide access to details of the programme, since they have financed the Programme.

This Privacy Policy sets out the purposes for which we process the personal data of Users, the reasons why the processing is lawful, how long we store the data, the entities with which we share them, the rights that may be exercised and other matters that we consider important in order for Users to clearly understand what we are going to do with their data when they use the Service.

When we say "personal data", we mean all information related to Users which they provide us with directly, which they have generated by using our Service or which we have inferred concerning them, provided they feel it is appropriate for us to analyse their profile (the "Data"). Specially protected data or information considered "sensitive" will not be processed.

Universia informs Users that the processing of Data carried out by the Institutions or Promoters to implement the Programmes posted on the Portal will be subject to their own privacy policies. This Privacy Policy therefore merely informs Users on the processing carried out by Universia, including processing concerning courses offered directly by Universia.

Users must only supply in each case data marked with an asterisk or marked as mandatory, since they are considered necessary to enjoy the Service. In this regard, it is possible that additional data may be requested in some functions. For example, to enrol for a scholarship it is possible that academic and/or employment data may be requested, or, in the case of User Communities, Users may be allowed to complete their profile on a voluntary basis with additional information, such as the company at which they work.

1. DATA CONTROLLER

Identity of the Data Controller:

Universia Holding, S.L

An entity filed with the Mercantile Registry of Madrid in 2005, at volume 16547, sheet 107, page number M-28189, entry 4, with corporate tax number B82976515 (the “Data Controller”).

Data controller contact details:

Postal address: Ciudad Grupo Santander. Avda de Cantabria s/n, 28660 Boadilla del Monte, Madrid

E-mail: derechosarcobecas@universia.net

Contact details of data protection officer: dpo@universia.net

2. DATA WE PROCESS AND ORIGIN OF THE DATA

On the Portal, we process Data that Users have provided us with directly both during and after the registration process by using our Service, enrolling on Programmes, using the Programmes' Communities, going on courses and browsing the Portal.

Specifically, we obtain the following data: full name, country of residence, e-mail, date of birth, curriculum vitae, training or qualifications and data concerning browsing and use of the Portal (IP address, enrolment on Programmes, profile data, participation and interaction in Communities or contents marked as favourites).

Finally, we inform Users that we obtain information on browsing habits via cookies. For more information in this regard, we recommend Users consult our Cookies Policy.

3. PURPOSES OF AND LEGAL BASIS FOR PROCESSING

  1. Management of the User's registration on the Portal and enjoyment of the Service. The Data Controller will process any Data of Users entered on the relevant form to register these data on the Portal to the extent that they can be identified. Likewise, Universia will process the Data for all processing that is necessary to permit the use of all the functions of the Service that are employed by the User, such as enrolment in Programmes, participation and interaction in User communities associated with the Programmes ("Communities") and take training courses and assess your skills using the "Assessment Center" feature.

    Users are advised that if they wish to take part in Communities, they must provide some data on their profile, so that other users in the Community will know who they are interacting with. However, other data are optional, and will only be visible if the User supplies them voluntarily.

    n relation to our Assessment Centre, we wish to inform our Users that these analyses will not be carried out for any purposes other than providing Users with strong points and improvement points in connection with their competences and skills, in order to enable them to ascertain which Programmes or courses are appropriate for them. In short, this is a function which is provided exclusively for Users. Universia does not make any automated decisions that have any effect on Users.

    What is the legal basis for this processing?

    The legal basis that enables this data processing is the performance of a contract put in place through acceptance of the General Conditions of Use.


  2. Transfer of data to Institutions and Promoters for proper implementation of the Programme. When Users enrol on a Programme, the Data Controller will send certain Data to the Institution that has granted or must grant it the Programme concerned, and to the Promoter that has sponsored, promoted or financed it, if they are not the same, to enable the Programme to be carried out (each Programme shall identify the Institution and the Promoter that will receive User data from the Controller). Also, on certain occasions the Programmes entail mobility of the User, i.e. they are run with a different Institution, to which Universia will also send the Data in order to manage the necessary processes to enable the Programme to be run.

    We wish to inform Users that transfer of these Data is necessary to take part in the Programmes, and to execute the General Conditions of Use and the specific conditions of the Programme concerned. Occasionally, the Institutions are located in countries that are not secure or are outside the European Union.

    The Data that will be sent are as follows: full name, country of residence, e-mail, date of birth and data concerning browsing and use of the Portal (IP address, enrolment on Programmes or contents marked as favourites).

    What is the legal basis for this processing?

    The legal basis that enables this processing is the performance of a contract put in place through acceptance of the General Conditions of Use and any specific conditions of the Programme concerned stipulated by the Institution concerned. We also consider that transfers to Institutions with Programmes on which Users enrol qualify as occasional transfers, as we will only transfer the Data when Users decide to enrol. Both instances justify the international transfers we may perform when transferring the Data of these Users to Institutions located outside the country in which the Users are located, in countries not recognised as secure by the data protection authorities.


  3. Sending, by any means, of own communications of an academic nature that are personalised on the basis of the User profile.Our intention at all times is to provide Users with content that may interest them. To this end we will draw up a profile on the User, employing factors such as the data they have supplied to us and data on their browsing and use of our Portal (IP address, enrolment on Programmes, content marked as favourites) or on third-party platforms forming part of the same network (in the last-mentioned case, only when the User has granted their consent to the installation of cookies or other tracking devices when accessing the Platform).

    We will use this profile to send them customised, exclusively academic communications, which may be in relation to courses, grants, employment, training, workshops and others.

    What is the legal basis for this processing?

    The legal basis that enables this personal data processing is that it is of legitimate interest of the Data Controller. Specifically, the Data Controller wishes its Users to have knowledge of the various functions and opportunities available on the Portal, and similar opportunities, and to interact and use the Portal as much as possible, to help Universia remain relevant in the academic sector. The Data Controller also wishes to draw up a profile on Users, since we have no interest in sending generic communications that do not match what we have found to be the interests of each User, and also to make the Portal useful and precise, and for users to use it as much as possible.

    At Universia we have conducted a weighting analysis to determine whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this analysis through the contact data indicated. However, there follow a few of the main conclusions obtained from the analyses performed: the profiling and the sending of customised communications represent a genuine interest on our part which is totally lawful; it is proportionate because there are no less invasive measures to enable us to implement our desire for you to familiarise yourself with the opportunities we are offering and for our Portal to not be generic, but rather useful and relevant; it has no adverse impact on you, and in fact enables us to send you offers, calls or academic content which we believe will facilitate your training and improve your job prospects; you may opt out of these communications at any time, right from the outset; and this is also a habitual practice in the sector.


  4. Transfer of Data to Santander Group based in the User's place of residence (respectively, "Local Bank" and "Local Universia*"), to enable them to send, by any means, including electronic media, their own customised commercial communications and those of third parties.The Data Controller will transfer Data belonging to Users that have given their express consent to the Local Bank and the Local Universia concerned so that they may separately send own and third-party marketing communications and/or communications of an academic nature that may refer, for example, to banking products, insurance products, telecommunications, education, leisure, research, vehicles, consumer goods, employment, culture, professional opportunities, textile, transport, insurance, catering, technology, food, television, radio, portals and Internet comparison tools. The commercial communications will be customised (because those parties are not interested in sending generic communications) and based on the profile of the User, which will comprise (i) Data we give them (these may be consulted below) and (ii) any data they already had on the User that the User had already supplied to them outside the Portal, if any.

    What is the legal basis for this processing?

    The legal basis for this processing is the express consent provided by the User. If the User does not initially provide their consent, or has provided it but then revokes it in the future, they will still be considered a User and their enjoyment of the Service will not be affected. Consent also covers transfer of data that would be carried out by the Data Controller if the User resides in an "insecure country". More information on international transfers can be found in section 5 of this Privacy Policy.

    *Users may consult the identity of the Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence, by clicking here

    The Data that will be sent are as follows: full name, country of residence, e-mail, date of birth and data concerning browsing and use of the Portal (IP address, enrolment on Programmes or contents marked as favourites).


  5. Profiling for marketing purposes and sending via any channel, including digital ones, of marketing communications regarding own and third-party services and products.

    Our intention at all times is to offer you content that we believe will interest you. Universia may send you own and third-party marketing communications regarding products and services that may, for example, relate to banking products, insurance products, telecommunications, education, leisure, research, vehicles, consumer goods, employment, culture, professional opportunities, textile, transport, insurance, catering, technology, food, television, radio, and Internet comparison tools and portals.

    The marketing communications will be personalised based on your profile, as we are not interested in sending you generic communications. When carrying out this profiling, we will rely on factors such as (i) your Data (including basic identification and details of your browsing habits on our Platform, such as the type of Processes you register for, etc.), or (ii) data regarding you that comes from third-party platforms that belong to the same advertising network as us (in this case, only when you have accepted the installation of cookies or other monitoring devices when accessing the Platform).

    What is the legal basis that allows us to do this? The legal basis for this data processing is your express consent. If you do not initially provide your consent, or you provide it but then revoke it in the future, you will still be considered a User and your participation on the Platform will not be affected.


  6. Competitions, promotions, prize draws and other events via the Portal or social networks.With a certain frequency, the Data Controller publishes contests, promotions, draws and other events on the Portal or on social media so that Users can take part and have a chance of winning the prizes on offer.

    What is the legal basis for this processing?

    This processing will only take place upon acceptance of the legal terms for each promotion, draw, contest or event, and this will be the contract that legitimises the processing of data.


  7. Statistical surveys on the functioning of the technology that supports the Service in order to make technical improvements or improvements to security, to operation and usability and commercial improvements.The Data Controller will process all information obtained through the interaction of Users with the Portal and the Service, in order to generate metrics and aggregate information with which to assess the status and utility of the Service, correct errors, make it more secure and user-friendly, and improve it.

    What is the legal basis for this processing?

    The legal basis that enables this data processing is the legitimate interest of the Data Controller. Our interest is that we can use information on utilisation of the Service to gain an insight into the impact and utility of the Programmes and courses, and correct and improve the Service, to make it user-friendly and secure for our Users and enable it to meet their actual needs. We wish to inform Users that we have conducted a weighting analysis to ascertain whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this analysis through the contact channels indicated. However, there follow some of the main conclusions obtained from the analyses performed: the performance of statistical analyses represents a genuine interest on our part which is totally lawful, it is proportionate because there are no less invasive measures to enable us to implement our interest, it has no adverse impact on you, and it is also a habitual practice in the sector.


  8. Resolution of consultations by Users.Universia will process the Data to manage and administer requests for information, doubts or other queries sent by the User (registered or not registered) through the contact form, and any actions and operations that may arise from these.

    What is the legal basis for this processing?

    The processing is carried out on the basis of the legitimate interest of Universia in properly resolving any concerns of Users and improving satisfaction with the Service, and, where applicable, in meeting any legal obligations that may be applicable in relation to customer service. Users may ask Universia to provide them with a copy of the weighted judgment generated from the contact data already supplied.

    We have conducted a weighting analysis to ascertain whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this through the contact data indicated. However, there follow some of the main conclusions obtained from the analyses performed: the resolution of doubts and queries represents a genuine interest on our part which is totally lawful, it is proportionate because there are no less invasive measures to enable us to implement our interest without processing the data of Users lawfully, it has no adverse impact on you (on the contrary, in fact, for it propitiates fluid communication with Universia), the processing of data is not imbalanced, and it is also a habitual practice in the sector.


  9. Transfer of Data to the Local Bank* and to Banco Santander, S.A. (Spain) to enable them to contact data subjects for potential selection processes.When Users specifically grant consent, the Data Controller will transfer the Data of Users who have given their express consent to the Local Bank to enable the latter to contact them to take part in its selection processes. Likewise, the Data will also be sent to Banco Santander, S.A. (Spain), as parent of the Group, for global recruitment processes. Thus, for example, if the User is resident in Brazil, their data will be transferred to the Local Bank in Brazil and to Banco Santander, S.A. (Spain).

    What is the legal basis for this processing?

    The legal basis for carrying out this processing is the express consent provided by the User. If the User does not initially provide their consent, or has provided it but then revokes it in the future, they will still be considered a User and their enjoyment of the Service will not be affected. Consent also covers transfer of data that would be carried out by the Data Controller if the User resides in an "insecure country". More information on international transfers can be found in section 5 of this Privacy Policy.

    *Users may consult the identity of the specific Local Bank to which Universia will transfer their Data, depending on their country of residence, by clicking here

    The Data that will be sent are as follows: full name, country of residence, e-mail, date of birth, curriculum vitae, data on training or qualifications and data concerning browsing and use of the Portal (IP address, enrolment on Programmes, profile data, participation and interaction in Communities or content marked as favourites).

  10. Profiling for use in behaviour patterns to suggest products and recommendations. When users accept the processing of personal data obtained from online identifiers, such as analytical and advertising cookies, the data controller may carry out profiling of their behaviour, in which the information generated by the users in their profile will also be taken into account. 

    This profiling will be performed using a tool that automatically executes an analysis of behaviour patterns to allow recommendations to be shown to users, in the Portal, on acquiring products and/or services that may better match their interests, according to the behaviour patterns. For more information, go to this link, where the details are given of the data processing that will be carried out based on this tool.

    Specifically, to carry out this activity, the controller will process data obtained by observing the browsing habits of users on the portal, and by monitoring and analysing these users' behaviour when they browse this web environment (in particular, we will process your IP address, enrolment in programmes, profile data, participation and interaction in communities or content marked as favourite and browsing habits through cookies). 

    The controller will also process the following categories of data: full name, country of residence, e-mail, date of birth, curriculum vitae, training and qualifications.
    With this information, the controller will analyse users' interests to determine which of our products and services best match their profile, so that we can show them, in the portal, recommendations that match their preferences.

    What is the legal basis for this processing?

    This processing involves acceptance of the terms and conditions of cookies consent and the automated profiling based on legitimate interest:

    (i)            Consent for the use of behavioural parameters: 
    Universia will process the personal data obtained from the use of analytical and advertising cookies, as long as the user has given express consent for such purposes on the cookie configuration panel. For more information, see our Cookies Policy.  

    (ii)           Legitimate interest to carry out automated profiling:
    This processing is necessary to satisfy the legitimate interests of Universia. However, users have the option to object to this processing of their personal data. 

    We inform you that Universia's predominant interest in carrying out this data processing is to improve the offer of content and adapt it to the user's profile, thus offering information about products that may be of interest on the portal. 

    In particular, Universia has an interest in its users being able to access the content that interests them more easily and for searches on the portal to be more agile and personalised, so that they can find the product they are looking for, according to its characteristics, more quickly.

    In accordance with the provisions of the data protection regulations, Universia has carried out the corresponding weighting analysis and balancing tests to confirm that the legitimate interest of the controller does not harm the interests of the users. The conclusion we draw from these tests is that the legitimate interest of the controller is shown to be a truly legitimate interest since this activity seeks to achieve a higher level of conversion, a more personalised value offer and an improved user experience on the portal. Consequently, we understand that this processing does not constitute an impediment to the normal exercise of the users' rights and freedoms, and that it is also a common practice in the sector.

  11. Anonymisation of Personal Data.We will convert the Data of Users into anonymous data and we will analyse them on an aggregate basis with many other anonymous data in order to ascertain patterns and extract perceptions and intelligence on trends in training, improve the security of our technology and other objectives. The Data that will be sent are as follows: full name, country of residence, e-mail, date of birth and data concerning browsing and use of the Portal (IP address, enrolment on Programmes or content marked as favourites).

    What is the legal basis for this processing?

    The legal basis of this purpose is the legitimate interest of Universia in improving the security of our Service and in generating intelligence that helps us and third parties to ascertain trends in training, and in using this knowledge for other purposes. Any perceptions and lessons we obtain from the aggregate analysis of anonymous information will not affect Users directly.

    We have conducted a weighting analysis to ascertain whether we could effectively carry out this processing on the basis of our legitimate interest. Users may ask us for this analysis through the contact channels indicated. However, there follow some of the main conclusions obtained from the analyses performed: anonymisation represents a genuine interest on our part which is totally lawful, it is proportionate because there are no less invasive measures to enable us to implement our interest, it has no adverse impact on you, and it is also a habitual practice in the sector.

  12. Fulfilment of legal obligations.Lastly, Universia may process Data to fulfil any applicable legal obligations. For example, fulfilment of tax obligations, fulfilment of instructions received from courts of justice etc.

    What is the legal basis for this processing?

    The legal basis for this processing is that we need to process your Data to be able to fulfil obligations imposed by law.

4. DATA RETENTION PERIOD

The Data will be retained for as long as the contractual relationship that binds us to Users is in place, as regulated by the General Conditions of Use.

Nonetheless, for the purposes for which we have requested the consent of the User, or which the User has the option of challenging, we will stop processing your Data beforehand if the User withdraws their consent or objects to us continuing to process them, provided our legitimate interests, in the last case, no longer prevail. If the User withdraws their consent or exercises the right of erasure, their personal data will be blocked for the periods laid down in law to respond to any liability that may arise from their processing, for the formulation, the exercise and/or the defence of potential claims, provided this is permitted by applicable legislation, or in order to make the Data available to judges and courts or to the competent public authorities. During this additional period, Universia shall retain the Data of the User in blocked format. That means we will not use it for the initial purposes, but solely for those described in this paragraph and until the statute of limitations expires on any possible lawsuits that may be brought. At the end of this extra period, we undertake to stop processing all the Data.

In cases where the data subjects on particular Programmes accept the transfer of their CV data to the Local Bank and to Banco Santander, S.A., in relation to recruitment processes, the entity receiving these data shall retain them for a period of three years only. At the end of this period, the data will remain blocked for the legally established period prior to their erasure.

5. DATA RECIPIENTS

Data concerning Users will be shared with the entities mentioned below:

  • Institutions. The Data Controller shall send the Data to the Institution that has granted or is to grant the Programme concerned, and to the Institution where the Programme concerned is to be delivered, if this is a Programme entailing mobility on the part of the User.

    We wish to inform Users that the Portal is international in scope, meaning Institutions located both inside and outside the European Union may register on it. If the User goes on a Programme by an Institution located outside the European Union, the User is aware that their data will be sent to this Institution and to the Institution at which the Programme is carried out, if this is different. In this regard, the User is informed that the processing of data outside the European Union may entail a security risk concerning these data, which would no longer be protected by the safeguards required under European regulations in the absence of a Commission decision concerning adaptations with respect to the third country concerned. We wish to remind Users that such transfers are lawful because they are necessary for the performance of the General Conditions of Use and because they are occasional, as they will only take place when Users decide to enrol on the Programmes.

  • Users. Any Users that decide to take part in the Communities will keep their profile visible, along with the data associated with it for all members (with the exception of their e-mail). In this regard, the profile Data of Users and any interaction by users (comments, recommendations, messages etc.) will be visible to other Users in that Community, associated with their profile.

  • Santander Group entities. Also, the Data of any Users that have previously granted consent by means of the consents set out in the User register will be sent to the Local Banks and/or to the Local Universias to enable them to send their own commercial communications and those of third parties, if the User has granted consent in accordance with point 3 of this Privacy Policy.

    Users may consult the identity of the specific Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence for the purposes of commercial communications, by clicking here

    Subject to consent by the User, the Data Controller will likewise send Data to the Local Banks and to Banco Santander, S.A. (Spain), to enable them to contact the User in connection with selection and recruitment processes to fill positions within Santander Group.

    Users may consult the identity of the specific Local Bank and the Local Universia to which Universia will transfer their Data, depending on their country of residence for the purposes of HR selection processes, by clicking here

    There are Santander Group entities located outside the European Union, even in territories classified as "unsecure" according to the European Commission. In this regard, the User is informed that the processing of data outside the European Union may entail a security risk concerning these data, which would no longer be protected by the safeguards required under European regulations in the absence of a Commission decision concerning adaptations with respect to the third country concerned. Therefore, unless otherwise specified, we will exclusively transfer the Data of Users in accordance with standard contractual clauses approved by the European Commission, and if need be these will be enhanced by additional measures. The Data Controller will not be held responsible for and cannot guarantee the security of the transferred data.

  • Public bodies and authorities for the performance of their duties. On occasion, applicable legislation may require information to be shared with public bodies or authorities, so that they may perform their duties. For example, tax authorities or courts of justice, who would use your Data for their own purposes.

  • Service providers. They are entities that help us with different matters relating to management of the Service, such as technological infrastructure, storage, or sending marketing communications or services for Users. At Universia we ensure that all of our service providers that might have access to your Data act in confidence and in compliance with applicable data protection regulations. We have signed agreements with them to regulate and restrict their use of your Data to the provision of the Service and to establish the security measures they must adopt to protect the Data. These providers never use your Data for their own purposes, but simply to help us provide you with the Service.

    Some of these service providers are located or may access Data of Users outside the European Economic Area. We have therefore adopted appropriate safeguards to ensure that the Data is processed with a level of protection equivalent to that afforded in the European Economic Area. In particular, these transfers may be pursuant to the adoption of standard contractual clauses approved by the European Commission, and where required these have been enhanced by additional measures.

Users can see which specific Data are sent to the aforementioned Recipients in section 3 of this Privacy Policy.

Users may request additional information in relation to international transfers of Data to non-secure territories and on the risks involved. They may likewise obtain a copy of the safeguards and protection measures to have been adopted by writing to the postal address provided in section 1.

6. RIGHTS OF DATA SUBJECTS

Users have the right to access their Data, and to request the rectification of any inaccurate data, that the processing be restricted, or request they be erased when, among other reasons, the data are no longer necessary for the purposes for which they were gathered. In certain circumstances and for reasons relating to their own specific situation, data subjects may oppose the processing of their data. The Data Controller shall cease to process the Data, except in the event of compelling legitimate reasons, or the exercise of claims or defence of claims.

Users will also have the right to request the portability of their data where this is technically possible.

For the purposes of exercising their rights, data subjects may send an e-mail to derechosarcobecas@universia.net, or a letter to Ciudad Grupo Santander. Avda de Cantabria s/n, Santander Universities, 28660 Boadilla del Monte, Madrid, Spain, attaching a copy of their identity document.

Data subjects have the right to lodge a complaint with the Spanish Data Protection Agency at Calle Jorge Juan 6, 28001, Madrid or its online address www.aepd.es

We wish to remind you that as a User you have the right to withdraw your consent for marketing purposes at any time by writing to the above addresses.

7. AMENDMENT TO THE PRIVACY POLICY OF END USERS

We may amend this Privacy Policy at any time, pursuant to applicable legislation, but we will inform Users with sufficient notice of any important changes that may have a significant impact on their privacy. We will also publish the amended Privacy Policy on our Portal, where Users will be able to check the date it was last updated. If necessary, depending on the nature of the amendment we make, we may ask Users to grant their consent again.

Last modification date: 09/12/2021