General Privacy Policy of the website

• Data Controller: CUNEF S.L.U. Tax Identification Number: B86969235
• Address: Calle de Almansa, 101– 28040 MADRID
• Telephone: 91 444 51 61
• email: lopd@cunef.edu

A Data Protection Officer (DPO) is a legally established figure whose role is to provide information and advice regarding the organisation’s duties in terms of personal data protection, as well as to supervise compliance. For any questions related to the processing of your personal data, please contact CUNEF’s DPO:

• Address: Picón y Asociados Derecho y Nuevas Tecnologías, S.L. C/ Hermanos Pinzón 3, Bajo – 28036 Madrid.
• email: dpd@piconyasociados.es

We use the personal data provided by students to handle their registration process, as well as their requests for academic services or any other services specified during self-enrolment or related to their studies at this University (pursuing internships, participating in academic events, joining clubs, teams, or alumni events, etc.). For these purposes, the organisation may take photographs and record videos, which may contain both images and voice recordings, and use them for one or both of the following purposes:

• Educational purposes (e.g.: university assignments, projects, exams…). 
• To publicise and advertise CUNEF events in the organisation’s magazine or on its website or social media. Specifically, the organisation may take photographs and record videos of students when they participate in events or activities, interviews, award ceremonies and/or similar functions organised by the University, and disseminate them on the institution’s website, social media, corporate magazines or any other similar means of communication. By consenting to the use of their data for this purpose, students authorise CUNEF to process their image (including their voice, in videos) to promote the institution’s events, activities or services, as follows:
  1. Capture and reproduce, by any means used for this purpose, images of students during their participation or presence in the University’s ordinary or extraordinary activities and events.
  2. Publish images of students on any type of medium to advertise, promote or publicise activities and events that the University considers relevant for any journalistic, editorial, advertising or commercial purposes.
  3. Use images of students to illustrate news and other publications on the University’s portals and websites, including social media.
• Students grant CUNEF the right to fix, reproduce, distribute, publicly display and make copies of photographs and videos of them, with no limitation in terms of number, time and geographical scope, and without being entitled to any remuneration. The only exception and limitation are any uses that could breach the right to honour in the terms provided for in Organic Law 1/1982, of 5 May, on Civil Protection of the Rights to Honour, Personal and Family Privacy and One’s Own Image. Consenting to the use of their data for this purpose is not mandatory, although, if they do not provide consent, their image cannot be used for the purposes described above. 

Consenting to the use of their data for the purposes detailed above—except for the use of their image for publicity and advertising purposes, which is voluntary and requires their consent—is mandatory, as it is otherwise impossible to process their registration or the services and procedures related to their studies at this University.

CUNEF may also use students’ data to send them surveys on its academic services. Completing the surveys is completely optional and anonymous, so the only consequence of not doing so is that CUNEF will not have their opinion on the services received. CUNEF may also send surveys to alumni to find out their opinion regarding their employability, as set out in CUNEF’s Internal Quality Assurance System.

Additionally, if students provide their consent, CUNEF may send them commercial communications about news and services, as well as events that CUNEF organises or participates in, organised by companies in different industries (legal, financial, consultancy, auditing and investment banking). In any case, consenting to the use of their data for this purpose is voluntary and, if they do not, the only consequence will be that they will not receive said commercial information. Based on the information provided, we may create commercial profiles, to offer the services that best suit students’ interests. 

CUNEF will also process graduates’ personal and professional data to maintain the institutional relationship and provide them with information suited to their profile and interests on academic activities, continuing education programs, institutional events, networking initiatives, and opportunities for professional or academic collaboration, including participation in surveys, mentoring or strategic alliances.

By virtue of the above, and with the express consent of CUNEF students or graduates, CUNEF Universidad may use the information that they provide publicly on LinkedIn or other professional networks to update their profile in its databases and send them information adapted to their interests.

Students’ personal data will be stored for as long as they are students at CUNEF and, after that, until any liabilities related to their academic relationship with the institution expire, as per the current statute of limitations.

The University Student Statute (art. 29.3) states that professors and lecturers are required to keep exams and any assessment evidence until the end of the following academic year. In case of a request for review or an appeal against the grade and, in compliance with the aforementioned regulations, they will be kept until there is a final decision. Notwithstanding the foregoing, CUNEF may store exams and assessment evidence for longer, to accredit the quality of its academic services at the request of the relevant evaluation agencies. To this end, exams and assessment evidence will be stored for a maximum of six years, in accordance with RD 822/2021. 

This said, university diplomas, certificates and accreditations will be stored indefinitely, since, according to Royal Decree 1002/2010, of 5 August, on official university degrees (art. 20), interested parties may request, at any time and after paying the corresponding fees, a duplicate of the degree certificate in cases of loss,  theft, total or partial destruction or rectification of the original; this also applies to university-specific degrees, in accordance with Royal Decree 822/2021 (art. 36). 

Images and voice recordings of students captured during their participation in CUNEF activities and events for the purpose of publicity and advertising of said events will be stored indefinitely, unless students request their erasure via any of the contact means specified in this policy.

Anonymous information collected in surveys may be stored indefinitely. Graduates will only receive surveys for three years after graduation.

Data for commercial communications will be stored indefinitely, unless students request their erasure or express their wish to stop receiving such communications. In the case of graduates, their data will be kept as long as they do not oppose their use or request their erasure and, after that, until any liabilities related to their academic relationship with the institution expire, as per the current statute of limitations.

In the case of students’ data processed for the purpose of handling their registration, as well as their requests for academic services or any other services specified during self-enrolment or related to their studies at this University, the legal basis is serving a mission carried out in the public interest, by virtue of Organic Law 2/2023, of 22 March, on the University System, and fulfilling the existing contractual relationship with the student resulting from their enrolment in this University, regarding any services requested by them that are not directly related to the public service of higher education. When students’ image is captured for an academic purpose (university assignments, projects, exams, etc.), the legal basis is also fulfilling a mission carried out in the public interest.

When images are not captured for an educational purpose, but rather for publicity and advertising of events or activities in the organisation’s magazine, website or social media, CUNEF will obtain the consent of the parties involved, thus acquiring a legal basis.

In any case, CUNEF reserves the right to take photographs and shoot videos of all the activities and events that it organises, individually or with third parties. Therefore, any participants who wish for their image and voice to be captured and used for the above-mentioned purposes of publicity and advertisement must provide their consent. Any participants who do not consent must refrain from voluntarily participating in said photographs and videos. If their image is captured incidentally, it will not be considered an illegitimate invasion of privacy and personal image, and there is no need to obtain their express consent, in accordance with Organic Law 1/82, since the legal basis is the above-mentioned fulfilment of a mission carried out in the public interest.

In the case of graduates’ data, the legal basis for processing them is the University’s legitimate interest in fostering an alumni community and promoting their personal and professional development, guaranteeing that their data is protected at all times. However, graduates have the right to oppose this use of their data and may do so by any of the means specified in this privacy policy.

For the purpose of sending out communications aimed at informing students or alumni of the services offered by CUNEF, including news on the institution and the events it organises or participates in, or of processing the data published by students or alumni on LinkedIn or other professional networks to update their profile in CUNEF’s databases and send them information adapted to their interests, the legal basis is their consent. They may withdraw it at any time, or oppose the use of their data for commercial profiling, although this will not affect the lawfulness of any previous use of the information.

For the purpose of conducting surveys, the legal basis is CUNEF’s legitimate interest in learning students’ opinions on the academic services received and alumni’s opinions regarding their employability. This legitimate interest is considered to prevail considering that:

• Surveys are sent only to CUNEF students, graduates, and alumni.
• They are anonymous.
• The intrusion into their privacy is minimal.

However, please note you that you have the right to object to this processing of your data, and you may do so by any of the means specified in this policy.

If you become a friend or follower of CUNEF on social media, we will process your data to keep you informed of our events and activities via said media. The legal basis for this is your consent, and your data will be stored for as long as you remain a friend or follower. You may withdraw your consent at any time, although this will not affect the lawfulness of any previous use of the information. Providing personal data is optional, but, unless you provide the necessary information, it will be impossible for you to become a friend or follower on social media.

When users register directly via social media, we will process the data provided on said media only for the purposes described in their privacy policies, collecting the data required to complete our registration form. If we require additional information to register you on our website, you will be required to add it using our registration form, subject to the conditions set out in in this Privacy Policy.

If you submit your résumé, we will process your personal data to collect all the information required for the job/internship recruitment process. The data submitted for a specific ongoing recruitment process will be stored for the duration of said process and subsequently deleted, unless you are selected, in which case the data will be included in your employee file. Any applicants who are not selected and want us to store their résumé for future recruitment processes must request this explicitly via email. In this case, as well as when users submit their résumé spontaneously, simply for future reference, the data will be stored for a year after the information is last updated. It is your responsibility to keep your data up to date, especially in terms of education and experience. 

The legal basis for processing résumés submitted for a specific ongoing recruitment process is the existence of a pre-contractual relationship. Any additional data collected during the interview or candidate selection process will be processed on the same legal basis.

The legal basis for processing your résumé if you have asked us to store it after a recruitment process or you have submitted it spontaneously is your consent. You can withdraw this consent at any time, although this will not affect the lawfulness of any previous use of the information. 

Your data may be transferred to the following recipients:

• Relevant government agencies, for the cases and purposes established by law.
• Financial institutions that process billing and payments.
• Insurance companies where CUNEF holds the corresponding insurance policies.
• Universidad Complutense de Madrid, for students enrolled in CUNEF Affiliated Centre.
• CUNEF’s training and employment partners, to enable access to jobs/internships within the framework of the academic services offered by this University, always provided that the student registers in CUNEF’s internship platform and/or provides consent.
• Students’ parents or legal tutors, who will receive information on grades, enrolment or scholarships, provided that students have given their consent or are financially dependent on said parents/tutors. In these cases, a prevailing legitimate interest is assumed as a rule, enabling the transferring of the data without the need for students’ prior consent. Students can exercise their right to object within the limitations established by law.

Alumni may choose to receive information via WhatsApp. If so, their data (name and phone number) will be stored by WhatsApp LLC, located in the United States, which requires an international data transfer; nevertheless, this organisation, as a member of the Data Privacy Framework, https://www.dataprivacyframework.gov/list, offers adequate data protection guarantees. Users may refuse to receive information by this means at any time without affecting the lawfulness of any previous use of their data; in this case, the information will be sent via traditional means. 

Also, although this cannot be considered a data transfer, certain third parties, in their role as our suppliers, may process your data to fulfil their services. They do so according to our instructions, which prevent them from using them for other purposes, always in the strictest confidentiality and in compliance with a contract in which they undertake to meet the requirements set out in current regulations on personal data protection.

Everybody has the right to know whether or not we are processing their data. You have the right to access your data, to request that inaccurate data be rectified and also to request the erasure of data when, among other reasons, they are no longer necessary for the purpose for which you provided them.

Under the terms of the GDPR, you may request the restriction of the processing or transferring of your data, in which case we will only store them for the exercise or defence of legal claims.

Under certain circumstances, and for reasons related to their specific situation, users may object to the processing of their data. If you give consent for a specific purpose, you have the right to withdraw it at any time, although this will not affect the lawfulness of any previous use of the information. In such cases, we will stop processing your data or, where necessary, stop processing it for that specific purpose, except for compelling legitimate interests, or the exercise or defence of legal claims.

Additionally, data protection regulations allow you to object to being subject to decisions based solely on automated data processing, if applicable.

The following conditions apply to all the aforementioned rights:

• You can exercise them free of cost, unless your requests are manifestly unfounded or excessive (e.g., repetitive), in which case we may either charge a fee for the administrative costs incurred or refuse to act.
• You can exercise them directly or through a legal representative or volunteer.
• We must respond to you request within one month, although, depending on the complexity and number of requests, the period can be extended for another two months.
• It is our duty to inform you of how to exercise these rights and ensure that the necessary means are available. We cannot deny you the right to exercise your rights for the sole reason of choosing other means. If your request is submitted by electronic means, we will do our best to provide the information by these same means, unless you ask us to do otherwise.
• If, for any reason, your request is denied, we will inform you of the reasons within a maximum period of one month, and remind you that you may file a claim with a competent Control Authority.

To make it easier for you to exercise your rights, the links to the corresponding forms are included below:

• Right of Access Form
• Right to Rectification Form
• Right to Object Form
• Right to Erasure Form
• Right to Restrict Processing Form
• Right to Data Portability Form
• Rights in relation to automated decision making and profiling Form

All the aforementioned rights can be exercised using the contact details provided at the beginning of this Privacy Policy.

If you feel that your rights have been breached, especially if you tried to exercise them and did not receive a satisfactory response, you can file a claim with the Spanish Data Protection Agency (contact details at www.aepd.es) or another competent authority. You can also contact them for more information about your rights.

Students and graduates are responsible for ensuring that any information they provide is accurate. They are accountable for the truthfulness of the data provided, and must keep it duly updated, to ensure that it reflects their actual status at all times. Users will be liable for any false or inaccurate information that they might provide, and any damages this might cause to CUNEF or to third parties.

CUNEF undertakes to use the data provided solely for the purposes indicated in this Privacy Policy, guaranteeing their security and confidentiality. To this end, the organisation has implemented technical and organisational security measures to prevent data alteration, loss and unauthorised use or access, in accordance with applicable laws.

If you provide third-party data, you are solely responsible for having previously obtained their consent authorising us to process their data, after duly informing them of all the provisions of Article 14 of the GDPR.