Data protection

Who is the data controller for your data?

The data controller is Gredos San Diego, S. Coop. Mad. (hereinafter GSD), with Spanish Tax ID (NIF) F78037520, domiciled at C/ José Gutiérrez Maroto, nº 26, 28051, Madrid, with contact number 917861347, and email address: gsd@gsd.coop.

Data Protection Officer: dpo@adhocasesoreslegales.com

For what purposes do we process your personal data?

At GSD, we process the personal data of data subjects for the following purposes:

• The provision of teaching and purposes related to the teaching, educational and guidance functions.
• Management of relationships with students, their parents, guardians, or legal representatives, including administrative tasks related to the performance of the contractual relationship, such as, for example, billing, scholarships, and grants.
• Applying contractual or precontractual measures if necessary or derived from the purchase of services from any GSD centers or entities.
• Managing our employees’ working relationship. Managing job vacancies in our centers and relationships with applicants. Employment-mediation and job-search services through the “employment network” and the space on the website established for this purpose.
• Maintenance and management of the commercial relationship with our product and service providers.
• Providing complementary or extracurricular services and activities (including cultural and study trips, international exchanges, and foreign placements).
• Guaranteeing the safety of people, property, and facilities. Controlling access to our centers.
• Responding to queries made by users through the contact form on our website. When information is requested about a specific center, the request will be sent to said center to guarantee suitable management thereof. If information is requested from GSD Alcalá, the information provided will be transferred to EAC (Educación Activa Complutense), an affiliated worker cooperative dedicated to the teaching provided at said center, for the proper management of said request. To obtain more information about EAC, you can consult their website at www.eacomplutense.es
• Promotion of the Educational Center and its activities. Carrying out actions and/or communications related to our business activity, or to keep you informed of activities or services. For example, the publication of images and videos on the website, social media, or other media to raise awareness of the activities developed by the Center.
• Sending commercial communications through informative newsletters, as long as we have your consent, for: GSD and FUNDACION GSD products or services. Such as, for example, cafe services, extracurricular activities, etc. We will use your personal data in order to provide you with personalized information regarding our products and services. In this process, we will consider the information you provide to us, as well as your interest in a given academic stage or course and/or your academic center of interest. According to your request, we will seek to understand your preferences in order to offer you information suited to your interests and needs. Products, promotions, events, or services from companies belonging to the GSD group. Companies making up the GSD group: Endesys Ingeniería y Desarrollo de Sistemas, S. Coop. Mad; Clínica Physed, S. Coop. Mad.; Tosande, S. Coop. Mad.; El Mercante, S. Coop. Mad.; Artemus, S. Coop. Mad.; Educación Activa Complutense, S. Coop. Mad.
• In case of the rental or transfer of facilities, the data required will be that necessary to carry out the contractual service of said rental and, in the case of overnight stays, to comply with the obligations established in the basic regulations governing travelers.

For how long do we keep your data?

Personal data will be retained for the time necessary to comply with the purpose for which it was collected and to determine the possible responsibilities that may derive from said purpose and from the processing of data.

What categories of data does GSD collect?

With regard to students, applicable legislation permits educational centers to collect personal data for the teaching and guidance function thereof with regard to family and social origin and environment, personal characteristics or conditions, academic development and results, and any circumstances for which knowledge thereof will be required to teach and guide students.

On the other hand, taking into consideration the purposes mentioned in the previous sections, the following categories of data are subject to processing by GSD, as applicable to each data subject: Identification data: Name and surname, contact details (postal address, contact telephone number and email address), identity document, and image. Other personal data: Date and place of birth, age, sex, nationality, and native language. Academic data: Training and qualifications. Family data. Health data, if applicable. Professional data: Professional experience, membership of professional bodies and associations. Bank details. Business information: Activities, businesses and commercial licenses.

Legitimate basis. What is the legitimate basis for the processing of your data?

The legal basis for the processing of your personal data will be related to the purpose for which said data was collected. In this regard, the processing of your personal data will be justified by compliance with the teaching function, including the following conditions:

• The execution of the contract and the Organic Law on Education as the legitimate basis to carry out the provision of teaching and manage relationships with students, their parents, guardians, or legal representatives.
• The execution of the service-provision contract as the legitimate basis for the maintenance and management of the commercial relationship with our product and service providers, as well as for the rental and transfer of facilities, and overnight stays.
• The execution of the employment contract and compliance with a legal obligation as the legitimate basis for the management of the working relationship with our workers, as well as compliance with the obligations imposed by tax and social-security regulations.
• Compliance with a public-interest mission and legitimate interest and the legitimate basis for the use of video-surveillance systems, in order to guarantee the safety of people, property, and facilities.
• The consent granted by the data subject, or the establishment of contractual or precontractual measures, as the legitimate basis for the management of GSD job vacancies and relationships with applicants.
• The consent granted by the interested party as the legitimate basis to respond to queries made by users through the contact form on our website.
• The consent granted by the data subject as the legitimate basis for the processing of the data subject’s image for the purpose of promoting GSD and its activities.
• Legitimate interest or, as applicable, the consent granted by the data subject as the legitimate basis for the sending of information regarding GSD activities.

Recipients. To whom will your data be communicated?

In general, personal data will not be communicated to third parties, except in case of legal obligation, or consent granted by the data subject or their legal representatives.

If information is requested from GSD Alcalá, the information provided will be transferred to EAC (Educación Activa Complutense), an affiliated worker cooperative dedicated to the teaching provided at GSD Alcalá.

Mandatory or optional nature of information provided.

In all cases, the personal data we request is essential in order to correctly carry out the service, contract, provision, or activity requested by or established with the data subject, as well as to comply with our obligations to our students and offer an appropriate experience to each of our students, families, and users, as well as to maintain contact with each of you, providing the specific information that, in each case and as required, may be relevant.

Refusal to provide the requested personal data, or the delivery of inaccurate or incomplete data, may result in the impossibility of correctly providing the requested services. As such, the users—or, if applicable, their parents or legal guardians—or data subjects, will be responsible for the veracity of the data provided, as well as for communicating to GSD any changes thereto.

Rights. What are your rights when you provide your data?

Any person has to the right to obtain information about whether or not GSD is processing their personal data.

Data subjects have the right to access their personal data, as well as to request the correction of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was gathered. In such cases, GSD will communicate this to each of the recipients to whom said data subject’s personal data has been communicated.

In certain circumstances, data subjects may request the limitation of processing of their data, in which case it shall only be kept for the pursuit or defense of any possible claims.

In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. GSD will stop processing the data, except in the case of mandatory legitimate reasons, or for the pursuit or defense of any possible claims.

They will also have the right to withdraw consent at any time, without affecting the lawfulness of the data processing based on consent prior to its withdrawal.

Data subjects will have the right to receive the personal data referring thereto, which they have provided to GSD, in a structured, commonly used, and machine-readable format.

For the exercise of the rights mentioned in the previous sections, users may write to GSD’s registered address or to the email addresses of the Controller, unequivocally identifying themselves in both cases. In the case of any justified doubts with regard to the user’s identity, GSD may require additional information in order to suitably identify them.

We also inform you of your right to present a claim to the Spanish Data-Protection Agency (www.aepd.es), if you believe that your rights have not been respected in the processing of your data or after the exercise of your rights.

Security measures. 

GSD, with the aim of ensuring the effectiveness and efficiency of its Data-Protection Policy, has adopted the necessary technical and organizational security measures to avoid the alteration, loss, abuse, unauthorized processing and access, or theft thereof, bearing in mind the state of technology. Likewise, GSD has established measures to strengthen the confidentiality and integrity of information within its Organization, continually maintaining the supervision, control, and evaluation of processes to ensure respect for data privacy.