Additional and detailed information on the use of your personal data

1. Who is responsible for processing your personal data?

Company name: Instituto Tecnológico de Castilla y León (Castile and León Institute of Technology)
Tax ID number: G09226606
Address: C/ López Bravo 70, 09001 Burgos
Email: info@itcl.es
Website: www.itcl.es

2. Applicable regulations

Our Privacy Policy has been designed in accordance with the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), with Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, and its implementing regulations.
The entity may modify this privacy policy to adapt it to new legislation, case law or interpretations by the Spanish Data Protection Agency. These privacy conditions may be supplemented by the Legal Notice, Cookies Policy and General Conditions that, where applicable, are included for the sale of certain products or services, if such access involves any special provisions regarding the protection of personal data.

3. Purpose of the processing of personal data

We process your personal data for the following purposes:

1. To manage your requests through the contact form.
2. To send you the Newsletter if you have subscribed to it.
3. To correctly process your CV submission through the corresponding form.
4. To enable the receipt and processing of complaints about irregular conduct, serious or very serious administrative offences, crimes or regulatory breaches, both of the applicable legislation in force and of the internal regulations and commitments established by the entity in relation to the activity carried out by the company.
5. Respond to requests from citizens in the exercise of their rights under data protection regulations.

4. Legitimacy for processing the data collected

1. Contact form: The legitimacy for processing your data is your express consent at the time of providing us with the information, expressed by ticking the corresponding acceptance box.
2. Newsletter: The legal basis is your express consent to subscribe to it.
3. CV submission form: The legal basis for processing is the implementation of pre-contractual measures or the intention to conclude a contract.
4. Whistleblower channel: Processing necessary for compliance with a legal obligation applicable to the data controller.
5. Attention to the rights of data subjects: Processing necessary for compliance with a legal obligation applicable to the data controller. 

5. How long will we keep your data?

1. Contact form: We will keep your personal data from the moment you give us your consent until you revoke it or request the limitation of the processing. In such cases, we will keep your data blocked for the legally required periods.
2. Newsletter: We will keep your personal data for this processing until you withdraw your consent to receive the newsletter.
3. CV submission form: We will keep your personal data for this processing for the duration of the selection process or for 12 months if you have given your consent.
4. Whistleblower channel: The data being processed may be kept in the information system only for the time necessary to decide whether to initiate an investigation into the reported facts.
   If, three months after receipt of the communication, no investigation has been initiated, the data will be deleted, unless the purpose of the retention is to leave evidence of the functioning of the system.
5. Attention to the rights of data subjects: Data will be retained for the time necessary to resolve complaints. The provisions of the regulations on archives and documentation shall apply.

6. Transfers

Your data will not be transferred, except:

• Compliance with legal obligations.

7. International transfers

No international transfers will be made.

8. Security measures

As part of our commitment to ensuring the security and confidentiality of your personal data, we inform you that we have taken the necessary technical and organisational measures to guarantee the security of your personal data and prevent its alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the data stored and the risks to which it is exposed. Notwithstanding the above, users should be aware that security measures on the Internet are not impregnable.
You can obtain more information about the security measures we apply by contacting us through the channels indicated at the beginning of this Privacy Policy in the section identifying the Data Controller.

9. Rights of the Data Subject

The data subject has the following rights regarding the processing of their personal data, and may exercise these rights by contacting the Data Controller:

• If the legal basis for the processing is consent, the right to withdraw consent at any time, without this affecting the processing prior to its withdrawal.
• The right to request access to their personal data.
• Right to request rectification if they are inaccurate, or to request their deletion (for example, if you consider that they are no longer necessary for the purposes for which they were collected).
• Right to request the limitation of their processing, provided that any of the conditions set out in the regulations are met, in which case we will only keep them for the exercise or defence of claims.
• Right to object to processing, for example, regarding the sending of commercial information by us, in which case we will stop processing your data for that purpose, except for compelling legitimate reasons, or the exercise or defence of possible claims.
• Right to data portability.
• Right to lodge a complaint with the Spanish Data Protection Agency (the competent data protection supervisory authority), especially when you have not obtained satisfaction in the exercise of your rights: www.aepd.es