PRIVACY POLICY OF THE METROPOLI INSTITUTE

  1. DATA CONTROLLER

INSTITUT METROPOLI is responsible for processing the data collected through the websites owned by www.institutmetropoli.cat, www.ohb.cat and www.institutinfancia.cat, relating to the development of its competences, services and functions, as well as other processing activities included in the processing activities of the REGISTER OF PROCESSING ACTIVITIES

Postal address. Campus de Bellaterra- Plaça del Coneixement, edifici MRA, p. 2-8193 Bellaterra (Cerdanyola del Vallès). Telephone. 93 586 88 80. Email. info@institutmetropoli.cat.

 

  1. DATA PROTECTION OFFICER

Contact details:

  1. INFORMATION ON DATA PROTECTION

The INSTITUT METROPOLI, as the data controller, guarantees an adequate and consistent level of protection for natural persons with respect to their personal data, which is subject to processing, in accordance with the requirements of the General Data Protection Regulation (2016/679) and Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights.

INSTITUT METROPOLI carries out processing personal data responsibly and fairly, and in accordance with legal bases that allow the legality of the processing in compliance with the RGPD and the LOPDGDD and has adopted technical and organizational security measures, appropriate to the risks objectively assessed and identified for the rights and freedoms of the interested parties,  to which the data processed and the treatments carried out by the INSTITUT METROPOLI could give rise.

 

The INSTITUT METROPOLI applies the principle of transparency in the processing of personal data, providing interested persons with information on the processing required by the RGPD and by the LOPDGDD, in a concise, easily accessible, complete manner and with easy-to-understand language; At the same time, it facilitates the exercise of rights through forms available to interested parties.

Electronic Ethics Mailbox

 

  1. REGISTRATION OF PROCESSING ACTIVITIES

The INSTITUT METROPOLI manages and maintains a record of the following processing activities carried out under its responsibility:

 

1 HUMAN RESOURCES MANAGEMENT 14 CHILDHOOD AND ADOLESCENCE INSTITUTE
2 PERSONNEL SELECTION 15 METROPOLITAN HOUSING OBSERVATORY
3 PROTOCOL AND COMMUNICATION (INSTITUTIONAL AGENDA) 16 ADMINISTRATIVE CONTRACTS
4 EVENTS AND EVENTS 17 COLLABORATION AGREEMENTS COLLABORATION
5 OFFICIAL STATISTICAL ACTIONS 18 SCHOLARSHIPS AND SUBSIDIES
6 SURVEYS 19 REGISTER OF INTERESTS AND PATRIMONIAL ASSETS
7 STUDIES AND RESEARCH 20 VIDEO SURVEILLANCE CAMERA SYSTEM
8 BUDGET AND ECONOMIC MANAGEMENT 21 ATTENTION TO DATA PROTECTION RIGHTS
9 REGISTRATION OF ENTRY AND EXIT OF DOCUMENTS 22 ACCESS TO PUBLIC INFORMATION

 
10 TRAINING, COURSES AND CONFERENCES 23 QUERIES, COMPLAINTS AND SUGGESTIONS
11 COMMUNICATION / INFORMATIVE INFORMATION 24 MANAGEMENT OF SECURITY BREACHES
12 DEBATE SPACE 25 INTERNAL ALERT SYSTEM
13 PROJECTS

 

 

  1. PURPOSE OF THE TREATMENT

5.1. PURPOSE OF PROCESSING THE PERSONAL DATA OF WEBSITE USERS

The personal data of the users of the websites, www.institutmetropoli.cat, www.ohb.cat and www.institutinfancia.cat , will be processed for the following purposes:

A. Respond to requests for information and/or queries made by web users, through contact forms.

B. Keep users informed, including by electronic means, about the services provided by INSTITUT METROPOLI.

C.Manage subscriptions to the METROPOLIS INSTITUTE NEWSLWTTER.

D.Manage registrations in the METROPOLIS MASTER

E.Manage subscriptions to the INSTITUTE OF CHILDHOOD AND ADOLESCENCE NEWSLETTER.

F.Manage registrations for INSTITUTO DE LA INFANCIA Y LA ADOLESCENCIA PROGRAMMES.

 

5.2. PURPOSE OF PROCESSING THE PERSONAL DATA OF DATA SUBJECTS RELATED TO SERVICES AND ACTIVITIES OF THE METRÓLI INSTITUTE.

The purposes of the treatment of the set of treatment activities of the INSTITUT METROPOLI, derived from its competences, services and functions are contained in the REGISTER OF TREATMENT ACTIVITIES.

 

  1. LEGAL BASIS FOR LEGITIMACY OF THE PROCESSING OF PERSONAL DATA

In accordance with article 6.1. of the General Data Protection Regulation, INSTITUT METROPOLI processes personal data on the basis of one of the following legal bases, as stated in the REGISTER OF PROCESSING ACTIVITIES:

a) The interested party gave his consent for the processing of his personal data for one or more specific purposes.

b) The treatment is necessary for the execution of a contract in which the interested party is a party or for the application at its request of pre-contractual measures.

c) The treatment is necessary for compliance with a legal obligation applicable to the person responsible for the treatment

e) The processing is necessary for the fulfilment of a mission carried out in the public interest

 

  1. RECIPIENTS OF PERSONAL DATA

The personal data processed by INSTITUT METROPOLI may be transferred to third parties, in certain cases, with the identification of the assignee of the data, for each treatment activity, as stated in the REGISTER OF TREATMENT ACTIVITIES.

 

  1. EXERCISE OF DATA PROTECTION RIGHTS

8.1. RIGHTS OF DATA SUBJECTS

A.Right of access. The right of interested parties to know whether the controller is processing their personal data and, if so, has the right to access this data and obtain the following information:

  • The purpose of the processing, the categories of personal data processed and the recipients or categories of recipients to whom the data has been communicated or will be communicated.
  • The expected period of conservation of personal data or the criteria used to determine it.
  • The right to request rectification or deletion of data from the controller, limitation of processing or the right to object to it.
  • The right to file a claim with a supervisory authority.
  • The origin of the data, when they have not been obtained from the interested party.
  • The existence of automated decisions, including profiling, the logic applied and the consequences of such processing.
  • In the case of international data transfers, the appropriate guarantees offered.

Document

B.Right of rectification. Right of interested persons to rectify their inaccurate personal data and to complete those that are incomplete.

The person in charge must communicate the rectification to each of the recipients to whom he has previously communicated the data, unless it is impossible or requires disproportionate efforts.

 

C.Right of deletion. Right of interested persons to obtain the deletion of their personal data, when:

  • The data is no longer necessary for the purpose for which it was collected.
  • The consent on which the treatment was based is revoked.
  • The interested party opposes the treatment.
  • The data has been processed unlawfully.
  • The data must be deleted to comply with a legal obligation.

 

D.Right of opposition. Right of interested persons to object to the processing of their personal data, when:

  • The treatment is based on the public interest or the exercise of public powers conferred on the person responsible, or on the legitimate interest pursued by the controller or by a third party. In this case, the opposition must be based on reasons related to their personal situation.
  • The controller must stop processing them, unless the controller proves a legitimate interest that prevails over that of the interested party or is necessary to exercise or defend claims.
  • The purpose of the processing is direct marketing, including profiling related to this marketing.
  • The processing is for statistical purposes or scientific or historical research and a reason related to your personal situation is invoked.

 

E.Right to restriction of processing. Right of interested persons to have their stored personal data marked, in order to limit their processing in the future. The limitation of processing implies that, at the request of the interested party, their personal data is no longer processed.

The limitation can be requested when:

  • The interested party has exercised the rights of rectification or opposition and while the person in charge determines if it is appropriate to attend to the request.
  • The treatment is illegal, which would determine the deletion of the data, but the interested party opposes its deletion.
  • The data are no longer necessary for processing, which would determine the erasure of the data, but the interested party opposes its deletion because it needs it to formulate, exercise or defend claims.

 

F.Right to data portability (if applicable)

The interested party has the right to receive their personal data that they have provided to a data controller in a structured, commonly used and machine-readable format, and to transmit them to another controller, if the following requirements are met:

  • The treatment is based on consent or on a contract.
  • The treatment is done by automated means.

On the other hand, this right cannot be exercised when the treatment is based on the fulfillment of a mission of public interest or inherent to the exercise of public power.

 

8.2.COM EXERCISE DATA PROTECTION RIGHTS

Interested persons can exercise their access rights before the INSTITUT METROPOLI; rectification; deletion; limitation of treatment; data portability, if applicable; opposition and not to be subject to automated individual decisions, including profiling.

Similarly, in data processing, the legitimacy of which is based on the consent granted by the interested party, the latter has the right to withdraw this consent at any time, without affecting the legality of the treatment based on the consent prior to its withdrawal.

To exercise these rights, interested persons can submit their application in person at the INSTITUT METROPOLI  Campus de Bellaterra- Plaça del Coneixement, edifici MRA, p. 2-8193 Bellaterra (Cerdanyola del Vallès), or at the electronic headquarters of the INSTITUTO https://www.institutmetropoli.cat/ca/seu-electronica/instancia-generica/. In any case, interested parties have the right, whenever they consider it appropriate, to file a claim with APDCAT https://apdcat.gencat.cat/ca/inici.

 

  1. CONSERVATION OF DATA

The METROPOLI INSTITUTE keeps the personal data it processes on servers in the EUROPEAN ECONOMIC AREA.

Personal data are kept in a manner that allows the identification of data subjects for no longer than necessary for the purposes of processing personal data; Personal data may be kept for longer periods provided that they are processed exclusively for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

 

In particular,  the data deletion periods are determined in each treatment activity under the responsibility of INSTITUT METROPOLI, included in the REGISTER OF TREATMENT ACTIVITIES.

 

Specifically, personal data processed by an access control system or video surveillance cameras will be kept for a maximum period of one month from their capture.

 

  1. ORIGIN OF PERSONAL DATA

The personal data processed by INSTITUT METROPOLI, in fulfillment of a mission carried out in the public interest, in the exercise of public powers conferred on the person responsible for the treatment, in compliance with a legal obligation, in execution of a contract or through the provision of consent by the interested parties, come directly from the interested parties or their representatives.

 

In the event that the data does not come directly from the interested parties, for example, if other public administrations proceed, article 14 of the RGPD will be complied with, providing the interested party with the additional information required when the personal data have not been obtained from the interested party, which specifically includes the obligation to inform about the origin of the data and about the categories of personal data being processed.