INSTITUT METRÒPOLI PRIVACY AND DATA PROTECTION POLICY

INSTITUT METRÒPOLI, as the person responsible for the processing of personal data, guarantees an adequate and consistent level of protection of natural persons with respect to their personal data, which is processed for the development of their powers, in accordance with the requirements of the General Data Protection Regulation (2016/679) and Organic Law 3/2018,  of 5 December, on data protection and guarantee of digital rights.

The INSTITUT METRÒPOLI processes personal data with full responsibility and loyally, and in accordance with the legal bases that allow the lawfulness of the processing, in compliance with the General Data Protection Regulation and Organic Law 3/2018, of 5 December, on data protection and guarantee of digital rights.

The INSTITUT METRÒPOLI applies the principle of transparency in the processing of personal data, providing interested parties with the information on the processing required by the GDPR and the LOPDGDD, in a concise, easily accessible, complete and easy-to-understand language; at the same time, it facilitates the exercise of rights by means of forms available to the interested parties.

On the other hand, INSTITUT METRÒPOLI has appointed a Data Protection Officer, in accordance with the provisions of Article 37.1.a) of the General Data Protection Regulation (2016/679) and Articles 34 and 36 of Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights. The contact email address of the Data Protection Officer is info@institutmetropoli.cat.

Information about the person responsible for the processing of personal data:

  1. Data controller. INSTITUT METRÒPOLI CIF. P0800013E,

Postal address: Bellaterra Campus, Plaça del Coneixement, Edifici MRA, P2, 08193 Bellaterra. Telephone: 935 868 880; E-mail: info@institutmetropoli.cat.

  1. Contact details of the Data Protection Officer: info@institutmetropoli.cat.
  2. Legal bases and purposes of the processing.

The processing of the personal data of the interested parties, derived from the competences and functions of the INSTITUT METRÒPOLI is based, in general, on the following legal bases:

General Data Protection Regulation 2016/679.

  • Article 6.1.c. The processing is necessary for compliance with a legal obligation applicable to the data controller. Carrying out the activities of the administration.
  • Article 6.1.e. The processing is necessary for the fulfilment of a mission carried out in the public interest or in the exercise of public powers conferred on the data controller. Carrying out the activities of the administration. Also the video surveillance activity of all the offices that belong to the Entity.

 

Organic Law 3/2018 on the protection of personal data and guarantee of digital rights.

  • Article 8. Data processing due to legal obligation, public interest or exercise of public powers. Carrying out the activities of the administration.
    • The processing of personal data may only be considered based on compliance with a legal obligation required of the controller, under the terms provided for in Article 6.1.c) of Regulation (EU) 2016/679, when so provided for by a rule of European Union law or a rule with the rank of law.
    • The processing of personal data may only be considered to be based on the fulfilment of a mission carried out in the public interest or in the exercise of public powers conferred on the controller, in the terms provided for in Article 6.1 e) of Regulation (EU) 2016/679, when it derives from a competence conferred by a regulation with the force of law.

 

  1. Data retention period (deletion of data)

The personal data of the interested parties will be kept for the time necessary for the fulfilment of the purposes that justify the processing, in accordance with the exercise of the powers and functions of the INSTITUT METRÒPOLI, and to determine the possible responsibilities derived from these purposes. The deletion of data will also address specific cases such as the processing of data by the video surveillance camera system, and sectoral regulations that require minimum retention periods; and subsequently in application of the legislation on public administration archives.

  1. Data protection rights and how to exercise them

The interested parties, owners of the data processed by the INSTITUT METRÒPOLI,  have recognised the exercise of their rights to data protection: access to their data, rectification of erroneous, inaccurate or incomplete data, and deletion when, among other reasons, the data are no longer necessary for the purposes for which the processing had justified.

In certain circumstances, the interested parties may request the limitation of the processing of their data, in which case they will only be kept for the exercise or defense of claims.

For reasons related to their particular situation, the interested parties may oppose the processing of their data. In this case, INSTITUT METRÒPOLI will cease processing this data except for legitimate reasons or for the exercise or defence of possible claims.

The portability of the personal data of the interested parties may also be carried out, provided that they are on those data collected whose purpose is not based on the fulfilment of a legal obligation, a mission of public interest or in the exercise of public powers conferred on the Data Controller of the same (only the exercise of the right of portability whose processing is based on the consent of the interested party and that the latter may be processing is carried out by automated means).

To exercise these rights, the interested party may contact the INSTITUT METRÒPOLI, presenting the corresponding form available to interested parties in the Electronic Register of the INSTITUT METRÒPOLI.

Likewise, if you are not satisfied with the response to the request to exercise your rights, and in any case, whenever you consider it appropriate, you may file a complaint with the Catalan Data Protection Authority through its apdcat.gencat.cat e-Office.

  1. Recipients of the data:

Other competent public administrations in the matter may be recipients of personal data, where applicable, the transfer having been based on a legitimate legal basis, in accordance with Article 6 of the GDPR and Article 8 of the LOPDGDD.

  1. International data transfers.

No international data transfers are planned.

  1. Origin of personal data

The personal data processed by INSTITUT METRÒPOLI, in fulfilment of a mission carried out in the public interest, in the exercise of public powers conferred on the data controller, in compliance with a legal obligation or in the execution of a contract, come directly from the interested parties or their representatives.

In the event that the data do not come directly from the data subjects, for example if they come from other public administrations, Article 14 of the GDPR will be complied with, providing the data subject with the additional information required when the personal data has not been obtained from the data subject, which specifically includes the obligation to inform about the origin of the data and the categories of personal data being processed.

Likewise, with regard to the right of citizens not to provide documents that are already in the possession of the acting administration or have been prepared by any other administration, the provisions of the current wording of article 28.2 of the Law on Administrative Procedure will apply, in accordance with the twelfth final provision of Organic Law 3/2018, on the protection of personal data and guarantee of digital rights.