Privacy Policy

This Privacy Policy has been developed taking into account the provisions of current legislation on data protection: Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and the circulation of these data (hereinafter GDPR); and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD).

This Privacy Policy aims to inform the owners of personal data, for which information is being collected, the specific aspects related to the processing of their data, the purpose of the processing, the contact details to exercise the rights that assist you, the periods of storage of the information and security measures, among other things.

1.- Responsible Party

Business name: FUNDACIÓN ZARAGOZA LOGISTICS CENTER (ZLC)

CIF: G-50985993

Address: Av. Ranillas, 5, Building 5A (EXPO), ground floor, 50018 Zaragoza

Email (DPO contact): [email protected]

2.- Data processing

The personal data requested, where applicable, will consist only of those strictly necessary to identify and respond to the request made by the owner of the same, hereinafter the interested party. Such information shall be processed in a fair, lawful and transparent manner in relation to the data subject. Moreover, personal data will be collected for specific explicit and legitimate purposes, not being further processed in a way incompatible with those purposes.

The data collected from each data subject shall be adequate, relevant and not excessive in relation to the purposes for which they are collected in each case, and shall be updated whenever necessary.

The owner of the data will be informed of the general points regulated in this policy, prior to the collection of their data, so that he can give the express, precise and unequivocal consent for the processing of their data, if necessary and in accordance with the following aspects.

3.- Purposes of the processing.

The explicit purpose for which each processing is carried out is included in the information clauses incorporated in each of the data collection methods (web forms, paper forms, contracts, posters, etc.).

However, in general, the purpose of collecting and processing data is to:

Maintain the contractual relationship established between the data subject and ZLC.
Execute, maintain and manage any relationship that ZLC and the Data Owner may maintain: commercial, administrative, accounting, labor, marketing, and any other service provision that was requested from ZLC by the Data Owner.
Respond to requests for information and/or contact ( https://www.zlc.edu.es/contact/ )
Provide help to the user/interested party through our chat service.
Have data on candidates who choose to participate in selection processes promoted by ZLC, to respond to job applications and to manage the selection processes carried out.
Send advertising and promotional information relating to ZLC provided that it has given its consent to do so or there is a prior commercial/contractual relationship referring to the sending of commercial communications concerning products or services similar to those originally the subject of contracting with the customer (Article 21.2 of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce).

In addition, due to the relationship established with ZLC the storage of your data, the processing carried out and the purpose pursued varies. For this reason, the following details the specific treatment for each:

Event registration and executive training:

Expedite your request to participate in meetings, conferences, events, congresses, workshops, etc., promoted by ZLC, as well as in Executive Training programs.
Send commercial advertising communication via email, MMS, social networks or any other electronic or physical means, present or future, that make it possible to carry out commercial communications. These communications will be made by the Responsible Party and related to their activities, events, services and news.
Carry out statistical studies.
Capture images (photographs and/or video and audio recordings) of the activities carried out for informational and promotional purposes, including and disseminating them in the following media: web page, social networks, newsletters, magazines, email marketing campaigns, promotions, advertising, corporate publications, etc.

Master ZLOG:

Have the necessary information about your participation in the training program: admission, selection tests, registration, development, evaluation and qualification, control of the use of resources and facilities, billing thereof, etc.
Send you information about other programs, courses, events, congresses that may be of interest to you, by means of e-mails, newsletter mailings or other communication.
Manage your inclusion in the job market.
Generation of email account and profile book.
Creation of MIT Accounts, MIT SCALE Certificates, MIT Stay and participation in the Alumni Association.
Capture images and videos that will be used and published in the following media: blog, social networks, magazines, promotions, etc., which is carried out under the Image Provision Agreement.

MDSC Master:

Have the necessary information about your participation in the training program: admission, selection tests, registration, development, evaluation and qualification, control of the use of resources and facilities, billing thereof, etc.
Send you information about other programs, courses, events, congresses that may be of interest to you, by means of e-mail, newsletter mails or other communication.
ManagE your inclusion in the job market.
Generate an email account and profile book.
Capture images and videos that will be used and published in the following media: blog, social networks, magazines, promotions, etc., which is carried out under the Agreement of image provision.

In no case will they be used for purposes other than those for which they have been collected.

4.- Legitimation

As a general rule, prior to the processing of personal data, ZLC obtains unequivocal consent from the data subject, by incorporating informed consent clauses in the different information collection systems (Article 6.1.a) GDPR).

However, in the event that the consent of the data subject is not required, the legitimate basis for the processing on which ZLC is based is:

the execution of the established contractual relationship (Article 6.1.b) GDPR).
our legitimate interest in the development of the business (article 6.1.f) GDPR), in the case of commercial promotion and prospecting.
compliance with a law that authorizes or requires the processing of the data subject’s data (Article 6.1.c) GDPR).
the protection of the vital interests of the data subject (Article 6.1.d) GDPR).

If you have requested your consent for any of the treatments we will carry out (such as sending information about services and sending a newsletter) we inform you that you can withdraw it at any time.

5.- Recipients

We share your data with service providers who assist or support us (processors), with whom the required contract has been concluded under the terms of Article 28 of the GDPR.

Outside these cases, ZLC will not inform any third party about your personal data, unless the owner has given his consent to such effect, when the assignment is authorized by Law or when the communication is aimed at the fulfillment of purposes directly related to the legitimate functions of the assignor and the assignee.

In this regard, under the relationship established with ZLC, data communications vary. For this reason, the following are the same ones for each of them:

Event registration and executive training:

In some cases, it is necessary for the data to be brought to the attention of ZLC collaborators for the correct development of their participation in the activity, such as travel managers, accommodation, food, etc., with whom the corresponding processing agreement has been concluded on behalf of third parties.

Likewise, the data will be provided to the entities that finance the events.

Master ZLOG:

The data will be communicated to the Massachusetts Institute of Technology, for the following purposes:

- Creating MIT Accounts. Data provided: Full name, copy of passport, validity of passport, date of birth.
- MIT SCALE certificates. Data provided: Full name, date and place of birth.
- Management stay MIT. Data provided: Full name, date and place of birth, copy of passport, validity, nationality, email ZLC & MIT, resume and profile book (internal Facebook, CV and linkedin).
- Participation in Alumni Association. Data provided: Full name, date and place of birth, copy of passport, validity, nationality, email ZLC & MIT.

The data will be communicated to the University of Zaragoza, in order to manage the student’s enrollment, insurance management of the University and management of student practices (through Universa).
The data will be communicated to other students of the same class and will be published in the Student Section of the website: https://www.zlc.edu.es/
Your image may be collected in photos and videos that will be used and published in the following media: blog, social networks, magazines, promotions, etc.
In addition, it is sometimes necessary for the data be brought to the attention of ZLC collaborators for the correct development of their participation in the training action, such as travel, accommodation, food, etc. managers, with whom the corresponding processing agreement has been concluded on behalf of third parties.

MDSC Master:

The data is communicated to the University of Zaragoza, in order to manage the student’s enrollment, insurance management of the University and management of student practices (through Universa).
The data is communicated to other students of the same class and will be published in the Student Section of the website: https://www.zlc.edu.es/
Your image may be collected in photos and videos that will be used and published in the following media: blog, social networks, magazines, promotions, etc.

In addition, it is sometimes necessary for the data to be brought to the attention of ZLC collaborators for the correct development of their participation in the training action, such as travel, accommodation, food, etc. managers, with whom the corresponding processing agreement has been concluded on behalf of third parties.

6.- International data transfer

Only in the case of the data of the students of the ZLOG Master’s Degree, the communication of data to the Massachusetts Institute of Technology is foreseen, which implies an international transfer of data, since it is in the United States.

In this case, the transfer is made because the achievement of the training action is necessary (Article 6.1.b GDPR) and based on the consent given by the student (Article 6.1.a GDPR).

Other than in this particular instance, there is no provision for international data transfer.

7.- Data storage period.

The information collected from the interested party will be kept as long as it is necessary to fulfill the purpose for which the personal data was collected, so that, once fulfilled will be canceled. Such cancelation will result in the blocking of the data, being kept only at the disposal of the AAPP, Judges and Courts, to meet the possible responsibilities arising from the treatment, during the period of limitation of these, after the said period will proceed to the destruction of the information.

For information purposes, the following are the legal periods for storing information in different areas:

DOCUMENT	TERM	LEGAL REF
Documentation of an employment or social security nature	4 years	Article 21 of Royal Legislative Decree 5/2000 of 4 August approving the consolidated text of the Law on Offenses and Sanctions in the Social Order
Accounting and tax documentation for business purposes	6 years	Art. 30 Commercial Code
Accounting and tax documentation for tax purposes	4 years	Articles 66 to 70 General Tax Law
Data for sending information about products and services	As long as the interested party does not request its deletion	Non aplicable
CV data (candidates)	2 years	Non aplicable
Details of persons who have made contact	As long as the interested party does not request its deletion	Non aplicable

8.- Navigation data.

In relation to the navigation data that can be processed through the website, if data is collected, subject to regulations, it is recommended to consult the Cookies Policy published on our website, available at https://www.zlc.edu.es/cookies-policy/.

9.- Rights of the interested parties.

Anyone has the right to obtain confirmation as to whether or not ZLC is processing personal data concerning them.

Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request their deletion when, among other reasons, the data is no longer necessary for the purposes for which they were originally collected.

In certain circumstances, data subjects may request the limitation of the processing of their data, in which case we will only keep them for the exercise or defense of claims.

In certain circumstances, and for reasons related to their particular situation, data subjects may object to the processing of their data. In this case, the processing of the data will be stopped, except for compelling legitimate reasons, or the exercise or defense of possible claims.

Finally, data subjects have the right to withdraw the consent given for the processing of data for certain purposes.

The interested parties may exercise the indicated rights, by writing to ZLC, sent to the following address: Av. Ranillas, 5, Edificio 5A (EXPO), ground floor, 50018 Zaragoza or to the email address [email protected], attaching in any case, photocopy of the ID or equivalent document valid in law that allows proving their identity.

You also have the possibility to file a complaint with the Spanish Data Protection Agency (aepd.es) in the event that you consider that the processing of your data is not appropriate.

10.- Safety

Security measures taken by the FTZ are those required, in accordance with Article 32 of the GDPR. In this regard, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying probability and severity to the rights and freedoms of natural persons, it has in place appropriate technical and organizational measures to ensure the level of security appropriate to the existing risk.

In any case, ZLC has in place sufficient mechanisms to:

Ensure the continued confidentiality, integrity, availability and resilience of processing systems and services.
Restore availability and access to personal data quickly in the event of a physical or technical incident.
Verify, evaluate and assess, on a regular basis, the effectiveness of the technical and organizational measures put in place to ensure the safety of the treatment.
Pseudonymize and encrypt personal data, if applicable.