UCM Privacy Policy

Welcome to the Complutense University of Madrid.

Universidad Complutense de Madrid (UCM) is committed to ensuring that your personal information is protected and not misused. At UCM we take responsibility for complying with current national and European data protection legislation, and we aim to treat your data in a lawful, fair and transparent manner.

This document explains who the data controller is, the purposes for which your personal information will be processed, the legitimacy of the processing, to whom we may disclose your personal information, how we collect it, why we collect it, how we use it, your rights and also explains the processes we have put in place to protect your privacy.

Who is responsible for the processing?

According to current legislation, it is the natural or legal person, public authority, service or other body which, alone or jointly with others, determines the purposes and means of the processing.

Universidad Complutense de Madrid is the entity responsible for the processing generated with the personal data supplied by users of the portal www.ucm.es, as well as for those others that have been collected in the different facets of the provision of the higher education service entrusted to it by Organic Law 6/2001, on Universities, or that derive from and/or are necessary for the correct development of the working relations with its staff, and whose processing is listed in the Register of Processing Activities carried out under its responsibility.

Details of the person responsible:

• Universidad Complutense de Madrid, Avenida de Séneca nº 2, 28040 Madrid, Spain
• Tel: (+34) 913 941 001; Email: Q-2818014-I; Tel: (+34) 913 941 001: infocom@ucm.es
• Data Protection Officer: dpd@ucm.es

By virtue of the internal distribution of competences and functions, actual responsibility is vested in the various bodies and units that make it up. To find out who is responsible for each particular processing operation, you can consult our Register of Processing Activities.

This Privacy Policy also applies to the Services that UCM provides to you through the mobile Apps for which UCM is responsible.

For what purposes do we collect your personal information?

Aims protected in the public interest and in the exercise of the public function of higher education conferred on the University by Organic Law 6/2001, on Universities:

• The main reason why we collect your personal information is because it is necessary to provide the higher education service entrusted to the University through Organic Law 6/2001, of 21 December, on Universities, and other related
• In the case of public employees and civil servants, the processing of personal data is necessary for the maintenance of employment relations and compliance with the legal regulations governing the
• In the case of the processing of personal data provided by users of the ucm.es portal, the purpose of the collection and automated processing of personal data is the management, provision, extension and improvement of the services requested at any given time by the user and the follow-up of queries raised by users. The UCM website does not collect personal data from users without their knowledge, nor is it passed on to third parties. By providing us with your personal information and using our websites, we understand that you have read and understood the terms related to the personal data protection information set out.
• The data related to the research activity of the PDI may be used for the dissemination and valorisation of the UCM, especially through the Researcher’s

Other purposes:

• In some cases and when expressly consented to by the data subject, the data may be used for educational and promotional purposes of UCM’s academic

Under no circumstances will UCM draw up commercial profiles based on the information provided.

What is the legitimacy for the processing of personal information?

UCM bases the processing of personal data on several grounds of legitimacy:

• For compliance with various legal obligations applicable to UCM; in particular and without limitation, the provisions of Organic Law 6/2001, of 21 December, on Universities; Law 40/2915, of 1 October, on the Legal Regime of the Public Sector; Law 14/2011, of 1 June, on Science, Technology and Innovation; Royal Legislative Decree 8/2015, of 30 October, approving the revised text of the General Law on Social Security; Law 58/2003, of 17 December, on General Taxation; Organic Law 11/1985, of 2 August, on Trade Union Freedom; Law 16/1985, of 25 June, on Spanish Historical Heritage; Law 4/1993, of 21 April, on Archives and Documentary Heritage of the Community of Madrid; Law 39/2015, of 1 October, on Common Administrative Procedure.
• UCM is an Institutional Public Sector entity and, therefore, the processing is necessary for the provision of the public service of higher education. The processing is also necessary for the fulfilment of a mission carried out in the public interest, as well as in the exercise of the public powers conferred on UCM

by virtue of the provisions of Organic Law 6/2001, of 21 December, on Universities, in its Statutes approved by Decree 32/2017, of 21 March, of the Governing Council of the Community of Madrid, and in the other related regulations.

• For the presence of a legitimate interest, for example, for the proper maintenance of relations between members of the university community and
• On occasion, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural
• Personal data may also be used for the formulation, exercise or defence of any claims that may
• Processing may also be necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures at the request of the data
• The data subject’s consent is required where the processing of personal data is not covered by one of the above For example, consent is required if the data are used for promotional activities of the University. In this case, data subjects may withdraw their consent at any time.

To whom may we disclose personal information?

Depending on the type of data processing activities carried out on each occasion, UCM may be obliged to communicate the data subject’s personal information to different public or private Institutions, Bodies or Entities.

Likewise, your personal information will be at the disposal of the Public Administrations, Judges and Courts, for the attention of the possible responsibilities arising from the processing.

The Register of Processing Activities identifies, in each case, the intended recipients.

Likewise, in the event that you authorise it, your personal data may be communicated to Companies or Collaborating Entities, for example, for the management of the employment exchange, or for external internships. If you do not authorise the communication of your data in these cases, we will not be able to provide you with the service.

Do we transfer data internationally?

The personal information we collect resides in Spain, although it is possible that in some exchange programmes such as Study Abroad or in the participation in the activities developed by the Complutense Volunteering, it may be necessary to transfer the personal information of the interested party to a third country outside the European Union, in which case international data transfers are carried out. In these cases, UCM undertakes to comply with the requirements established by the Spanish Data Protection Agency and the European Union, ensuring that any international transfer of personal information carried out at UCM complies with legislation on the protection of personal data.

How long do we store your personal information?

We only store your personal information to the extent that we need it in order to use it in accordance with the purpose for which it was collected, and in accordance with the legal basis for processing it in accordance with applicable law. In many cases, in the case of official documentation, the retention of personal data is envisaged for long periods of time because it is necessary for the exercise of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of public authority vested in the controller, for reasons of public interest in the field of public health, for archiving purposes in the public interest, for scientific or historical research or statistical purposes, or for the formulation, exercise or defence of claims. However, in these cases, safeguards are put in place to ensure that technical and organisational measures are implemented to ensure that, in particular, the principle of data minimisation is observed. In addition, further processing of personal data for scientific or historical research or statistical purposes shall be protected by appropriate safeguards, such as, for example, pseudonymisation of data.

When the lawful reasons justifying the retention of data for long periods of time do not exist, we will keep your personal information for as long as there is a relationship with you – as a student or as a public employee or civil servant – or for as long as you do not exercise your right to erasure, cancellation and/or limitation of the processing of your data. In these cases, we will keep the information retained, without making any use of it, for as long as it may be necessary for the exercise or defence of claims, or as long as  any type of legal, judicial or contractual liability may arise from its processing, which must be attended to and for which its recovery is necessary. The common time limit for the purposes of the prescription of liabilities is set at 5 years from the end of the relationship.

How can you exercise your rights?

You have the right to have control over the personal information we collect so that we also ensure that it is accurate and truthful.

You have the right to obtain access to your personal information, as well as to request the rectification of inaccurate data and to update it or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

In certain circumstances, and on grounds relating to your particular situation, you may object to the processing of your data. Your personal information will no longer be processed for the purposes to which you have objected, provided that the processing is not covered by a legal obligation, or is necessary to protect your vital interests or those of another person, and that the legitimate interests of the controller or of a third party or necessary for the establishment, exercise or defence of claims do not override the legitimate interests of the controller or a third party.

You may also exercise your right to limit the processing of your personal information by requesting that we retain it.

In certain circumstances and only where the processing is based on consent or a contract, you may request the portability of your data to another data controller.

You may exercise your rights free of charge, and you are entitled to receive a response within the time limits established by the data protection legislation in force, and you may choose between the following means:

• By means of a written request, signed and submitted at the University Registry or at any of the Registries or Post Offices referred to in 16 of Law 39/2015, of 1 October. The request shall be addressed to the postal address indicated in each registered Processing Activity, and a photocopy of the applicant’s National Identity Card must be attached. It is essential that you provide us with a valid contact address.
• By sending a request together with a photocopy and/or scanned copy of the applicant’s ID card to the e-mail address provided for each Processing
• In any case, you may address your request to the UCM Data Protection Delegate, to the address dpd@ucm.es or to dpd@ucm.es.

Please note that, as these are highly personal rights, we may ask you to verify your identity before taking any action you have requested.

You can also file a complaint with the Spanish Data Protection Agency, especially when you are not satisfied with the response to the exercise of your rights. For further details, please consult the website www.agpd.es

How do we protect your personal information?

We are committed to protecting your personal information. UCM, always in accordance with its Information Security Policy, uses appropriate technical and organisational measures in order to protect the security and confidentiality of stored data and to guarantee the privacy of data subjects, and reviews these measures periodically.

We protect your personal information by using a combination of physical, computer and logical security controls, including access controls that restrict and manage how your personal information and personal data is processed, administered and managed.

We also ensure that UCM staff are properly trained to protect your personal information. Our procedures are designed to require reliable identification of the data subject before we disclose any of your personal information to them.

With the combination of these means, we prevent the alteration, loss, processing or unauthorised access to personal information contained in its databases; taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as risks of varying likelihood and severity associated with each of the treatments. However, in the internet environment, security is never an impregnable asset, so the security measures adopted are those resulting from the customised management system, as they are considered adequate to guarantee the protection of the personal data processed in relation to the level of risk in the context of UCM’s activities.

How do we collect your personal data?

We collect personal information about you in a variety of ways.

In some cases, we collect personal information from you, and in other cases, we collect personal information from other sources, including publicly available sources. Below, we explain the different ways in which we collect personal information and some examples of where we use such information.

Information provided by the interested party

• The data will be collected through the corresponding forms, either in person or through the UCM The forms will only contain the fields that are essential for the provision of the service requested by the interested party. It is the responsibility of the interested party to update their own data; UCM will not be held responsible for inaccuracy if the interested party does not communicate any changes that may have occurred, for example, a change of email address and/or mobile phone number.

For example: we collect data from you when you register for a degree course, or apply for a Social Action grant. You may also provide us with information when you register on our website, or participate in a public call for applications, competition, etc.

• Generally, the personal information you provide us with is: name and surname, address, ID number, email address, contact telephone number and Given the university environment in which we operate, it is very likely that we will also collect your date of birth, personal, academic and professional characteristics and employment details, as well as payment and insurance details. In very specific cases, and depending on the purpose and intended use of your data, health, social and economic or financial circumstances may be collected.
• Users’ personal data will be used for the purposes indicated in the corresponding form(s) and always within UCM’s competences and The specific purposes for which the data are collected will be stated on the form(s). In those cases in which it is intended to process data for purposes other than those indicated, the consent of the owner must be recorded.

Information we collect from your visits to our website

• We collect and store limited personal information and anonymous aggregate statistics from all users who visit our website, either because you actively provide us with such information or because you are simply browsing our The information we collect includes the Internet Protocol (IP) address of the device you are using, the browser software you are using, your operating system, the date and time of access, the Internet address of the website you accessed and also information about how you use our website.
• We use this information to find out how long our website takes to load, how it is used, the number of visits to the different sections and the type of information that most attracts It also helps to identify if the website is working correctly, and if we detect faults or errors in the operation, to fix them and improve the performance of our website, in order to provide a better service to all users.
• The navigation data will only be stored for the time necessary to guarantee the security and provision of the service or the fulfilment of the purpose for which they were

Information we collect from publicly available sources

• In some cases, we collect data from publicly available sources, as is the case, for example, with the resolutions of public calls for research

Data on minors

• The public higher education service provided by UCM is not, in principle, aimed at Therefore, its website and mobile applications are not aimed at minors either.

Mobile phone

• The applications may have a geolocation tool whose main purpose is to know your location in order to show you the quickest route to the Faculty or Centre of destination from your Having the geolocation function activated on your mobile device allows you to benefit from all the functionalities of the applications. If you do not have geolocation activated, we will inform you and ask for your permission beforehand with a notification.
• This geolocation service will not be used to provide your location to third parties, except as provided for in current
• Most mobile devices provide users with the possibility to disable location This is most likely to be found in the device’s settings menu. If you are unsure how to disable location services on your device, we recommend that you contact your mobile operator or device manufacturer.

Links to third party websites

• The portal owned by UCM contains links to third-party websites, whose privacy policies are not those of By accessing such websites, you can decide whether to accept their privacy and cookie policies. In general, if you browse the Internet, you can accept or reject third-party cookies from the configuration options of your browser.
• UCM has no control over third-party websites, is not responsible for their content, and has no control over how those third parties collect and use your personal These websites may have their own privacy policies that explain how they use and share your personal information.
• We recommend that you carefully review the privacy policies before using these websites to ensure that you are happy with the way your personal data is collected and

Use of Cookies

UCM informs you about the use of cookies on its websites.

A “cookie” is a file that can be downloaded to your computer by websites. It is a tool that plays an essential role in the provision of numerous information society services. Among others, they allow a website to store and retrieve information about the

browsing habits of a user or their equipment and, depending on the information obtained, they can be used to recognise the user and improve the service offered.

Types of cookies

Depending on the entity that manages the domain from which the cookies are sent and processes the data obtained, two types of cookies can be distinguished: first-party cookies and third-party cookies.

There is also a second classification according to the length of time they remain stored in the client’s browser, which may be session cookies or persistent cookies.

Finally, there is another classification with five types of cookies depending on the purpose for which the data obtained are processed: technical cookies, personalisation cookies, analysis cookies, advertising cookies and behavioural advertising cookies.

For more information on this subject, please consult the Spanish Data Protection  Agency’s Guide on the use of cookies.

Purpose of the cookies used on the UCM website.

Acceptance of the Cookies Policy

UCM assumes that you accept the use of cookies. However, it displays information about its Cookie Policy at the top of any page on the website with each login so that you are aware of it.

Given this information, the following actions are possible:

• Accept This notice will not be displayed again when accessing any page of the portal during the current session.
• Modify the You can obtain more information on what cookies are, find out about UCM’s Cookie Policy and modify your browser settings.

Modification of the UCM Privacy Policy

UCM reserves the right to modify this Privacy Policy in order to adapt it to new legislation, jurisprudence or the interpretation of the Spanish Data Protection Agency. In this case, UCM will announce such changes, indicating clearly and with due notice the modifications made, and requesting, if necessary, your acceptance of such changes.

Contact

If you have any queries, comments or concerns, or if you would like to make any suggestions about how we use personal information, please contact the UCM Data Protection Officer by email: dpd@ucm.es or ofi.dpd@ucm.es