This page explains which personal data are processed through the website of the Student Recreation Centre (CALUM) of the Universitat Politècnica de València, for what purpose, and how you can exercise your rights. For this site it supplements the general UPV privacy policy, which applies to anything not covered here.
If you are a UPV student or member of staff, information about the University’s other processing activities is available in its Record of Processing Activities.
Data controller
The controller is the Universitat Politècnica de València (Camí de Vera s/n, 46022 València; telephone +34 96 387 70 00), acting through the Vice-Rectorate for Students and Entrepreneurship (vee@upv.es), to which the Student Recreation Centre reports; the Centre is run by the UPV Student Council.
UPV has appointed a Data Protection Officer, whom you can contact at dpd@upv.es with any question about the use of your data.
What data we process and why
Enquiries by e-mail or telephone
If you write to casalum@ddaa.upv.es or call the Information Desk, we use your contact details and the content of your message solely to reply to you. The legal basis is your consent, given when you contact us. Messages are kept for as long as needed to deal with the enquiry and any liability that may arise from it.
Sign-ups and bookings through external forms
Activity sign-ups, game bookings and room bookings are made in tools outside this site: UPV forms, the UPV intranet and Microsoft Bookings. The data you enter (name, e-mail, ID or UPV card number, degree, dates) are used only to manage your participation or booking and are processed by UPV as controller; Microsoft acts as processor under its service agreement with the University.
The legal basis is the performance of a task carried out in the public interest (organising activities and services for students) and, where a form asks for it, your consent. Each form gives the details of its own processing.
Photographs and video at activities
Photographs and videos are taken at the Centre’s activities and published on this site, in the agenda and on CALUM’s social media (Instagram and Facebook) to inform about and promote university life. You are told about this when you sign up for or take part in an activity; the legal basis is the University’s public-interest task and, where requested, your consent.
If you do not want to appear, tell the person taking the pictures or avoid posing for the camera. You can ask us at any time to remove an image in which you appear:
- Write to casalum@ddaa.upv.es giving the address of the page or post and describing the image.
- We will remove it from this site and from CALUM’s social media as soon as possible and confirm by e-mail.
- If you prefer to address the University directly, write to the Data Protection Officer (dpd@upv.es).
Images published on social media are subject to those platforms’ terms, which may involve international data transfers. If you are under 14, consent is given by your parent or guardian.
Site usage statistics
To learn which pages are visited we use the WP Statistics plugin, which runs on our own server, sets no cookies and sends no data to third parties. For each visit it records the page visited, date and time, referring page or search engine, browser and version, operating system, device type and model, approximate location (country, region and city, derived from the IP address with a database installed on the server) and an anonymised, hashed IP address, so it cannot identify you; it does not store the full browser identification string and does not count visits by the people who manage or edit the site. These records are deleted automatically after 180 days. The legal basis is the performance of a task carried out in the public interest (understanding and improving a university service); the data are anonymised at the moment of collection.
Site access security
To protect the accounts of the people who edit the site against brute-force attacks we use the Limit Login Attempts Reloaded plugin, which runs on our own server. When a login attempt fails it stores the IP address, the user name tried and the time; after 4 failed attempts it blocks that address for 20 minutes, and for 24 hours if the lockouts are repeated. Attempt counters are deleted after 24 hours. If lockouts are repeated, the site e-mails its administrator the IP address and the user name. The login page also uses a one-day technical cookie (see the cookie policy). The legal basis is the performance of a task carried out in the public interest (keeping this university service secure); the data are kept only as long as needed for that purpose.
Log of pages not found
To detect broken links and redirect them, the site keeps for 30 days the non-existent addresses (404 error) that someone visits, with the date, the referring page and the browser identification, and for 7 days the redirects that are used, with the same data. It does not store the IP address. The legal basis is the performance of a task carried out in the public interest (keeping this university service working).
Children under 14
This site is not aimed at children under 14, who may not give us personal data without the permission of a parent or legal guardian. You are responsible for the accuracy of the data you provide and for keeping them up to date.
Who we share data with
We do not disclose your data to third parties except where required by law or a court, or to the public or private bodies to which they must be passed to provide the service requested. The providers supporting forms and bookings (Microsoft) and the social networks on which images are shared may process data outside the European Economic Area under the safeguards of Articles 45 to 49 of Regulation (EU) 2016/679.
How long we keep data
Data are kept for as long as needed for the purpose for which they were collected and while liability may arise, or until you withdraw your consent. They may then be retained for public-interest archiving, research or statistical purposes. Usage statistics are deleted after 180 days, the log of pages not found after 30 days and the redirect log after 7 days.
Your rights
Under the General Data Protection Regulation and Spanish Organic Law 3/2018 you may:
- Access your data and find out whether we process them.
- Rectify inaccurate data.
- Erase data that are no longer needed.
- Object to processing in certain circumstances.
- Restrict processing in the cases provided for.
- Port your data to another controller.
- Withdraw consent at any time, without affecting the lawfulness of earlier processing.
- Lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe your rights have not been respected.
How to exercise your rights
- Write to the Data Protection Officer at dpd@upv.es stating which right you are exercising. You may use the AEPD templates.
- If there is any doubt about your identity, the DPO will ask for additional details or a document.
- To have a photograph removed or to settle a simple matter you can write directly to casalum@ddaa.upv.es.
Security
As a public-law body, UPV applies the security measures of the Spanish National Security Framework (Royal Decree 311/2022). This site is served over an encrypted connection (HTTPS).
Changes to this policy
This policy may be updated when the site’s services or the law change. The current version is always the one published on this page. See also the legal notice and the cookie policy.
Last updated: