The University of Seville (hereinafter, US or the Entity) makes this Privacy Policy available to users of the website https://grupo.us.es/horizonnet4flow/ (hereinafter, also the Website), for the purpose of providing information on how personal data are processed and how privacy and information are protected.

1. Introduction

This Privacy Policy applies to the US website, as well as to the applications, and to the interactions carried out by the user with US through said website (collectively referred to as the “Services”).

This Privacy Policy may be modified by the website owner when necessary, but such modifications will be communicated through the website or by other means so that the user may be aware of them and continue using the Services. Continued use of the Services after the aforementioned modifications have been communicated shall imply acceptance thereof, except in cases where express consent is required.

2. Who is the controller responsible for the processing of your personal data?

The controller responsible for the processing of the personal data provided through the website shall be US, with its registered office for these purposes at [Registered address].

For the proper management of the processing of personal data, US has a Privacy Committee, which you may contact to resolve any matter you may require, by sending an email to xxxx@us.es.

3. For what purpose do we process your personal data?

At US, the personal data collected through this website, app and/or by users of any US Group websites may be processed for the following purposes:

Contact: to manage the personal data of users who contact US through the contact form made available by US. Your data will be processed for the purpose of managing such contact and responding to the queries, questions, or comments that you submit through the channels enabled for this purpose on the website.

Likewise, users are informed that, exclusively where necessary, such data will be communicated to the US entity to which the query or reported issue is addressed. The legal basis for such data communication is compliance with legal obligations applicable to US.

Consumer, Customer, or Supplier Support Service: US makes a communication channel available to users to manage, electronically, the Consumer, Customer, or Supplier Support Service.

In this regard, the personal data collected through the “Contact” section made available to the public through the website will be processed by US for the purpose of handling queries regarding products, as well as managing incidents and/or complaints submitted.

4. What data are processed by US and what are their sources?

The data processed by US as a result of interactions carried out by the user through the website come from the following sources:

• Data provided by the user by completing the forms made available by US, or data that the user authorizes social networks to provide to US when using social network connectors to register, by completing the fields made available to participate in promotions managed by US, by sending emails, or by any other means through which the user communicates with US.
• Data generated as a result of browsing and use of US websites by the user.
• Data generated as a result of the development, processing, and maintenance of the relationship established between the user and US.
• Data relating to third parties provided by the user.
• Data obtained from external sources (e.g., social networks, etc.).

US may process personal data of the following categories, depending on the relationship established with the user:

• Identification data (e.g., name and surname, email address, postal address, telephone number, IP address, image, etc.).
• Academic or professional data and/or employment details (e.g., data contained in a curriculum vitae).
• Personal characteristics and social circumstances data (e.g., age, date of birth, preferences, hobbies, and lifestyle, etc.).
• Browsing and location data (e.g., use of US websites, sections visited, data provided by the user through social networks when indicating their location, etc.).
• Health data and/or other categories of data. These categories of data will be processed exclusively in the event that the user has voluntarily included this type of information in the free-text field of the Consumer Support form, considering it relevant to submitting a complaint or reporting an incident. In all cases, US informs that appropriate security measures will be applied according to the type of data processed in each case.
• Other categories of data. Exclusively in the event that the user registers through social network connectors, the categories of data that the user has made public through the relevant social network and has consented to be accessed and processed by US will be processed.

5. What is the legal basis for the processing of your data by US?

US processes the personal data provided by users of its websites based on the following legal grounds, depending on the type of data provided by the user and the interactions established with US:

1. Processing of your data for the “Contact” purpose is based on the management and processing of the legal relationship established between the user and US, that is, the management of the user’s own request, the maintenance of contact between the parties, and, where applicable, the provision of the service requested by the user.
2. Processing of your data for the purposes of “Work with us,” “Factory visits,” “Promotions,” “Commercial, promotional, or advertising communications regarding products and services of US and companies of the US Group, tailored to your preferences, hobbies, and interests in accordance with the profiling and segmentation carried out” is based on the user’s consent.

US informs that it will only carry out the processing of personal data for purposes based on user consent where such consent has been granted through the consent mechanisms made available by US.

Processing of your data for the “Consumer, Customer, or Supplier Support Service” purpose is based on the management and processing of the legal relationship established between the data subject and US and on compliance with legal obligations applicable to US.

6. To whom are your data disclosed?

Data collected by US for the Consumer, Customer, or Supplier Support Service purpose may be disclosed by US to the US Group company to which the query, incident, or complaint is addressed, exclusively where necessary. In such cases, such data communication will be carried out in compliance with legal obligations applicable to US.

Data collected by US for the Promotions purpose may be disclosed by US to:

• Notaries, for the conduct of prize draws before a public notary.
• Public Administrations, for compliance with tax obligations.

With regard to the remaining data processing purposes detailed in this Privacy Policy, US informs users that such processing purposes do not involve the disclosure of their data to third-party entities.

7. How long do we retain your data?

US will retain your personal data for the time necessary to provide the requested service and/or to achieve the intended processing purpose.

Subsequently, provided that the user has not exercised the right to erasure, data will be retained for the legally applicable periods in each case, taking into account the type of data and the processing purpose.

In any case, users may request detailed information on the data retention periods applied by US by contacting the Privacy Committee at xxxx@us.es.

8. What personal data must be provided in each case?

US informs users that when personal data are collected through a form made available through the website, the user must provide at least those data marked with an asterisk (*). If such data, considered necessary, are not provided, US will not be able to manage the provision of the service or respond to the query or complaint submitted.

Likewise, US informs users who wish to participate in a promotion made available by US through any of its websites that, in such cases, the personal data requested in each case must be provided, in accordance with the promotional mechanics and the provisions set out in the Legal Terms governing the relevant promotion. If the required data are not provided, the user will not be able to participate in the promotion and, where applicable, will not be able to receive the associated prize.

9. What must you guarantee when providing your personal data?

The user guarantees that the data provided are true, accurate, complete, and up to date, and shall be responsible for any direct or indirect damage that may arise as a result of breach of this obligation.

If the user provides data belonging to a third party, the user guarantees that such third party has been informed of all aspects contained in this Privacy Policy and that their consent has been obtained to provide their data for the relevant processing purpose, prior to providing such data through any of the US websites.

US informs users that, in order to provide personal data through the website, the user must be of legal age. The user providing data to US through the website declares and guarantees that they are of legal age and accepts full responsibility for such declaration.

10. What measures do we take to protect your personal data?

In response to US’s concern to guarantee the security and confidentiality of data, the required security levels for the protection of personal data have been adopted and technical measures have been implemented to prevent loss, misuse, alteration, unauthorized access, and theft of personal data provided through the Website. In any case, users should be aware that Internet security measures are not impregnable.

11. What are your rights regarding your personal data?

US informs you that you have the right to obtain confirmation as to whether or not personal data concerning you are being processed.

In the same way, US informs you that you have the following rights regarding your personal data:

• Access your data: You have the right to access your data in order to know what personal data concerning you are being processed.
• Request rectification or erasure of your data: In certain circumstances, you have the right to rectify personal data you consider inaccurate and which concern you, and which are being processed by US, as well as the right to request erasure of your data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• Request restriction of processing of your data: In certain circumstances, you have the right to request restriction of the processing of your data, in which case US will only retain the data for which restriction has been requested for the exercise or defence of legal claims.
• Data portability: In certain circumstances, you have the right to receive the personal data concerning you, which you have provided to US, in a structured, commonly used, machine-readable format, and to have such data transmitted by US to another data controller.
• Object to the processing of your data: In certain circumstances and for reasons relating to your particular situation, you have the right to object to the processing of your data, in which case US will cease processing them unless there are compelling legitimate grounds or the processing is necessary for the exercise or defence of possible claims.

Likewise, you are reminded that you have the right to object, at any time, to the sending of advertising related to products and services of US and companies of the US Group, as well as to the profiling and segmentation carried out for this purpose in order to offer communications tailored to your preferences, hobbies, and interests.

In addition, you may withdraw any consent you have given for the processing of your data at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

US will provide the requested information within a maximum period of one month from receipt of the request. This period may be extended by an additional two months where necessary, taking into account the complexity and number of requests.

US informs you that you may lodge a complaint with the competent Data Protection Supervisory Authority. However, in the first instance, you may submit a complaint to the Privacy Committee, which will resolve the complaint within a maximum period of two months.