Confidentiality and security are fundamental values of the CATALAN INSTITUTE OF NANOSCIENCE AND NANOTECHNOLOGY (ICN2). For this reason, we are permanently committed to ensuring the privacy of our users' personal data and not collecting unnecessary information.

Below, we provide you with all the necessary information about our Privacy Policy in relation to the personal data we collect, explaining:

• Who is responsible for the processing of your personal data. 
• For what purposes we request the information we request from you. 
• What is the legal basis for the processing? 
• How long we keep your data. 
• To which recipients your data is communicated. 
• What are your rights? 

Who is the data controller of your personal data?

Company name: INSTITUT CATALÀ DE NANOCIÈNCIA I NANOTECNOLOGIA (ICN2)

NIF: G63277776

Address: Edifici ICN2, Campus UAB, Bellaterra, Cerdanyola del Vallès, 08193 Barcelona, Spain

Contact: info@icn2.cat

How can you contact our Data Protection Officer?

ICN2 has appointed a Data Protection Officer (DPO), who acts as a guarantor of compliance with data protection regulations within ICN2.

You can contact ICN2's Data Protection Officer through the following channels:

Email: dpd@icn2.cat
Mail: Edifici ICN2, Campus UAB, Bellaterra, Cerdanyola del Vallès, 08193 Barcelona, Spain

For more information, you can consult the register relating to the current ICN2 Data Protection Officer.

Who are the stakeholders?

The personal data processed correspond to:

• People who have provided us with their data through the different forms on the website to make enquiries or obtain information about our services and activities. 
• People subscribed to job alerts. 
• People who apply for selection processes through the employment portal. 
• People who enroll in the Open Knowledge Programme. 

For what purposes and on what legal bases do we process personal data?

The ICN2 will process the personal data of the interested parties, in general, to:

1. To manage and respond to requests for information, queries, suggestions or communications made through the different channels enabled, as well as to maintain the relationship with the interested parties.
2. Manage the provision of services and participation in activities organized by the ICN2, including research programs, training, outreach, events, and other institutional initiatives.
3. Manage personnel and candidacy selection processes, as well as participation in employment programs, internships and professional alerts.
4. Send informative communications, including newsletters, news, activities, calls and events related to ICN2 activity, when appropriate.
5. To improve the quality of services and analyse the use of the website, as well as to carry out studies on user satisfaction or behaviour.
6. Ensure the security of information systems and prevent misuse, including the detection of unauthorized access.
7. Manage research, innovation and collaboration activities with third parties, including the coordination of scientific projects and relations with public and private entities.
8. To comply with applicable legal obligations, as well as to manage notifications, administrative communications and, where appropriate, claims or appeals.

Legal basis for processing:

The ICN2 is entitled to carry out the processing of personal data in accordance with the principle of lawfulness of the processing established in Article 6 of Regulation (EU) 2016/679, General Data Protection (GDPR) and, in particular, on the following legal bases:

• In general, when the processing is carried out within the framework of the ICN2's own activity, especially in relation to the management of procedures, research, training, innovation and services activities, the legal basis will be the fulfilment of a mission carried out in the public interest or in the exercise of public powers conferred on the data controller (art. 6.1.e GDPR).
• In certain cases, the processing will be based on the consent of the interested parties (art. 6.1.a GDPR), especially for the sending of informative communications, participation in certain activities or when required by applicable regulations.
• Likewise, certain processing may be based on the satisfaction of legitimate interests pursued by the ICN2 (art. 6.1.f GDPR), in particular in relation to the improvement of services, the security of information systems, the prevention of fraud, the management of the relationship with users and the sending of information on activities related to its field of action,      provided that those interests do not override the fundamental rights and freedoms of the data subjects.
• In any case, the legal basis applicable to each specific processing will be set out in the corresponding information clauses provided in the personal data collection forms and interaction channels with the ICN2.

In addition to the above, ICN2 may carry out other processing of personal data. In such a case, the data subject will receive the necessary information in relation to such processing and ICN2 will seek their consent where necessary.

How long will ICN2 keep the data?

In general, the data will be kept for the time necessary to fulfil the purpose for which they were collected and to determine the possible responsibilities that may arise from said purpose and the processing of the data.

This implies, among other things, that ICN2 will keep the personal data of the interested parties for the duration of their relationship with us and, where appropriate, for the period necessary for the formulation, exercise or defence of possible claims, or to comply with the legal obligations established by the applicable regulations.

In the case of candidates who apply for positions published on the employment portal, their data will be kept for a maximum period of 1 year if they have not been admitted to any selection process during that period.

Once this period has elapsed, ICN2 undertakes to cease the processing of all personal data, destroy them, limit their processing or anonymise them, as far as possible, depending on the purpose for which they are kept.

To which third parties will the data be disclosed?

In general, personal data will not be communicated to third parties, unless it is necessary to process the request, there is a legal obligation or the interested party has given their consent.

In order to provide you with an appropriate service and manage our relationship with you, we may disclose your personal data to:

Companies that provide us with services related to the ordinary and administrative activity of the entity, such as national or international processing providers, within the framework of the provision of services such as, among others, email services, web hosting, server hosting, SaaS management application services, cloud file archiving and other similar services.

The provision of these services may involve the processing of personal data by companies located in countries outside the European Economic Area, which constitutes an international transfer of data. International data transfers will be made to countries that have an adequate level of protection, declared by the European Commission, or through the adoption of appropriate safeguards, such as standard contractual clauses.

ICN2 may also transfer or communicate personal data in order to comply with its obligations to public administrations in those cases where it is required by applicable legislation in force.

What are the rights of data subjects when they provide us with their data?

We will inform you, upon request, about whether we process your personal data, what data we process and for what purposes. Likewise, provided that the legally established conditions are met, you have the right to request the rectification of your data, the restriction of processing, the deletion of your data, opposition to the processing and the portability of the data.

These rights may be exercised free of charge by the interested party and, where appropriate, by his representative, by means of a written and signed request, addressed to:

By email: dpd@icn2.cat
By post: Edifici ICN2, Campus UAB, Bellaterra, Barcelona, 08193, Spain

In the case of acting through a representative, the representation must be accredited by means of a written document and attaching a document that proves such representation.

In addition to the above rights, the data subject shall have the right to withdraw at any time the consent granted through the procedure described above, without such withdrawal affecting the lawfulness of the processing based on the consent prior to its withdrawal. ICN2 may continue to process the data subject's personal data to the extent permitted by applicable law or there is another legal basis that justifies it.

In particular, in the case of the service of sending commercial communications, the interested party has the right to revoke at any time the consent granted for the sending of such communications, notifying ICN2 that they do not wish to continue receiving them. To this end, the interested party may oppose the processing under the terms described in the previous section or click on the link included in each commercial communication, thus cancelling the sending of electronic commercial communications.

Opposition to the processing of candidates' data will imply the impossibility of processing their application, so the exercise of this right will lead to the deletion of the data or the limitation of its processing under the terms established in our data retention policy.

Notwithstanding these rights and the possibility of exercising any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the applicable data protection regulations.

Updating your data

In order for us to keep your personal data up to date, it is important that you inform us of any changes that occur. Otherwise, we cannot be responsible for the veracity of said data or for the consequences that this may have on the processing.

Security in data processing

In order to safeguard the security of your personal data, we inform you that ICN2 has adopted all the necessary technical and organisational measures to guarantee the security of the personal data provided, as well as the confidentiality, integrity, availability and permanent resilience of the processing systems and services.

Specifically, security measures are available consisting of:

• Physical control of access and protection of the equipment, people and facilities in which data processing is carried out. 
• Access to computer systems through individual usernames and passwords, limiting access to data to those employees who strictly require it for the performance of their duties. 
• Backup copies of personal data when it is necessary to ensure its integrity and availability. 
• In the case of handling media or documents containing personal data, these are properly stored under lock and key or by equivalent locking devices. 
• Network perimeter protection systems to prevent intrusions and antivirus protection of computer systems. 
• Recording security incidents and establishing mechanisms and procedures for reporting security breaches. 

ICN2 has also implemented internal controls to periodically check, review and evaluate the effectiveness of the technical and organisational measures implemented to guarantee the security of the processing, as well as to be able to demonstrate that the processing is carried out in accordance with current regulations and that the protection of the rights of the data subjects is guaranteed.

To this end, ICN2 has implemented a Personal Data Protection Management System to determine and apply the technical and organisational means at its disposal in order to prevent the loss, misuse, alteration, unauthorised access and theft of the data provided by users.

Record of Processing Activities (ROPA)
Article 30 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), establishes that each controller shall maintain a record of processing activities (ROPA) it carries out, including the following information:

• The name and contact details of the controller and the data protection officer.
• The purposes of the processing.
• A description of the categories of data subjects and of the categories of personal data.
• The categories of recipients of the data.
• Transfers of personal data, if any.
• The envisaged time limits for the erasure of the different categories of data, where possible.
• A general description of the technical and organizational security measures.

Likewise, as set out in Article 31.2 of Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights (LOPDGDD), all entities included in Article 77.1 of this law must make public an inventory of their processing activities, which shall include the information established in Article 30 of the GDPR and its legal basis for the processing of personal data.

In accordance with this regulation, a record of the processing activities carried out by ICN2 is maintained.

Use of cookies

This website, like most websites on the Internet, uses cookies to improve the user experience. In our Cookie Policy you will find information about what cookies are, what type of cookies this website uses, how you can disable them in your browser and how to specifically disable the installation of third-party cookies.

Please read our Cookie Policy carefully before continuing to browse our website.

Modification of the Privacy Policy