Informative Clause
Data Manager:
DigiPen Institute of Technology Europe - Bilbao
(hereinafter DigiPen Bilbao)
Mission - Ribera de Zorrotzaurre, 2
48014 Bilbao (Bizkaia), Spain
Contact Information:
Telephone: +34 94 636 51 63
Website: digipen.es
Email: admissions.es@digipen.es
Data Protection Officer: lopd@digipen.es
Purpose
The data collected in the application for admission and which is subsequently collected in the case of admission as a student of DigiPen is used for the following purposes:
- To manage enrolment to the academic degree program requested and respond to requests for information regarding DigiPen degrees and the services provided to its students.
- To manage student academic records in the event of admission to the degree program and to monitor and control student activities while enrolled at DigiPen.
- To issue internal publications, news bulletin, and viewbooks of DigiPen.
- To manage, if applicable, the registration of projects in which the student has participated on platforms such as FilmFreeWay and FestHome.
- To manage, if applicable, the registration and attendance at European and International video game and animation festivals.
DigiPen requests identification data including image and information regarding academic background, billing, and contact information.
Communication to Third Parties
DigiPen Bilbao is an international campus belonging to the private degree-granting institution DigiPen Institute of Technology, whose headquarters are located in Redmond, Washington (United States). The central headquarters designs study plans and academic programs, issues degrees, and monitors academic records along with DigiPen Bilbao. Therefore, this contract binds the applicant for registration of DigiPen Bilbao with DigiPen Institute of Technology, located at 9931 Willows Road NE, Redmond, WA, USA 98052 (“DIT USA”), to which the student actually enrolls, with the Bilbao campus being a subsidiary location.
It is possible that in certain circumstances personal data may be communicated among DigiPen faculties located in Bilbao (Spain), Redmond (United States), and Singapore in order for adequate academic, administrative, and career management of students. In this way, data transfers are made between DigiPen entities within the framework of the development and execution of the contractual relationship with the students in accordance with the provisions of articles 6.1.b) and 49.1 sections b) and c) of the General Data Protection Regulation.
If you grant or have granted consent for processing images to promote the organization’s educational activities through the website and other media and communication channels like social networks, international data transfers may be conducted under the provisions of article 49.1.a) of the RGPD.
Management of Registration on Platforms and Festivals
If the student grants consent and it is necessary, their data may be shared with FilmFreeWay and FestHome platforms. Additionally, their data may be shared with European and international video game and/or animation festivals where projects in which the student participated are submitted for registration and, if applicable, to facilitate their attendance.
These transfers to the mentioned platforms and international events necessarily involve the communication of personal data to countries outside the European Economic Area, including but not limited to the United States, Chile, and Mexico.
Such data transfers to third countries outside the European Economic Area are classified as International Data Transfers under personal data protection regulations and carry potential risks for the concerned individuals’ data.
These risks stem from the absence or leniency of data protection regulations in these third countries, which may not provide necessary safeguards for personal data protection. This could lead to the absence of oversight by a data protection authority and the possibility of authorities in the recipient country accessing information without the same guarantees as in the EU.
However, given these circumstances, only the strictly necessary and minimal data will be shared to carry out the required management.
If the student wishes to obtain additional information about the third countries where their personal data may be transferred, they should contact lopd@digipen.es, and their inquiry will be addressed as soon as possible.
Legitimization of Processing
The basis that legitimizes the processing carried out by DigiPen Bilbao are:
- The contractual or pre-contractual relationship into which the interested party has entered, in relation to enrolment processing and academic management.
- Consent of the interested party for the use of any image provided in photographs and videos produced by DigiPen Bilbao and which are displayed in the national and international environments in which DigiPen participates, including social networks.
- Legitimate interest in relation to the issuance of news bulletins, internal publications, and viewbooks of the activities and services of DigiPen Bilbao.
Exercise of Rights
We inform you that you may exercise the following rights:
- The right of access to your personal data to know what data is being processed and the corresponding treatments carried out;
- The right to rectify inaccurate personal data;
- The right to request the deletion of personal data when possible;
- The right to request the limitation of personal data processing when there are doubts about accuracy, legality, or necessity. In such cases, we may retain the data for claim execution or defense.
- The right to object to the processing of personal data when the legal basis enabling such processing is a legitimate interest. DigiPen will cease processing personal data unless there is a compelling legitimate interest or in the formulation, execution, or defense of claims.
- The right to data portability when the legal basis enabling processing is a contractual relationship or explicit consent.
- The right to revoke the given consent.
To learn more about your rights, exercise them materially, or any other issue you may contact:
DigiPen Institute of Technology Europe - Bilbao.
Mission - Ribera de Zorrotzaurre, 2,
48014 Bilbao (Bizkaia), Spain
Contact information for the exercise of rights: lopd@digipen.es
Contact information for the attention of your rights in relation to international transfer to the United States:
DigiPen (USA), LLC
9931 Willows Rd NE Redmond, Washington 98052
Contact: akugler@digipen.edu (Angela Kugler)
Security and Guarantees
We aim to handle personal data consistently properly, and lawfully, aligning with current data protection principles. When DigiPen processes personal data based on legitimate interests, the Data Controller carefully assesses the interests, rights, and freedoms of the individuals involved. This assessment is done in accordance with the law, ensuring that privacy is safeguarded appropriately and not negatively impacted.
DigiPen has implemented suitable technical and organizational measures to maintain a security level that matches the associated risks. This includes considerations of current technology, implementation expenses, and the specific nature, scope, context, and data processing objectives. Additionally, it accounts for the differing probabilities and levels of risk to the rights and freedoms of individuals.
Access to the SRS
DigiPen has implemented a two-factor authentication application that students must install on their personal devices to verify access to the SRS (Student Record System) to consult the academic record or register for classes, among other purposes. Therefore, and in compliance with the provisions of current data protection regulations, we inform you:
The legal basis legitimizing this type of processing is found in Article 6.1.f) of Regulation 2016/679 of the European Parliament and of the Council, dated April 27, 2016, regarding the protection of individuals concerning the processing of personal data and the free movement of such data. This processing is appropriate for carrying out registration in the requested class and is necessary for security reasons (verifying the identity of the person accessing the information in the Student Record System and proceeding with the registration in the requested class). Moreover, this processing remains proportional as it solely handles the requisite data essential for achieving the intended objective (i.e., the authentication code).
DigiPen has taken all security measures, both technical and organizational, to preserve the security of the data collected through various systems. It has ensured that the service providers offer sufficient guarantees required as data processors.
According to the Regulation and Organic Law 3/2018 provisions of December 5 on Personal Data Protection and guarantee of digital rights, you may exercise your data protection rights at the following email address: lopd@ digipen.es. In any case, you can contact the Spanish Data Protection Agency if you disagree with the attention received regarding your rights.
Duration of Data Maintenance
We shall maintain personal data for the duration of the relationship with DigiPen and, subsequently, in accordance with that required for compliance with applicable laws. If your data is no longer necessary for the legal purposes for which it was obtained, it shall be deleted in accordance with data protection laws. Data used for publicizing our activities, including images, will be retained unless the student requests its deletion or withdraws consent for its processing.
Proxy
Students may grant ‘proxy’ to an individual to access certain aspects of their student account, by filling out the Proxy Form. The designated individual will be able to view, print, and download information to which the student has granted them access. Proxy access also grants the designated individual the right to communicate with Faculty, and Registrar about ONLY the information to which the student has permitted proxy access. This form will be distributed to all students during Orientation and can also be obtained from the Administration.
For more information on GDPR, please visit gdpr-info.eu.