Data Protection Policy

OUR COMMITMENT TO PERSONAL DATA PROTECTION:

“INFORMED PEOPLE AND PROTECTED DATA”**

The Management of Fundación Parque Científico y Tecnológico de Castilla-La Mancha (hereinafter, the Data Controller) assumes the highest level of responsibility and commitment to the establishment, implementation and maintenance of this Data Protection Policy, ensuring the continuous improvement of the Data Controller with the aim of achieving excellence in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR) (OJ L 119/1, 4 May 2016), as well as Spanish personal data protection legislation (Organic Law, specific sectoral legislation and its implementing regulations).

The Data Protection Policy of Fundación Parque Científico y Tecnológico de Castilla-La Mancha is based on the principle of accountability, whereby the Data Controller is responsible for compliance with the regulatory and legal framework governing this Policy and must be able to demonstrate such compliance to the competent supervisory authorities.

Accordingly, the Data Controller shall be governed by the following principles, which shall serve as guidelines and a reference framework for all personnel involved in the processing of personal data:

  1. Data protection by design: The Data Controller shall implement, both when determining the means of processing and at the time of the processing itself, appropriate technical and organisational measures, such as pseudonymisation, designed to effectively implement data protection principles, such as data minimisation, and to integrate the necessary safeguards into the processing.

  2. Data protection by default: The Data Controller shall implement appropriate technical and organisational measures to ensure that, by default, only personal data that are necessary for each specific purpose of the processing are processed.

  3. Data protection throughout the information lifecycle: Measures designed to ensure the protection of personal data shall apply throughout the entire information lifecycle.

  4. Lawfulness, fairness and transparency: Personal data shall be processed lawfully, fairly and transparently in relation to the data subject.

  5. Purpose limitation: Personal data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes.

  6. Data minimisation: Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

  7. Accuracy: Personal data shall be accurate and, where necessary, kept up to date. Every reasonable measure shall be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.

  8. Storage limitation: Personal data shall be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

  9. Integrity and confidentiality: Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, through the implementation of appropriate technical or organisational measures.

  10. Information and training: One of the key elements in ensuring the protection of personal data is the training and information provided to personnel involved in their processing. Throughout the information lifecycle, all personnel with access to personal data shall receive appropriate training and information regarding their obligations concerning compliance with data protection legislation.

The Data Protection Policy of Fundación Parque Científico y Tecnológico de Castilla-La Mancha shall be communicated to all personnel of the Data Controller and made available to all interested parties.

Accordingly, this Data Protection Policy applies to all personnel of the Data Controller, who must be familiar with it, accept it and regard it as their own. Each member of staff shall be responsible for applying the Policy and verifying the data protection rules applicable to their activities, as well as identifying and proposing any opportunities for improvement they consider appropriate, with the aim of achieving excellence in compliance.

This Policy shall be reviewed by the Management of Fundación Parque Científico y Tecnológico de Castilla-La Mancha as often as deemed necessary to ensure that it remains aligned at all times with the applicable personal data protection legislation.