1. USER INFORMATION

The ‘Fundación Universidad San Jorge’ Foundation, hereinafter the ‘Data Controller’, the ‘Service’ or ‘DIGI4MSK’, recognised by the Order of 9 March 2005 (Official Gazette of Aragón of 23 March 2005) by the Department of Government and Institutional Relations of the Government of Aragón, registered in the College Campus Villanueva de Gállego, Autovía A-23 Zaragoza- Huesca Km. 299, 50830 Villanueva de Gállego (Zaragoza), with Spanish Tax Code G-99047672, filed in the Registry of Foundations of the Regional Government of Aragón, is the Controller of the personal  data of the users of the platform, and informs that your data shall be processed in accordance with the provisions of Regulation (EU) 2016/679, of 27 April 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Therefore, you are herein provided with the following information regarding data processing:

Purposes of the processing:

1. a)    Holding a contractual relation with the User or Professional through the platform to be able to provide the service. The operations foreseen to carry out the data processing are:

• Collecting and storing personal data to provide the services described in the platform. Enabling users to manage and monitor their profile and receive health-related service, examinations, training, etc., with the help of the

• Processing orders, requests or any other type of petition made by users through any of the means of contact made available to

1. b)     Preventing musculoskeletal disorders related to work. The operations foreseen to carry out the data processing are:

• The existence of a series of questionnaires prepared by professionals, which users must fill out for their situation to be assessed. These questionnaires may process information related to users’ health data as worker, student and health professional, based on their answers and

1. c)      Sending commercial advertising communications via email, social networks or any other present or future electronic or physical means, which allows us to send commercial communications. The operations foreseen to carry out the data processing are:

• Those established for the use of the platform. These communications will be made by the Data Controller, and related to its products and/or services, or those of the collaborators or suppliers with whom the Controller has reached a promotion agreement. In this case, third parties will never have access to the personal data of the users of the

• And, if any, sending the newsletter of the

1. d)    Carrying out scientific research and statistical surveys after performing and implementing the corresponding techniques for the anonymisation of personal data, which are irreversible.

Legal basis of the different types of processing: As appropriate:

• Article 6.1.b) of the GDPR based on the contract with the data subject through the Terms of Use of the platform and this Privacy Policy to enjoy the services of the
• Articles 21. 1 and 2 of the LSSICE (Spanish Law of Information Society Services and Electronic Commerce 34/2002, of 11 July) to send commercial communications to the users of the
• Article 6.1.a) of the GDPR based on the consent of the the data subject when subscribing to the newsletter.
• Article 9.2.a) of the GDPR based on the explicit consent of the the data subject for the processing of their health

• Article 9.1.j) of the GDPR to carry out the required data processing for scientific research purposes. Notwithstanding the abovementioned, this is a subsequent use the data of which will be duly

Data storage criteria: the data will be kept for as long as the contract is in force and/or there is a mutual interest to keep the purposes of the processing in force. Once they are no longer necessary to this effect, they will be erased by applying the relevant security measures to guarantee their pseudonymisation and/or anonymisation (especially for research purposes) or the total destruction thereof.

Communication of data: Your personal data will not be sold to other organisations or companies. The only transfers foreseen are those made as required by law.

Likewise, no data transfers to third countries are foreseen.

Rights of Users:

• Right to withdraw their consent at any
• Right of access, to rectification, portability and erasure of their data and to the restrict or oppose the processing
• Right to file a claim before the supervisory authority (www.agpd.es) if they consider that the processing does not observe the current

Contact details to exercise your rights:

You may exercise at any time your rights of access, rectification and erasure of your data, and to the portability of your data or to the opposition or restriction of the processing thereof, by sending an e-mail to: privacidad@usj.es

You must identify yourself with your name and surname, as well as by providing a copy of your ID.

If you have granted consent for a specific purpose, you have the right to withdraw it at any time, without affecting the legality of the processing based on the consent prior to its withdrawal.

Moreover, if as a user of the platform you consider that there is a problem with the way the Controller handles your data, you may file a claim before the Data Protection Officer or the corresponding data protection authority. In Spain, it is the Spanish Data Protection Agency.

This document presents the terms applicable to the collection, processing and use of the personal and non-personal information of the users.

2. Information provided by users and its mandatory or optional nature

By checking the corresponding boxes and entering data in the fields marked with an asterisk (*) in the contact form or in forms available for download, users expressly, freely and unequivocally accept that their data are required by the Data Controller to meet their request, and that the inclusion of their data in the remaining fields is voluntary.

Users guarantee that the personal data provided to the Data Controller are true and they must notify the Data Controller. of any changes thereto.

Forms are filled out voluntarily. If the mandatory fields are not completed, some of the functions of the platform will not be available or will be available with limitations.

The Data Controller informs and expressly guarantees users that their personal data will not be transferred in any case to third parties, and that in case they need to carry out any type of transfer of personal data, the express, informed and unequivocal consent of the users will be requested in advance.

The personal data we collect will depend on how you use the app. We will collect the data you voluntarily provide us with (when registering on the platform, using it, sending messages, subscribing to our newsletter, etc.) and those provided by third parties (such as through social media).

3. Security measures

Pursuant to the provisions of the current regulations on personal data protection, DIGI4MSK complies with all the provisions of the regulations on personal data protection for the processing of personal data, under its responsibility. Particularly, DIGI4MSK processes personal data pursuant to the principles described in article 5 of the GDPR, according to which, data is processed in a lawful, fair and transparent manner in relation to the data subject and it should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.

DIGI4MSK guarantees that it has implemented the corresponding technical and organisational policies to implement the security measures defined in the GDPR to protect the rights and freedoms of users, and has also given Users the necessary information for them to exercise their rights.

4.- Changes to the Privacy Policy

This Privacy Policy may be updated in the future. We will inform you of these changes by sending an email to the address provided to that effect and/or featuring a notice in an outstanding place in our website.

5.- Contact

If you have any questions regarding this Privacy Policy, you can contact us at: privacidad@usj.es