Privacy Policy
This Privacy Policy explains how personal information is collected, used, managed, retained and protected when individuals browse GUTEC University, request information, apply for admission, enrol in training programmes, purchase educational services, access digital learning environments or otherwise interact with the services available through gutec.university.
The educational and commercial activities presented under the GUTEC University name are operated by NEXORA GENERATION, SOCIEDAD DE RESPONSABILIDAD LIMITADA, which acts as the data controller for the processing activities described in this Policy.
Personal data is processed in accordance with Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE) and any other Spanish or European Union rules that may apply to the relevant processing activity.
1. IDENTITY OF THE DATA CONTROLLER
The entity legally responsible for the processing of personal data through GUTEC University is:
Legal name: NEXORA GENERATION, SOCIEDAD DE RESPONSABILIDAD LIMITADA
Short company name: Nexora Generation, S.L.
Legal form: Single-Member Limited Liability Company (Sociedad de Responsabilidad Limitada Unipersonal – SLU)
Tax Identification Number (NIF/CIF): B93900314
Registered and tax address: C/ Lladró y Mallí, 10, Esc. C, Piso 3, Pta. 14 — 46007 València (Valencia), Spain
Principal CNAE activity: 8559 — Other education not elsewhere classified
Commercial educational brand: GUTEC University
Website: https://gutec.university/
Contact email: info@gutec.university
For the purposes of applicable data protection legislation, Nexora Generation, S.L. is the data controller, as it determines the purposes and means of the processing carried out in connection with GUTEC University.
References throughout this Policy to “GUTEC”, “GUTEC University”, “we”, “us” or “our” refer to the educational activity conducted by Nexora Generation, S.L. under the GUTEC University commercial brand.
2. SCOPE OF THIS PRIVACY POLICY
This Policy applies to personal data processed through:
GUTEC University websites.
Online contact forms.
Admission and enrolment processes.
Student accounts.
Virtual learning environments.
Educational platforms.
Payment and billing processes.
Academic communications.
Student support services.
Certification procedures.
Other digital services directly managed in connection with GUTEC University.
It applies to prospective students, enrolled students, customers, website visitors, professional contacts and other individuals who interact with GUTEC services.
3. NATURE OF GUTEC EDUCATIONAL SERVICES
GUTEC University provides and commercialises proprietary professional and specialised training programmes developed or managed within the educational activity of Nexora Generation, S.L.
The training portfolio may include programmes in areas such as:
Civil engineering.
Construction.
Building engineering.
Architecture.
Infrastructure.
BIM and digital construction.
Building systems.
Project management.
Rehabilitation.
Sustainability.
Materials.
Industrial processes.
Technology.
Other technical and professional disciplines.
Available formats may include:
Courses.
Diploma programmes.
Proprietary master’s programmes.
Specialist programmes.
Advanced training programmes.
Executive education.
Professional development programmes.
Technical training.
Unless the information relating to a specific programme expressly establishes otherwise on a legally supported basis, programmes offered directly by GUTEC are proprietary training programmes.
They should not automatically be understood as official Spanish university degrees, regulated university qualifications, professional licences or qualifications registered in the Spanish Registry of Universities, Centres and Degrees (RUCT).
Successful completion may entitle the student to receive the corresponding proprietary certificate, diploma, training credential or other completion document, subject to the specific requirements of the programme.
4. DATA PROTECTION PRINCIPLES
Personal information handled through GUTEC will be processed in accordance with the principles established under Article 5 GDPR.
4.1. Lawfulness, fairness and transparency
Processing must rely on an appropriate legal basis and individuals must be provided with understandable information about how their personal data is used.
4.2. Purpose limitation
Personal information will be collected for specified, explicit and legitimate purposes and will not subsequently be used in a manner incompatible with those purposes.
4.3. Data minimisation
GUTEC will seek to collect only information that is adequate, relevant and necessary for the relevant activity.
4.4. Accuracy
Reasonable steps will be taken to ensure that personal information is accurate and, where necessary, kept up to date.
4.5. Storage limitation
Personal data will not be kept in identifiable form for longer than reasonably necessary, without prejudice to statutory retention requirements.
4.6. Integrity and confidentiality
Appropriate measures will be implemented to protect personal information against unauthorised access, alteration, disclosure, accidental loss or destruction.
4.7. Accountability
Nexora Generation, S.L. is responsible for implementing appropriate measures and procedures designed to demonstrate compliance with applicable data protection obligations.
5. PURPOSES FOR WHICH PERSONAL DATA IS PROCESSED
Personal information may be processed for different purposes depending on the relationship between the individual and GUTEC.
5.1. Information requests and enquiries
When an individual contacts GUTEC, personal data may be used to:
Identify the enquiry.
Respond to questions.
Provide programme information.
Explain learning methodologies.
Provide tuition or pricing information.
Explain admission requirements.
Provide enrolment guidance.
Respond to administrative questions.
Enquiries may be received through website forms, email, messaging systems or other authorised communication channels.
5.2. Admission procedures
Where a programme includes an admission process, information may be processed to:
Register the application.
Identify the applicant.
Review submitted documentation.
Assess programme entry requirements.
Communicate with the applicant.
Request additional information where necessary.
Process admission decisions.
Prepare subsequent enrolment.
5.3. Enrolment and contracting
Where a student purchases or enrols in a programme, data may be processed to:
Formalise the enrolment.
Create the relevant student record.
Associate the student with the programme purchased.
Manage contractual conditions.
Process administrative requirements.
Activate access to educational services.
Manage the contractual relationship.
5.4. Delivery of educational services
Personal information may be used to provide the training purchased by the student, including:
Creating student accounts.
Activating platform access.
Assigning learning content.
Managing programme participation.
Recording learning progress.
Managing exercises.
Conducting assessments.
Recording results.
Providing academic support.
Providing technical support.
Managing programme completion.
5.5. Academic records and programme administration
GUTEC may maintain information relating to:
Enrolment.
Programme participation.
Learning progress.
Submitted activities.
Assessments.
Results.
Completion status.
Academic communications.
Certificates or diplomas issued.
This information is processed where necessary to manage and document the educational relationship.
5.6. Certificates and proprietary credentials
Certain information may be retained or processed in order to:
Prepare certificates.
Issue diplomas.
Record successful completion.
Produce replacement documentation.
Verify previously issued credentials.
Respond to student requests concerning their training records.
5.7. Billing, payment and accounting
Financial and identification information may be processed for:
Payment administration.
Invoice creation.
Payment reconciliation.
Refund management.
Accounting.
Tax compliance.
Commercial record-keeping.
Financial administration.
Full payment card information may be processed directly by authorised payment service providers or financial institutions rather than being stored by GUTEC.
5.8. Student support
Personal data may be used to manage questions or incidents relating to:
Accounts.
Enrolment.
Learning content.
Platform access.
Assessments.
Payments.
Billing.
Certificates.
Administrative documentation.
Technical problems.
5.9. Essential service communications
GUTEC may send communications that are necessary to administer an existing educational or contractual relationship.
These may include:
Enrolment confirmations.
Access instructions.
Payment notifications.
Academic notices.
Assessment information.
Programme updates.
Support responses.
Certificate notifications.
Administrative communications.
Security alerts.
Communications that are strictly necessary to provide the contracted service are not treated as optional direct marketing.
5.10. Marketing and educational information
Where an appropriate lawful basis exists, GUTEC may send information concerning:
New programmes.
Course intakes.
Proprietary master’s programmes.
Diploma programmes.
Specialist training.
Educational events.
Professional content.
Promotions.
GUTEC news.
Where consent is required, such communications will only be sent after valid consent has been obtained.
5.11. Website and platform security
Technical information may be processed for purposes including:
Access security.
Account protection.
Fraud detection.
Identity misuse prevention.
Investigation of suspicious activity.
Infrastructure protection.
Cybersecurity monitoring.
Incident investigation.
Security logging.
5.12. Legal and regulatory compliance
Information may be processed when necessary to comply with:
Tax obligations.
Accounting requirements.
Commercial legislation.
Consumer protection obligations.
Data protection legislation.
Court orders.
Regulatory obligations.
Legitimate requests from public authorities.
6. LAWFUL BASES FOR PROCESSING
GUTEC does not rely on a single legal basis for all personal data processing.
The appropriate basis depends on the purpose and circumstances of each activity.
6.1. Pre-contractual measures
Processing may be necessary before entering into a contract when an individual:
Requests detailed information about a programme.
Starts an admission process.
Submits an application.
Requests enrolment-related assistance.
6.2. Performance of a contract
Article 6(1)(b) GDPR may apply where processing is necessary to:
Manage enrolment.
Deliver a purchased programme.
Provide virtual campus access.
Manage assessments.
Provide student support.
Process contractual payments.
Issue programme documentation.
Maintain the educational relationship.
6.3. Compliance with legal obligations
Article 6(1)(c) GDPR may apply where Nexora Generation, S.L. is required to process or retain information to comply with tax, accounting, commercial, administrative, judicial or other legally binding obligations.
6.4. Consent
Consent may be relied upon for activities such as:
Newsletter subscriptions.
Certain marketing communications.
Non-essential cookies.
Optional forms.
Other activities expressly identified as consent-based.
Consent may be withdrawn at any time.
Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
6.5. Legitimate interests
Article 6(1)(f) GDPR may apply where processing is necessary and proportionate for legitimate purposes such as:
Protecting systems.
Preventing fraud.
Securing accounts.
Investigating misuse.
Defending legal claims.
Improving internal operational processes.
Maintaining service integrity.
Where legitimate interests are relied upon, the interests and fundamental rights of the individual will be considered.
7. CATEGORIES OF PERSONAL DATA
The information processed will depend on the services used.
7.1. Identification data
This may include:
First name.
Last name.
Identification document details where required.
Date of birth where legitimately necessary.
Other information reasonably necessary to establish identity.
7.2. Contact information
This may include:
Email address.
Telephone number.
Postal address where required.
Professional contact details.
7.3. Admission information
Depending on a programme’s requirements, admission information may include:
Programme selected.
Previous education.
Professional experience.
Curriculum vitae.
Employment information.
Supporting academic documents.
Other information voluntarily provided during the application.
7.4. Educational information
Information generated during the educational relationship may include:
Programme enrolment.
Learning progress.
Activities.
Assessment participation.
Assessment results.
Completion status.
Certificates.
Diplomas.
Proprietary training credentials.
7.5. Billing and financial information
Where applicable, data may include:
Billing name.
Company details.
Tax identification information.
Billing address.
Amounts invoiced.
Payment status.
Transaction references.
Refund information.
7.6. Technical and security data
Systems may generate:
IP addresses.
Session identifiers.
Device information.
Browser information.
Operating system information.
Login records.
Access dates and times.
Technical logs.
Security events.
8. SPECIAL CATEGORIES OF PERSONAL DATA
As a general rule, GUTEC does not request special categories of personal data as defined under Article 9 GDPR.
These categories include information concerning:
Health.
Racial or ethnic origin.
Political opinions.
Religious beliefs.
Philosophical beliefs.
Trade union membership.
Genetic information.
Biometric identification.
Sexual life.
Sexual orientation.
Where such information becomes exceptionally necessary, processing will only take place where an appropriate legal basis exists and any additional obligations have been satisfied.
Users should not submit unnecessary sensitive information through general enquiry forms or ordinary email communications.
9. SOURCES OF PERSONAL INFORMATION
Personal data may be obtained from several sources.
9.1. Information supplied directly by the individual
This may include information supplied through:
Contact forms.
Admission applications.
Enrolment forms.
Emails.
Support requests.
Billing procedures.
Documentation voluntarily submitted.
9.2. Information generated through educational services
Data may also be created during use of:
The virtual campus.
Learning resources.
Assessment systems.
Support services.
Student accounts.
Certification processes.
9.3. Technical information
Certain data may be generated automatically through normal use of websites and digital services, including access logs, security information and device or browser data.
9.4. Payment service information
Financial institutions or payment service providers may provide limited transaction information, such as whether a payment has been:
Authorised.
Rejected.
Refunded.
Cancelled.
Left pending.
10. ACCURACY OF PERSONAL INFORMATION
Users are responsible for ensuring that information provided to GUTEC is accurate, complete and reasonably up to date.
Where material information changes, the user should update it through the available systems or inform GUTEC.
Nexora Generation, S.L. may request reasonable verification where necessary to:
Confirm identity.
Prevent fraud.
Process enrolment.
Issue certificates.
Comply with legal requirements.
11. INFORMATION RELATING TO THIRD PARTIES
A user who submits personal information concerning another individual must have an appropriate legal basis for doing so.
Where required, the third party must also have been informed about the disclosure.
Users should not submit personal information about third parties where it is unnecessary for the requested service.
12. MANDATORY INFORMATION
Some forms may identify certain fields as mandatory.
Failure to provide required information may prevent GUTEC from:
Responding to a request.
Processing an application.
Completing enrolment.
Creating an account.
Delivering a programme.
Issuing an invoice.
Complying with legal requirements.
Optional information will be used for the purposes identified at the point of collection.
13. RECIPIENTS AND SERVICE PROVIDERS
Nexora Generation, S.L. does not sell personal data or student databases to unrelated third parties.
However, delivering digital education and operating an online platform may require the involvement of professional and technology providers.
Depending on the services used, these may include:
Website hosting providers.
Cloud infrastructure services.
Learning management systems.
Email providers.
Customer support tools.
IT providers.
Cybersecurity services.
Administrative software.
Backup providers.
Storage providers.
Analytics tools.
Banks.
Payment gateways.
Accounting advisers.
Tax advisers.
Legal advisers.
Where these providers process personal data on behalf of Nexora Generation, S.L., appropriate contractual arrangements will be implemented in accordance with Article 28 GDPR where required.
14. DISCLOSURES TO PUBLIC AUTHORITIES
Personal data may be disclosed to competent authorities where required or authorised by applicable law.
Potential recipients may include:
Tax authorities.
Courts.
Tribunals.
Public administrations.
Law enforcement bodies.
Regulatory authorities.
Other legally competent bodies.
Only information reasonably necessary for the relevant legal purpose will be disclosed.
15. INTERNATIONAL DATA TRANSFERS
Certain technology providers may operate outside the European Economic Area (EEA) or process information using infrastructure situated in third countries.
Where an international data transfer takes place, Nexora Generation, S.L. will use an appropriate mechanism recognised under Chapter V GDPR.
Depending on the circumstances, safeguards may include:
European Commission adequacy decisions.
Standard Contractual Clauses.
Binding Corporate Rules.
Additional contractual safeguards.
Technical and organisational protections.
Other legally recognised transfer mechanisms.
16. DATA RETENTION
Personal information will not be retained indefinitely merely because it has been collected.
The relevant retention period depends on the purpose and applicable legal requirements.
16.1. General enquiries
Enquiry information may be retained for the period necessary to provide a response and subsequently for a reasonable period where necessary to manage follow-up questions or possible claims.
16.2. Admission applications
Application data may be retained throughout the admission process and afterwards for a reasonable period where necessary for administrative purposes, dispute management or legal accountability.
16.3. Enrolled students
Information necessary to deliver a programme and administer the contractual relationship will generally be retained for the duration of the relationship and subsequently for any applicable statutory or limitation period.
16.4. Academic and certification records
Certain essential records may be retained where necessary to document:
Enrolment.
Assessment.
Completion.
Certificates issued.
Diplomas issued.
Subsequent verification requests.
16.5. Tax and accounting records
Invoices, payment records and other legally relevant financial documentation will be retained for the periods established under applicable Spanish tax, commercial and accounting legislation.
16.6. Marketing information
Where marketing is based on consent, information may be processed until consent is withdrawn.
Where another lawful basis applies, processing may continue until that basis no longer applies or a valid objection is exercised.
16.7. Technical and security records
Security logs may be retained for the period reasonably necessary to:
Investigate incidents.
Prevent fraud.
Protect systems.
Manage security.
Defend claims.
Satisfy compliance requirements.
When retention is no longer justified, personal data will be deleted, anonymised or blocked where required by law.
17. DATA PROTECTION RIGHTS
Individuals whose data is processed may exercise the rights granted by the GDPR and applicable Spanish legislation.
17.1. Right of access
You may request confirmation as to whether Nexora Generation, S.L. processes personal data concerning you and, where applicable, obtain access to that information.
17.2. Right to rectification
You may request correction of inaccurate personal information or completion of incomplete data.
17.3. Right to erasure
You may request deletion of personal information where the statutory requirements are satisfied.
This right is not absolute. Certain information may need to be retained to comply with legal obligations or defend legal claims.
17.4. Right to object
You may object to processing based on legitimate interests in the circumstances established by the GDPR.
You may object to direct marketing at any time.
17.5. Right to restriction of processing
You may request temporary or permanent restriction of processing in the circumstances provided for by applicable law.
17.6. Right to data portability
Where legally applicable, you may request data that you provided in a structured, commonly used and machine-readable format.
Where technically feasible and legally applicable, you may also request direct transmission to another controller.
17.7. Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
17.8. Rights regarding automated decisions
Where legally applicable, you have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you, except in the circumstances permitted by law.
18. HOW TO EXERCISE YOUR DATA PROTECTION RIGHTS
Requests may be addressed to:
NEXORA GENERATION, SOCIEDAD DE RESPONSABILIDAD LIMITADA
Tax Identification Number (NIF/CIF): B93900314
Address: C/ Lladró y Mallí, 10, Esc. C, Piso 3, Pta. 14 — 46007 València (Valencia), Spain
Email: info@gutec.university
A suitable email subject is:
“Data Protection – Rights Request”
The request should clearly state:
The identity of the applicant.
The right being exercised.
Sufficient information to understand the request.
Relevant contact information.
A copy of an identity document will not automatically be required in every case.
Where reasonable doubts exist regarding identity, additional proportionate information may be requested solely for verification purposes.
19. RESPONSE TO RIGHTS REQUESTS
Requests will be handled within the periods established under the GDPR.
Where permitted by law, the response period may be extended in cases involving particularly complex requests or a high volume of requests.
Where an extension applies, the individual will be informed as required by law.
20. RIGHT TO LODGE A COMPLAINT
Individuals who believe that their personal information has been processed contrary to applicable data protection law may lodge a complaint with the competent supervisory authority.
For processing activities carried out in Spain, the relevant authority is the:
Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD).
Individuals may also contact GUTEC first at info@gutec.university so that the matter can be reviewed directly.
21. INFORMATION SECURITY
Nexora Generation, S.L. implements technical and organisational safeguards designed to achieve a level of protection appropriate to the relevant risks.
Measures may include:
Authentication controls.
Restricted access.
Permission management.
Infrastructure protection.
Backup systems.
Technical logging.
Monitoring.
Security procedures.
Incident management.
Encryption where appropriate.
Security measures may evolve in response to technological developments, system changes and identified risks.
22. SECURE COMMUNICATIONS
GUTEC may use security technologies such as TLS/SSL to protect information transmitted between users and its online systems.
Although these measures reduce certain risks, no Internet-based system can guarantee absolute security.
Users should also take appropriate precautions when accessing digital services.
23. PERSONAL DATA BREACHES
Where a personal data breach occurs, Nexora Generation, S.L. will assess the incident in accordance with the GDPR.
Where required, the incident will be reported to the competent supervisory authority.
Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, those individuals will also be informed without undue delay where legally required.
24. CONFIDENTIALITY
Personnel, contractors and authorised providers who have access to personal information must maintain appropriate confidentiality.
Access should be limited to persons who require the information for legitimate professional or operational purposes.
Confidentiality obligations may continue after the relevant professional or contractual relationship ends.
25. CHILDREN AND MINORS
GUTEC’s directly commercialised educational services are generally intended for individuals 18 years of age or older.
GUTEC does not intentionally seek to collect personal data from minors through services intended exclusively for adults.
Where information concerning a minor is identified without an appropriate lawful basis, reasonable steps may be taken to restrict, erase or otherwise appropriately manage that information.
26. MARKETING COMMUNICATIONS
Where legally permitted, GUTEC may send information relating to:
New courses.
Diploma programmes.
Proprietary master’s programmes.
Specialist programmes.
New intakes.
Educational activities.
Professional content.
Promotions.
Where consent is required, marketing communications will only be sent after valid consent has been obtained.
Where required, communications will include a straightforward means of unsubscribing or objecting to future marketing.
27. COOKIES AND SIMILAR TECHNOLOGIES
The website may use cookies and comparable technologies for purposes such as:
Essential website operation.
Session management.
Security.
Preferences.
Analytics.
Performance measurement.
Advertising or campaign measurement where applicable.
Non-essential technologies that require consent will only be activated after the user has made the relevant choice.
Detailed information about the technologies used should be consulted in GUTEC University’s Cookie Policy.
28. THIRD-PARTY WEBSITES
GUTEC may provide links to websites, platforms or services operated independently by third parties.
Nexora Generation, S.L. is not generally responsible for the privacy practices of independently operated external websites.
Each external operator will determine its own processing activities and privacy conditions.
Users are encouraged to review the applicable privacy notice before providing information to an external service.
29. AUTOMATED DECISION-MAKING AND PROFILING
As a general rule, GUTEC does not make decisions based solely on automated processing that produce legal effects or similarly significant consequences for individuals.
If such processing is introduced in the future, affected individuals will be provided with the information required under applicable law, including, where appropriate:
The existence of automated processing.
Its purpose.
Meaningful information regarding its general logic.
Potential consequences.
Applicable rights.
30. CHANGES TO THIS PRIVACY POLICY
Nexora Generation, S.L. may revise this Privacy Policy where appropriate to reflect:
Changes in legislation.
Regulatory guidance.
New GUTEC services.
Changes in educational processes.
Technological developments.
New providers.
Changes in processing operations.
Security requirements.
The version published on gutec.university at the relevant time will be considered the current version.
Where a change materially affects how personal data is used, additional notice will be provided where legally required.
31. APPLICABLE LEGISLATION
This Privacy Policy is primarily governed by:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – General Data Protection Regulation (GDPR).
Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).
Any other Spanish or European Union rules applicable to the processing activities carried out through GUTEC University.
32. PRIVACY CONTACT DETAILS
For questions regarding this Privacy Policy or to exercise data protection rights, you may contact:
NEXORA GENERATION, SOCIEDAD DE RESPONSABILIDAD LIMITADA
Short company name: Nexora Generation, S.L.
Tax Identification Number (NIF/CIF): B93900314
Legal form: Single-Member Limited Liability Company (SLU)
Registered and tax address: C/ Lladró y Mallí, 10, Esc. C, Piso 3, Pta. 14 — 46007 València (Valencia), Spain
Commercial educational brand: GUTEC University
Website: https://gutec.university/
Email: info@gutec.university