Top

Privacy policy

This is a courtesy translation. The legally binding version is the Spanish text.

Information on the processing of personal data in accordance with the GDPR and the LOPDGDD.

Information on the processing of personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD, the Spanish Data Protection Act).

Data controller

The controller of the data processing is Ciudad Residencial Universitaria, S.A. (CRUSA), with registered office at Plaza San Diego, s/n, 28801 Alcalá de Henares (Madrid) and tax identification number (NIF) A-80991714.

Data Protection Officer: dpd@crusa.es.

Data we process and purpose

Through the forms on this website we process the data you provide (first name, surname(s), email address, telephone number and the content of your enquiry or booking request; for bookings, also the dates, the room type and, for a double room and if you choose to give them, the first name and surname(s) of the other person) for the purpose of managing your enquiry or your booking request at the San Ildefonso University Residence and of keeping in contact with you.

When you submit the form you also receive an automatic email at the address you entered, simply to confirm that your message or request has reached us and that we will reply as soon as we can. It is a courtesy, not an answer: in the case of a booking, the request is not confirmed until the Residence staff confirm it to you explicitly. For security reasons this automatic email is sent at most once per hour to the same address.

To protect the forms against mass submissions and abuse, the server records for one hour how many submissions arrive from the same IP address and how many acknowledgements are sent to the same email address. It does not store the IP address or the email address in clear, but a pseudonymised fingerprint of each, which stops being used after that hour and is deleted at the next automatic clean-up. If there is an error when you submit the form, what you have written is kept in your session only to give it back to you so that you do not have to type it again, and it is deleted as soon as the form is shown again. The legal basis for these security measures is the legitimate interest in protecting the website and the people who use it.

  • Legal basis: for enquiries, the consent you give when submitting the form (Art. 6(1)(a) GDPR); for booking requests, taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for the security measures described above, the legitimate interest in protecting the website and the people who use it (Art. 6(1)(f) GDPR).
  • Categories of data: identifying data and personal contact data.
  • Retention: enquiries and booking requests that are not confirmed, for one year from the last communication; confirmed bookings, for six years, the period required by Article 30 of the Spanish Commercial Code (Código de Comercio). After those periods, the data is deleted. Security fingerprints and session data are kept as explained above.
  • Recipients: data is not disclosed to third parties, except where legally required. The website and email are hosted by Webempresa, which processes the data only on behalf of CRUSA, as a data processor, on servers in the European Union.
  • International transfers: no data transfers are made outside the European Union.

Your rights

You may exercise the following rights over your personal data:

  • Access: to know what data of yours we process.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure: to request that your data be deleted.
  • Restriction: to request that processing be restricted in the cases provided for by law.
  • Portability: to receive your data in a structured, commonly used format.
  • Objection: to object to processing on grounds relating to your particular situation.
  • Withdrawal of consent: to withdraw, at any time, the consent you have given. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise them you may write by post to Ciudad Residencial Universitaria, S.A., Plaza San Diego, s/n, 28801 Alcalá de Henares (Madrid), or by email to the Data Protection Officer: dpd@crusa.es. Where there are reasonable doubts about your identity, you may be asked for the additional information necessary to confirm it. You will receive a reply within a maximum of one month.

Complaint to the supervisory authority

If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency, AEPD) (Paseo de la Castellana, 141, 9th floor, 28046 Madrid · telephone +34 900 293 183 · www.aepd.es).

Accuracy of the data

The data provided must be true, accurate and up to date; the user is responsible for its accuracy. People aged 14 or over may consent to the processing of their data themselves; children under 14 need the consent of their parents or legal guardians. A booking leads to a contract: if the person requesting it is under 18, it must be formalised by their parents or legal guardians.