Personal data protection

The protection of personal data is of vital importance to UNIVERSIDAD TECNOLÓGICA ECOTEC. Our processes, processing operations, activities, and educational services are designed to guarantee data protection and information security as part of our institutional goals of continuous improvement. For this reason, through this Policy, we inform all our students, applicants, alumni, employees, candidates, faculty, suppliers, and data subjects in general, in a simple and transparent manner, about the processing of their personal data.

1. What is the purpose of our Privacy Policy?

To establish the general guidelines for the processing of personal data at Universidad Tecnológica ECOTEC, fulfilling the duty to inform and strengthening trust between the Controller and Data Subjects regarding the processing carried out. It also serves to inform Data Subjects of the purposes for which their personal data are processed and the mechanisms for exercising their rights.

2. What is the scope of this Policy?

This Policy applies to all databases or files that contain personal data and are processed by Universidad Tecnológica ECOTEC. The activities carried out by the institution, as data controller, comply with the principles and rights set forth in the Organic Law on Personal Data Protection, published on May 26, 2021, in Official Registry No. 459 (5th Supplement), and its General Regulations, published on November 13, 2023, in Official Registry No. 435 (3rd Supplement).

3. Who is the controller of personal data?

Universidad Tecnológica ECOTEC (hereinafter ECOTEC), identified with Single Taxpayer Registry (RUC) No. 0992489812001, domiciled at Km. 13.5 Vía a Samborondón, ECOTEC Campus, Samborondón canton, Guayas province, Ecuador.

You may contact us by email at dpd@ecotec.edu.ec

4. What is the role of the Data Protection Officer?

The Data Protection Officer (DPO) is the person who oversees compliance with our data protection policy, ensuring that data are processed appropriately and that the rights of data subjects are protected. Among the DPO’s duties is handling any questions, suggestions, complaints, or claims from the people whose data we process. You may contact the Data Protection Officer in writing at our address or directly by email at dpd@ecotec.edu.ec

5. For what purposes and on what legal basis do we process data?

Our processing of personal data focuses on protecting the rights of data subjects and on the principle of proportionality. This means that, in each case, we process data that are adequate, relevant, and limited to fulfilling the explicit purposes for which they were obtained, in order to provide the educational services that are our mission and to ensure the proper functioning of the institution.

ECOTEC processes personal data mainly to provide academic, research, and cultural services, to send communications about our activities and services, and to develop the relationships we maintain with our visitors, employees, faculty, suppliers, and other data subjects.

Depending on the data subject, we use personal data for the following activities and on the following legal bases set forth in Art. 7 of the Organic Law on Personal Data Protection:

a) On the basis of the performance of pre-contractual measures

• To verify, analyze, and record applicant information and manage the admission process for the various academic programs.
• To manage supplier selection.
• For candidate selection processes.
• To review the academic and professional profiles of faculty in selection processes.

b) To fulfill contractual obligations

• To record and maintain the information of admitted students in the University’s academic information system.
• To manage the notification and resolution of payment issues by email.
• To categorize payment rates according to the academic plan and the student aid system.
• To manage the legal relationship with suppliers, including the corresponding payment.
• To manage human talent records, including payroll management, communications to employees, and additional employee benefits.
• To manage and resolve Information Technology issues at the University with students, staff, and faculty.
• Likewise, to carry out core processes such as handling requests, reviewing academic and professional profiles for faculty retention, and communicating work activities, research, and event invitations.
• Management of communications and incidents related to studies and work.
• To manage accreditations and certifications for students and faculty.
• For community engagement activities, pre-professional practicums, internships, mobility, and internationalization, including communications related to social impact projects, international exchange and cooperation activities, and scholarships.
• Management of library services.
• For activities related to student affairs, including student profiling to ensure the well-being of the various vulnerable groups.

c) In compliance with legal obligations

• Management of accident insurance for students.
• Financial management related to the registration and payment of Social Security contributions, as well as issuing payment receipts, withholding certificates, and other tax documents.
• Monitoring and recording of working hours (hours worked) of employees and tenured faculty, in compliance with obligations and the exercise of specific rights in the employment context.
• Profiling of student and faculty information for reporting to and registration in the Comprehensive Higher Education Information System, as well as recording the information required by the competent public institutions such as SENESCYT, CACES, and CES.

d) On the basis of free, unequivocal, and informed consent

• Explicit consent is required to monitor the entry and exit of students, faculty, employees, and staff at ECOTEC facilities using biometric data from facial recognition or fingerprints, depending on the system implemented on each campus. Likewise, explicit consent is requested for body temperature monitoring through the technical systems implemented at the University on each campus, in order to prevent the spread of viruses and the transmission of diseases within the facilities.
• To manage candidate selection when the processing of special category data is required.
• To monitor call center calls and handle information requests.
• For communications about work activities, research, and event invitations with data subjects with whom there is no contractual relationship.
• For commercial and marketing activities.
• To manage information on host families in mobility and internationalization processes.
• To control the loan of audiovisual equipment and the sharing of videos and photographs produced by students.

e) On the basis of our legitimate interest

• To control access to the University’s facilities, including video surveillance and/or license plate capture, in order to protect the safety of people, facilities, movable property, and infrastructure through formal physical access control, always observing the applicable security measures, principles, and limitations.
• To verify the proper use of resources by users of ECOTEC applications and platforms, and to maintain the security of the University’s computer systems.
• To investigate breaches of the University’s internal regulations, policies, and manuals and to apply sanctions.
• To analyze the University’s installed and operating capacity.
• For performance evaluations of the University’s employees and faculty, and the management of surveys and training.
• To analyze information in order to generate academic planning indicators.

In connection with the above, we describe the main purposes of data processing at the University:

Academic management

ECOTEC records and processes the data of people who apply in the admission process and subsequently complete their enrollment, in order to provide its higher education services. In addition, during their time at the University, personal data may be requested on various occasions, such as for teaching activities, participation in student activities, and each school’s internal processes, among others.

The data provided and those resulting from academic activity make it possible to monitor and evaluate students. Managing the student’s academic record is the most significant data processing activity, as it is interrelated with the University’s other areas, including enrollment, registration, record keeping, campus life, and the fulfillment of core, academic, and legal obligations.

Student data are also used for administrative purposes, that is, to identify students as users of the University’s services; to enable access to these services; to send information of interest; to process and issue degrees; and to track job placement and alumni benefits. This also includes monitoring student national mobility and internationalization processes, managing practicums and internships, and recording classes, among others.

For online academic services, ECOTEC may record virtual/online assessments to ensure their security and as evidence of the assessment. Accordingly, the purpose of the recording is to verify the students’ presence, the completion of the assessment, and to prevent students from engaging in certain inappropriate conduct during the assessment. In addition, when necessary, classes and academic events held remotely may be recorded, and therefore the image and, where applicable, the voice of students who are either physically present in the classroom or interacting through digital tools will be processed.

The University may share class recordings through the learning tools or platforms established by ECOTEC; in this case, access will be restricted to the University’s students and professors, as well as to the University employees responsible for maintaining that system, and students are strictly prohibited from distributing them. Under no circumstances may students record classes unless they have obtained the consent of those present, bearing in mind that ECOTEC will have decision-making authority over sharing class recordings.

If any of the personal data required by the University are not provided, we would be unable to carry out academic management and the purposes linked to these processes.

Contact management

We process personal data to channel the requests for information, suggestions, and complaints you may send us, to contact the sender, to respond to requests made by data subjects through any of the contact methods made available to them, and to follow up afterward.

We also obtain data through in-person interactions and other channels, such as emails, phone calls, or our social media profiles. In all cases, the data are used only for the explicit purposes that justify their collection and processing.

Human talent management and recruitment

We process personal data in the course of the employment relationship with the University’s administrative, general services, and teaching staff. This includes processing their personal data for payroll, well-being and employee benefits, work-related communications, access control and compliance with working hours, and the management of general information in human resources records to fulfill legal and contractual obligations.

Data are also processed for recruitment processes, in order to assess how well candidates’ profiles match vacant or newly created positions. We collect and keep the résumés sent to us by people interested in working with us. Our practice is to keep, for approximately one year, the data of people who, after completing the selection process, are not hired by ECOTEC. The reason for keeping these data is in case a new vacancy or position that may suit the candidate’s profile arises in the short term. However, in this case, we immediately delete the data if the data subject so requests.

Management of information on activities and services

Based on the information provided, we send commercial communications by electronic means to inform interested data subjects about the various services and activities offered by ECOTEC, as well as the events it organizes. In connection with sending these communications, we may create commercial profiles in order to offer you the academic services that best suit your interests.

In addition, once studies have been completed, we use alumni contact details to send them information about our services and activities.

Supplier and faculty management

We record and process the data of suppliers and external and visiting faculty from whom we obtain services or goods. This category includes data obtained from data subjects who represent or work for legal entities and that are processed within the contractual relationship. We obtain only the data essential to maintain the commercial relationship and/or the provision of services, use them solely for this purpose, and within the normal scope of this type of relationship.

Statistical reporting

The purpose of processing data for statistical reports is to fulfill the obligation to analyze the quality of the academic service offered and the student and faculty body. These reports will be submitted to the competent public education authorities in anonymized form and/or in accordance with the guidelines set by the authority. Processing data for this purpose is mandatory, since otherwise these reports could not be prepared.

Likewise, the processing is intended for the internal assessment of the quality of the academic services offered by ECOTEC and to propose improvements. Statistical reports will be kept indefinitely when they contain anonymized information.

The legal basis for processing data for statistical purposes is both compliance with a legal obligation, in the case of reports that must be submitted to public education authorities, and legitimate interest, in the case of internal reports, with the processing being proportionate to the purpose pursued.

Video surveillance and security management at the facilities

At the entrances to our facilities, the presence of video surveillance cameras is indicated, where applicable, by information signs. Likewise, visitors’ ID cards may be requested to register their entry, and vehicle license plate information may be captured in order to maintain control and ensure the safety of the people who enter and are within the University’s facilities, as well as of all its property and assets. Cameras record images only of the points where this is justified to ensure the safety of property and people, and the images are used solely for this purpose and kept for approximately 20 days.

Management of access control and working hours through facial recognition or fingerprints, and body temperature monitoring

ECOTEC may, on certain occasions, process biometric facial recognition or fingerprint data to verify the identity of students, faculty, staff, or employees who have access to our systems and facilities, in order to maintain control and security at the University. Likewise, these biometric data may be processed to monitor the working hours of employees and faculty, in compliance with obligations and the exercise of specific rights in the employment context. Body temperature monitoring is carried out to prevent the spread of viruses and the transmission of diseases within the facilities.

This biometric data processing depends on the systems implemented by the University on each campus. For this purpose, ECOTEC has taken the necessary actions to ensure compliance with data protection regulations, guaranteeing at all times the confidentiality, integrity, availability, and resilience of the institution’s personal data and systems.

Management of data subjects’ participation in academic events

During participation in the various activities and events held by the University, images of participants and visitors may be captured through photographs and videos. The University reserves the right to take photographs and recordings of all activities and events it organizes, individually or in collaboration with third parties, as part of its legitimate interest.

Website users and management of proper use of resources

The browsing system and software that enable our website to function collect the data ordinarily generated through the use of internet protocols. This category of data includes, among others, the IP address or domain name of the computer used by the person connecting to the website. This information is not associated with specific users and is used solely to obtain statistical information on website use. The ECOTEC website uses cookies that make browsing easier and provide us with information about our users. In addition, personal data are processed to verify the proper use of resources by users of the University’s applications and platforms.

6. What categories of data do we process?

Depending on the data subject and the processing we carry out, the categories of data may include the following:

• a. Identification data: for example, student ID; first and last names; email; phone number; city; image (photograph); home address; cell phone; among others.
• b. Personal characteristics data: for example, sex; date and place of birth; marital status; among others.
• c. Family and social circumstances data: for example, number of people in the household; number and ages of siblings, among others.
• d. Academic and professional data: for example, educational history (high school, type of high school, year, and higher education); grades; résumé; employment history; among others.
• e. Employment details data: for example, workplace; workplace address and phone number; position; among others.
• f. Economic, financial, and insurance data: for example, scholarships; discounts; financial aid; bank certificates, among others.
• g. Sensitive data: for example, ethnic identification, biometric data (fingerprint, facial recognition, temperature monitoring).
• h. Health data: for example, illnesses, medical examinations, conditions, among others.
• i. Data of persons with disabilities: type of disability, degree of disability.
• j. Data of adolescents: students who enter the University before turning 18, or students still in high school who take part in events organized by the University.

7. How do we obtain data?

Section 5 refers to some of the sources of the data we process, according to each process. In most cases, the data come directly from data subjects, and we obtain them mainly through forms, agreements, or contracts prepared for this purpose. We also obtain data at events, fairs, and academic activities where we present our programs.

In the course of our relationship with students, faculty, employees, and service providers, other data are generated and incorporated into ECOTEC systems.

8. To whom is data disclosed?

As a general rule, we disclose personal data to the competent authorities in compliance with legal obligations. Likewise, in certain cases, personal data are disclosed for the proper provision of educational services and for the performance of the contractual relationship with our suppliers. Recipients may include, among others, the following:

• a) Ministry of Education, CACES, CES, SENESCYT, SIIES, SRI, IESS, Judges and Courts of Ecuador, Prosecutor’s Office, UAFE, among others.
• b) Insurance service providers.
• c) Companies or institutions with which ECOTEC has signed contracts, agreements, or Strategic Alliances.
• d) External auditors and University service providers for the delivery and management of academic, technological, administrative, student affairs, and employee benefit services, among others.
• e) National and foreign universities, as well as other educational institutions that are part of the group and allied third parties with which strategic, academic, and research collaboration and cooperation ties are established.

In all cases, ECOTEC will ensure that your personal data are processed securely and confidentially, in accordance with the Organic Law on Personal Data Protection. ECOTEC will only share your personal data with trusted third parties that offer an adequate level of data protection.

9. How long do we keep data?

Personal data will be stored solely and exclusively for the time necessary to fulfill the processing purposes, in line with the legal periods set forth in the applicable regulations, and at most for the time necessary for legal actions to become time-barred. After this period, the data will be deleted, anonymized, or blocked, in accordance with the mechanisms, tools, and strategies implemented by ECOTEC.

Likewise, the personal data necessary to address possible judicial or administrative liabilities arising from the processing of data by ECOTEC, and to respond to any request from data subjects, public administrations, or judicial bodies, may be retained.

In the case of commercial communications and service promotion based on consent, your data will be kept until you express your wish to withdraw the consent given. You may exercise your right to erasure of, or objection to, this processing at any time.

Finally, in the case of images captured by video surveillance cameras, the data are kept for approximately 20 days, although in the event of incidents that justify it, they will be kept for the time necessary to facilitate the actions of the competent authorities.

10. What happens if you give us incorrect or inaccurate data?

Data subjects are entitled to quality services. To provide them, we need you to entrust us with your information, because if you refuse or provide it incorrectly or inaccurately, we will be unable to provide our services, fulfill our obligations, or perform the contractual relationship with the highest standard of quality and excellence that characterizes us.

11. What are your rights and how can you exercise them?

Depending on the circumstances of each case and the current legislation on personal data protection, you have the right to request:

a) Right of Access

You will be given more details about how we use your data.

b) Right to rectification and updating

Any data that you have modified or that has changed may be updated, and any inaccuracy in the personal data we process will be rectified, in accordance with the LOPDP guidelines.

c) Right to erasure

Any personal data whose processing is not justified on any legal basis will be deleted.

d) Withdrawal or revocation of consent

When processing is based on consent, you may withdraw your consent so that this specific processing stops.

e) Right to Object

Data subjects may object to or refuse the processing of data when:

1. The fundamental rights and freedoms of third parties are affected, the law allows it, and the information is not public, of public interest, or its processing is mandated by law.
2. The purpose of the processing of personal data is direct marketing; the data subject will have the right to object at any time to the processing of personal data concerning them, including profiling, in which case the personal data will no longer be processed for those purposes.
3. Their consent is not required for the processing because of a legitimate interest, as provided in Article 7 of the LOPDP, and the objection is justified by a specific personal situation of the data subject, provided that no law provides otherwise, and unless our grounds for carrying out such processing outweigh any harm to their data protection rights.

f) Right to Suspension

You may request the suspension of the processing of your data in the following situations:

1. When the data subject contests the accuracy of the personal data, while the controller verifies their accuracy;
2. The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise, or defense of claims; and,
4. When the data subject has objected to the processing under Article 31 of the LOPDP, pending verification of whether the controller’s legitimate grounds override those of the data subject.

g) Right to Portability

The portability of your data in a compatible, up-to-date, structured, common, interoperable, and machine-readable format, preserving its characteristics; or to transmit it to other controllers in accordance with the LOPDP guidelines.

h) Right not to be subject to wholly or partly automated decisions

Including profiling, that produce legal effects concerning the data subject or that infringe their fundamental rights and freedoms.

i) All the rights set forth in the LOPDP and its general regulations

ECOTEC will verify the legitimacy of the request and, if the information needs to be clarified or expanded, the data subject may be asked, only once and within five (5) days of receipt of the request, to clarify or complete it. The data subject so notified will have ten (10) days from the day following notification to clarify or complete the request.

If the data subject clarifies or completes the request within the time granted, the controller will process it accordingly. Requests to exercise the rights of access, rectification and updating, erasure, and objection will be answered within 15 days.

Requests concerning the exercise of other rights for which the LOPDP does not set a specific response period will be handled within 15 days from the day following receipt of the request and/or the clarification submitted.

If the data subject so notified does not clarify or complete the request within 10 days from the day following notification, the request will be archived and the data subject will be notified accordingly.

To exercise these rights, data subjects may submit their written request to the address indicated in section 3 of this policy. The written request must include, at a minimum, the following information:

• a) The name and email address of the Data Subject or any other means of receiving the response and notifications;
• b) A document proving the identity of the requester and, where applicable, that of their representative or attorney-in-fact with the respective authorization.
• c) A clear and precise description of the personal data with respect to which the Data Subject seeks to exercise any of the rights, and the specific request.

Notwithstanding the foregoing, ECOTEC may deny the request on reasoned grounds. In addition, ECOTEC may retain certain information of the Data Subject requesting erasure or deletion so that it may serve as evidence in the event of a possible claim against ECOTEC. Such retention will last for the time necessary according to the legitimate interest of ECOTEC to defend itself against any possible claim the Data Subject may bring.

Where the deletion of personal data is appropriate but cannot be carried out due to technical limitations, the data will be anonymized so that they cannot be used to identify the Data Subject or make them identifiable.

If you are not satisfied with how your personal information is used or with the response you received when exercising your rights, you have the right to file a complaint with the Personal Data Protection Authority through the channels it provides for this purpose.

12. Changes to the Personal Data Protection Policies

ECOTEC expressly reserves the right to modify, update, or supplement this Privacy Policy at any time. Any modification, update, or expansion of the Policies will be communicated through one of the official ECOTEC channels.

The latest version will always be available on our website, and the date of the last update will appear at the end of this Policy.

13. Applicable law and dispute resolution

The terms of this Policy are governed by and construed in accordance with the laws in force in the Republic of Ecuador, subject to the competence and jurisdiction of the Judges of the city of Guayaquil, Ecuador, and of the National Personal Data Protection Authority.

Last updated: May 23, 2024.