1. Legal, privacy and cookies notice

Updated on 06/16/2025

The co-owners of the website under the esic.edu domain are ESIC University and ESIC Business & Marketing School. Both entities are autonomous, independent, and part of the ESIC Network.

1.1. ESIC University

Identification data:

  • Name: ESIC University (ESIC Foundation for Higher Education and Research).
  • NIF: G87046124.
  • Institutional and tax address: Camino de Valdenigriales, s/n (ESIC Building), 28223, Pozuelo de Alarcón, Community of Madrid, Spain.
  • Trade name and domain names: ESIC University | esic.edu | esic.university

Contact information:

Special legislation, commitments and certifications:

Additional information:

  • Registration: Register of Foundations of the Community of Madrid, Page 715, Volume CCXXXV, pages 301 and following.
  • IAE: 931.5 (Higher Education) and 936 (Scientific and Technical Research).
  • CNAE: 8543 (Higher education).
  • ISIC: 853 (Higher Education).

 

1.2. ESIC Business & Marketing School

Identification data:

  • Name: ESIC School of Higher Education of the Priests of the Sacred Heart of Jesus PP.RR., a school of higher education founded in 1965 by the Congregation of the Priests of the Sacred Heart of Jesus (PP. Reparadores / Dehonians).
  • NIF: R2800828B
  • Registered and tax address: Avenida de Juan XXIII, 12, 28224, Pozuelo de Alarcón, Community of Madrid, Spain.
  • Trade name and domain: ESIC Business & Marketing School esic.edu
  • Trade name of one of its departments: ICEMD .

Contact information:

Special legislation, commitments and certifications:

Additional information:
  • Registration: Ministry of Justice Registry of Religious Entities No. 003159 (789-/12-SE-B).
  • IAE: 932 (Non-formal education in vocational training and continuing education, and higher education).
  • CNAE: 8543 (Higher education).
  • ISIC: 8530 (Higher Education).
 

2. ESIC data protection and cookies notice

In this section, we provide information on how ESIC protects your data.

The controller or joint controllers for each processing operation, as applicable, are listed in the section on the Record of Processing Activities (RPA).

2.1. General information about personal data protection

To exercise your data protection rights, please contact ESIC by emailing arco.lopd@esic.edu. The email address for ESIC’s Data Protection Officer is dpd@esic.edu.

If you no longer wish to receive electronic communications, you can unsubscribe by clicking the link provided in each message you receive from ESIC. And if you are registered on the ESIC website, you can exercise some of your rights through your user dashboard.

The main rights you can exercise are:
  • Right to request access to personal data: We will inform you whether or not we are processing your data and, if so: what data, how we obtained it, why we are processing it, whether we have disclosed it, and the retention period, among other details. In addition, we will inform you of your other rights and of the possibility of filing a complaint with the AEPD.
  • Right to request the correction or deletion of your data, so that you can correct them or ask us to stop processing them and retaining them.
  • Right to request the restriction of your data processing, in which case ESIC will retain the data solely for the purposes required by law, such as to allow you to use it for a claim.
  • Right to object to processing. You may request that ESIC stop processing your data in the manner you specify, unless compelling legitimate grounds or the exercise or defense of potential claims require that processing continue.
  • Right to data portability. If you wish to export your data so that it can be processed by a third party, ESIC will facilitate this portability.

If you have given your consent for a specific purpose, you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing based on the consent given prior to its withdrawal.

To exercise your rights, you can find templates, forms, and more information on the website of the Spanish Data Protection Agency website, which you can contact if you believe there is a problem with the way ESIC processes your data.

 

2.2. Information on cookies and other trackers used by ESIC

ESIC uses cookies and other trackers on its apps and websites for various purposes.    Cookies are files that are created on your device when you browse any of ESIC’s applications or websites. These files may store information about your browsing habits or simply remember that you are a registered user. ESIC or third parties may have access to the information contained in these files, so it is important that you decide whether or not you wish to accept this processing.   In addition to cookies, ESIC uses the following other tracking technologies to collect data from users: (1) tracking pixel: this is an image sent from ESIC to your browser when you open an email sent by ESIC or visit an ESIC website, which allows ESIC to obtain information about the opening of the email or access to the website; (2) fingerprint: this is a technological solution that allows for the analysis of the user’s browsing activity when they request a file from ESIC, download it to their device, or browse the ESIC website.  

Hereinafter, we refer to any type of tracker used by ESIC as “cookies.”

2.2.1. Details about cookies in ESIC applications and websites

A.- Technical Cookies (own)
  • Purpose: To identify the user as a new visitor.
    • Data processed: Login ID.
    • Duration of processing: 40 years or, at the latest, until the cookie is deleted from the user's browser.
  • Purpose: To remind the user of their response to the cookie banner.
    • Data processed: Identifier for banner responses.
    • Duration of processing: 37 years, or until the cookie is deleted from the user's browser, whichever comes first.
  B.- Technical cookies (third party)
  • reCAPTCHA (Google). Purpose: anti-spam security
    • Data processed: This website uses Google's reCAPTCHA API for the stated purpose. This system allows Google to collect software and hardware information, as well as application and device data, and sends it to Google for analysis. This information is used to improve the reCAPTCHA service and overall security. It will not be used to display personalized ads from Google.
    • Duration of processing: The retention periods are set by Google for each type of data based on the purpose of its collection. For example, Google retains browser height and width data, as well as the IP address, for up to nine months; while cookie information is deleted after 18 months.
    • For more information: https://policies.google.com/technologies/retention
  • WAF. Purpose. Security
    • Data Processed: This website has implemented a firewall and antimalware service that prevents and mitigates attacks against the website and against data both in transit and at rest. To this end, it collects information about the software and hardware used for browsing and actions taken on the website, such as attempts at SQL injection or brute-force attacks. The implemented system may block a user by IP address or by username when it recognizes specific patterns identified as malicious or potentially harmful.
    • Duration of treatment: 90 days
  C.- Analytical Cookies (third party)
  • Purpose: To identify unique users in Google Analytics, by Google Ltd
    • Data processed: IP address, port, type of file requested, language and character settings, as well as the referring website and the operating system.
    • Duration of processing: The retention periods are set by Google for each type of data based on the purpose of its collection. For example, Google retains browser height and width data, as well as the IP address, for up to nine months; while cookie information is deleted after 18 months.
    • More information: https://policies.google.com/technologies/retention

2.2.2. Social Cookies on ESIC sites

ESIC maintains social media profiles (e.g., Instagram) as listed in the legal notice and has also integrated certain third-party content (e.g., YouTube videos) into its applications and websites. These actions involve collaboration between ESIC and the operators of these other sites for the initial collection of user data for advertising or statistical purposes.   ESIC is jointly responsible for the processing of data collected during the initial collection of user data, together with the operators of the social media platforms listed and linked in the “Legal Notice” section of this website. With regard to this processing, the operators of the social media platforms are primarily responsible for receiving requests from data subjects to exercise their rights.  

2.2.3. How to delete cookies or change your cookie settings

At any time, you can reset or change your cookie preferences by clicking here to access the cookie control panel.   To delete cookies from your browser, follow the instructions provided by the browser: :  If you want, you can install the Google Analytics browser disabling add-on to opt out of the use of your personal data.  

For more information on how ESIC processes your data through cookies, please review the security, analytics, and advertising profiling processing activities in ESIC’s Record of Processing Activities (RPA).

2.3. Register of processing activities (RAT)

Click here to see the document Treatment Activity Record (RAT)

2.4. Information security and privacy policy

2.4.1. OBJECTIVE

EThe purpose of this Policy is to establish general guidelines that define ESIC’s commitment to ensuring the protection of the services, information, and personal data managed in its business processes.

2.4.2. SCOPE

This policy applies both to individuals and organizations that, in one way or another, are part of ESIC (University and Business School) and to those who interact with it.

2.4.3. PRINCIPLES OF INFORMATION SECURITY AND PERSONAL DATA

ESIC carries out its work by providing high-quality educational services with added value in the field of higher education. To achieve this goal, it conducts business processes that require the management of information and personal data through IT services supported by an information system.

ESIC recognizes the need to ensure that the information and personal data it manages, as well as the services it provides, receive adequate protection to meet legal compliance requirements, prevent unauthorized access to information and personal data, preserve their integrity, and ensure that the information, personal data, and services are available when needed. Of particular importance to ESIC is the protection that must be applied in the processing of personal data to guarantee the rights and freedoms of the individuals concerned.

The fundamental principles governing the protection of information security and personal data shall be as follows:

  • Comprehensive security. This requires the inclusion and coordination of all human, material, technical, legal, and organizational elements related to ESIC’s information and privacy system.
  • Risk-based security. Analyzing the impacts and likelihood of occurrence of risks that could threaten the information system and privacy, and taking measures to mitigate them to levels that do not hinder the achievement of business objectives.
  • Measures for monitoring, surveillance, detection, response, and conservation, establishing tools and processes that continuously monitor the operation of the information system, detect anomalies and threats, prevent them from materializing, and, if they do occur, enable the recovery of the affected information and a return to the initial state.
  • Training and awareness. Selecting individuals with the appropriate skills to participate in system processes, training them to enhance those skills, and raising awareness throughout the company of the need for a proactive approach to safeguarding information security, personal data, and services.
  • Legal Compliance. Conducting a detailed analysis of the legal framework governing the company’s activities and establishing the necessary measures to comply with the relevant legal obligations, with particular emphasis on those related to the protection of personal data and respect for the rights and freedoms of individuals involved in the processing of such data.
  • Continuous improvement. Equipping the system with mechanisms for regularly reviewing its performance, analyzing measures to correct any malfunctions that arise, and actively seeking opportunities to improve its design and operation.

2.4.4. IMPLEMENTATION OF THE INFORMATION SECURITY AND PRIVACY MANAGEMENT SYSTEM

In order to comply with the above principles, ESIC has decided to implement an Information Security and Privacy Management System that, by analyzing the relevant risks to information security and privacy, determines which measures are necessary to limit the impact and likelihood of such risks materializing, through the application of appropriate safeguards.

This risk analysis process will take into account the risks to individuals’ rights and freedoms that may arise from the processing of their personal data, and if these risks are significant, it will include a specific impact assessment, as required by applicable law.

These risk analysis and management processes will be adapted to ESIC’s internal and external context, as well as to the legal framework to which the company is subject due to the nature of its activities.

The set of processes implemented by the Information Security and Privacy Management System will be properly documented.
To ensure that the Information Security and Privacy Management System functions as intended and that the assigned security and privacy objectives are met, ESIC’s organizational structure will include the necessary positions, as well as specific applicable roles, assigning them the necessary responsibilities. In this context, a Compliance, Information Security, and Privacy Committee will be established as the cross-functional collegiate body for the supervision and management of the Information Security and Privacy Management System.

2.4.5. REVIEW AND CONTINUOUS IMPROVEMENT

ESIC is committed to implementing mechanisms to review the proper functioning of the Information Security and Privacy Management System and to establishing security and privacy objectives, the achievement of which will embody the principle of continuous improvement in security.

These objectives will be derived from the reviews conducted on a regular basis to evaluate the system’s processes, from nonconformities identified during scheduled internal and external audits, as well as from the initiative of all stakeholders when they identify malfunctions or opportunities for improvement.

Security and privacy objectives will have designated leads, sufficient resources, and realistic deadlines. Their development and implementation will be reviewed on a regular basis.

2.4.6. CORPORATE COMMITMENT

Achieving the objectives of the information security and privacy management system requires the company’s full commitment to ensure its implementation and the improvement of the processes and activities involved. This commitment will be demonstrated through the dissemination and communication of these guidelines to all company employees and to those external individuals and organizations that need to be aware of them. This document will be published in a format accessible to all stakeholders. This communication will be complemented by internal awareness-raising initiatives that facilitate the integration of this system into ESIC’s business objectives.

2.5 Policy on the Appropriate Use of Information Assets

Access the full text of the Policy on the Appropriate Use of Information Assets (PUAAI)

 

3. Legal Bases for Contests, Sweepstakes and other Promotions

View the list of the terms and conditions for ESIC's contests, raffles, and other promotions.

 

4. Applicable regulations and dispute resolution

This legal, privacy, and cookie notice is written in Spanish any translation into another language is considered unofficial); it will remain accessible online on this website and must be interpreted in accordance with Spanish law.

If you would like more information, wish to report a problem, or have any questions, you can contact ESIC using the contact information provided at the beginning of this notice or via the ESIC suggestion box.

Versions of this legal document are available for viewing in the cache stored on the Internet Archive (see). 

 

Shall we inform you?