Personal Data Processing Policy

This Data Processing Policy is the institutional document that broadly describes how ITPMI processes personal data in the course of its technical training, advisory and administrative activities. It complements the Privacy Policy (focused on the website and digital channels) and the Cookie Policy. Its purpose is to fulfill the LOPDP duty of information and transparency; it does not replace personalized legal advice or the specific clauses of each contract.

1. Controller and point of contact

• Company name: Instituto Técnico del Petróleo INSTIPETROL Cía. Ltda.
• Trade name: Instituto Técnico del Petróleo, Minas e Industria (ITPMI)
• RUC (tax ID): 1792336287001
• Legal representative: Golda Meir Rodríguez Espinosa, General Manager
• Address: Av. Gaspar de Villarroel E10-121 y Av. 6 de Diciembre, Edificio Plaza 6, office 22, Quito, Pichincha, Ecuador
• Point of contact for data protection / exercise of rights: contacto@itp.edu.ec
• Phone numbers: 02 336 0462

ITPMI has not publicly appointed a Data Protection Officer (DPO) separate from the institutional point of contact indicated. Requests are channeled to contacto@itp.edu.ec, without prejudice to the internal obligations of Management and the relevant areas (e.g. Human Resources, Sales, Operations).

2. Regulatory framework and definitions

The following apply, among others: Constitution art. 66.19; LOPDP and its Regulations; resolutions and guidelines of the Superintendency of Personal Data Protection (SPDP); and, where applicable, the Law on Electronic Commerce and the Organic Consumer Protection Law.

For the purposes of this policy:

• Owner: the natural person to whom the personal data refers.
• Data controller: INSTIPETROL Cía. Ltda. (ITPMI), which decides on the purposes and means of processing.
• Processor: whoever processes data on behalf of the controller (e.g. Odoo, hosting, messaging or analytics providers).
• Processing: any operation on personal data (collection, storage, use, communication, deletion, etc.).

3. Scope

This policy applies to the processing of personal data carried out by ITPMI in Ecuador (and, where applicable, with international transfers) concerning data subjects who interact with ITPMI as prospects, clients, participants/students, company representatives, instructors, suppliers, job candidates, website visitors or other groups described below.

4. Processing principles

ITPMI processes personal data observing, in particular, the following LOPDP principles:

• Lawfulness, fairness and transparency.
• Legitimate and limited purpose.
• Data minimization and proportionality (only the necessary data).
• Accuracy and keeping data up to date.
• Retention limited to the necessary time.
• Integrity, confidentiality and security.
• Proactivity / demonstrated accountability, through policies, controls and contracts with processors.

5. Processing inventory

Without prejudice to additional specific processing disclosed in each channel, ITPMI carries out, among others, the following processing activities:

5.1 Website, leads and sales support

• Data: name, email, phone, company, country, message, course of interest, technical browsing data and cookies (subject to consent).
• Purpose: answering inquiries, quoting, commercial follow-up, site improvement and campaign measurement.
• Channels: forms, WhatsApp Business, email, phone, Odoo CRM/ERP, GA4, Meta Pixel.

5.2 Students, participants and corporate training

• Data: identification (names, ID/passport when required), contact details, sponsoring company, position, attendance, assessments, grades, certificates issued, client billing data where applicable.
• Purpose: enrollment, delivery of the training service, attendance control, certificate issuance, post-course support and contractual/legal compliance.

5.3 Corporate clients and their employees

• Data: data of representatives, purchasing/training contacts, participant lists sent by the company.
• Purpose: performance of B2B contracts, logistics coordination and invoicing.
• Note: when a company sends data about its workers, that company must have a legal basis and internal authorizations; ITPMI processes that data as controller or in the role applicable to each operation, always for training/contractual purposes.

5.4 Instructors and teaching staff

• Data: identification, contact details, résumé, accreditations, bank details for payments, teaching performance evaluations where they exist.
• Purpose: hiring, course coordination, payments and academic quality control.

5.5 Suppliers and partners

• Data: data of legal representatives and contacts, RUC, contractual and billing information.
• Purpose: purchasing management, partnerships, confidentiality and compliance.

5.6 Job candidates and human resources

• Data: résumé, identification, contact details and other data provided in selection processes.
• Purpose: evaluation of applications and, where applicable, formal employment in accordance with Ecuadorian labor regulations.

5.7 Image, voice and training evidence

• Data: photographs, videos or recordings of sessions, when captured.
• Purpose: evidence of attendance/quality, institutional or training material, only with an adequate legal basis (consent or other authorization) and prior notice where applicable.

5.8 Security, access and technical records

• Data: access logs, IP addresses, incident records, physical or digital access control data where they exist.
• Purpose: information security, abuse prevention and defense of rights.

5.9 Certificates and validations

• Data: data needed to issue, archive and, where applicable, validate training certificates.
• Purpose: accreditation of the training delivered and handling of legitimate verification requests.

6. Special categories of data

ITPMI does not routinely request special categories of data (health, ideology, union membership, sex life, biometric data intended to uniquely identify a person, etc.).

If a processing activity requires them (e.g. minimal occupational health information in certain HSE courses, or data spontaneously included by the data subject in a message), ITPMI will:

• limit processing to what is strictly necessary;
• apply reinforced legal bases when required by the LOPDP (e.g. explicit consent or another legal exception); and
• reinforce confidentiality and restricted-access measures.

7. Legal bases

Depending on the case, ITPMI relies on one or more of the following LOPDP legal bases:

• Consent of the data subject.
• Performance of a contract or pre-contractual measures at the data subject's request.
• Compliance with a legal obligation.
• Legitimate interest of ITPMI or a third party, weighed against the rights of the data subject (e.g. security, fraud prevention, basic service improvement).
• Other bases provided by law where applicable.

8. Processors, recipients and transfers

The following may access personal data, to the extent necessary:

• Authorized ITPMI staff (sales, academic, administrative, finance, human resources and management areas).
• Odoo (CRM/ERP) as data processor.
• Google (Analytics / GA4) and Meta (Pixel / WhatsApp), when the data subject consents or initiates the interaction.
• Hosting, development and technical support providers, including Alfa Business Planet Alfa BP S.A.S. (RUC 1793209203001) or other equivalent providers, under confidentiality and processing obligations where applicable.
• Certification bodies, partners or corporate clients, when necessary to provide the service and there is a legal basis.
• Competent authorities, upon a valid request.

International transfers (e.g. cloud services in the United States or other countries) are carried out with adequate safeguards in accordance with the LOPDP and its Regulations (contractual clauses, technical and organizational measures, and data minimization).

9. Retention periods

As a guideline (they may be adjusted according to legal obligations or contracts):

Once the periods have elapsed, the data is deleted, anonymized or blocked, as appropriate.

10. Information security

ITPMI applies reasonable technical and organizational measures proportionate to the risk, including: access control, passwords and profiles, encrypted channels where available (HTTPS), confidentiality agreements with staff and suppliers, backups according to the current infrastructure, and internal awareness. No measure guarantees absolute security.

11. Data subject rights and procedure for exercising them

Data subjects may exercise the rights recognized by the LOPDP, including:

• Access
• Rectification and updating
• Deletion
• Objection
• Annulment
• Suspension
• Portability (where applicable)
• Not to be subject to decisions based solely on automated processing with legal or similarly significant effects, where applicable

11.1 How to exercise them

1. Send your request to contacto@itp.edu.ec or through the contact form, stating: full name, means of contact, the right you wish to exercise, a clear description of the request and, if possible, the context (course, date, company).
2. Provide a reasonable means of proving your identity (e.g. a copy of your ID card/passport or equivalent validation). If you act as a representative, provide the document proving representation.
3. ITPMI may request additional information only when necessary to handle the request.

11.2 Response times

ITPMI will respond within the periods established by the LOPDP and its Regulations. As an operational reference, we aim to reply within a maximum of 15 days from receipt of the complete request, extendable in accordance with regulations when its complexity justifies it, with the data subject being informed.

11.3 Complaints to the authority

If you believe your rights have not been properly addressed, you may file a complaint with the Superintendency of Personal Data Protection (SPDP) of Ecuador, without prejudice to other legal actions.

12. Security breaches

In the event of a security breach affecting personal data, ITPMI will assess the risk to the rights of data subjects and, where required by the LOPDP and its Regulations, will notify the SPDP and/or the affected data subjects, documenting the incident and the corrective measures.

13. Staff, suppliers and confidentiality

ITPMI staff with access to personal data are subject to duties of confidentiality and proper use of information. Suppliers and processors (including web development/hosting and CRM tools) must process data in accordance with ITPMI's instructions, with security measures and, where applicable, confidentiality / non-disclosure agreements (NDA) and data protection clauses.

14. Minors

ITPMI's services are mainly intended for professionals and companies. Processing the data of minors under 18 requires authorization from their legal representative, except for legal exceptions. If data from minors is detected without valid authorization, it will be deleted or blocked as soon as reasonably possible.

15. Automated decisions

As a general rule, ITPMI does not make decisions based solely on automated processing that produce legal effects or significantly affect the data subject. If such systems are implemented in the future, this will be disclosed and the corresponding rights will be guaranteed.

16. Updates

This policy may be updated due to legal, organizational or technological changes. The current version will be published on this page with its date of last update. Processing already disclosed will be progressively adjusted to the new version where applicable.

17. Contact and supervisory authority

ITPMI — Data protection: contacto@itp.edu.ec · 02 336 0462 · Av. Gaspar de Villarroel E10-121 y Av. 6 de Diciembre, Edificio Plaza 6, office 22, Quito.

Supervisory authority: Superintendency of Personal Data Protection (SPDP), Republic of Ecuador.

Related documents: Privacy Policy · Cookies · Terms · Legal Notice.