# Academia Tools — Privacy Policy

**Version:** 20 September 2026  
**Website:** [uni.bnr.ac](https://uni.bnr.ac/)  
**Status:** Adopted


## 1. Who is responsible for your personal data

Academia Tools is operated by **BUILDNER, SLU**, a company established under the laws of the Principality of Andorra, registration number **715322-T**, with its registered address at **Carretera Mas de Ribafeta 6, 3-1, Arinsal, La Massana, AD400, Andorra**.

In this policy, **Buildner**, **we**, **us**, and **our** mean BUILDNER, SLU. We are the data controller where we determine why and how personal data is processed for Academia Tools.

For privacy questions or requests, contact **contact@buildner.com**, preferably with “Academia Tools — Privacy” in the subject line, or write to our registered address. This is a privacy contact address; it is not a statement that a data protection officer has been appointed.

Andorra's Law 29/2021 on personal data protection, as amended, and its implementing rules apply to processing within their scope. The EU General Data Protection Regulation and other applicable privacy laws also apply where their territorial and other requirements are met.

## 2. What this policy covers

This policy covers personal data processed through Academia Tools at **uni.bnr.ac** and its related enquiries, educational resources, institutional functions, and competition functions where this policy is presented as the applicable notice. Provisions about accounts, payments, uploads, judging, publication, or optional tracking apply only when the relevant function is offered and used. Their inclusion does not promise that a feature will be introduced or remain available.

Other Buildner services and separately operated competition websites may have their own privacy notices. A link, shared brand, or common operator does not by itself mean that this policy replaces those notices or that records from separate services are combined for every purpose.

Our [Terms and Conditions](terms-and-conditions.html) address use of the service, competition changes, cancellation, refunds, materials, and liability. This Privacy Policy explains personal data handling. It is not an additional service warranty, a competition guarantee, or consent to all processing. Acknowledging it does not waive privacy rights.

## 3. Information we process and where it comes from

Personal data is information about an identified or identifiable person. A design, student number, IP address, account identifier, assessment, or institutional affiliation may be personal data even if it does not contain a full name.

Depending on the functions used, relevant information includes:

- **Contact and account information:** name, email address, account or sign-in identifier, authentication records, language, and preferences supplied through the relevant interface.
- **Academic and institutional information:** institution, department, course, role, student or educator status, team membership, and proportionate evidence required to establish eligibility or authority.
- **Competition and project information:** registration details, entry identifiers, drawings, images, written proposals, file metadata, contributor details, declarations, submission history, jury assessments, results, and related correspondence.
- **Payment and refund information:** payer and billing details, payment reference, amount, currency, payment status, and information needed to reconcile or return a payment. The payment interface and its provider determine which payment credentials they receive. Do not send card details by ordinary email or in project files.
- **Technical and usage information:** IP address, request time, requested address, browser and device information, referring address where provided, account activity, error information, and records needed for security or the functions used.
- **Communications and choices:** enquiries, support messages, complaints, privacy requests, relevant attachments, terms-acceptance records, marketing choices, and cookie preferences where those controls are used.

Information can come directly from you, from your browser or device, or from a team representative, educator, institutional administrator, competition organiser, juror, payment provider, or other person involved in the function you use. Relevant public institutional or professional information may also be used to check an affiliation or authority where justified.

Where information about you is provided by someone else, the applicable notice must also explain its source and use as required by law. An institution's or team leader's involvement does not remove Buildner's own transparency duties.

Do not include unrelated personal information, passwords, identification documents, health information, or other sensitive details in project materials or messages. If a particular process requires sensitive information, its purpose and applicable safeguards need to be explained separately.

## 4. Why information is used

The relevant purpose and legal basis depend on the relationship and function concerned. Processing is limited to a lawful basis that actually applies; the following table is not permission to select an unrestricted basis after the event.

| Purpose | Applicable basis and interest |
| --- | --- |
| Supply an account, requested resource, registration, submission function, or other service agreed directly with you | Performance of the agreement with you, or steps you request before entering it, where the processing is necessary |
| Administer institutional or team participation when you are not personally a party to the service contract | Legitimate interests in providing the requested institutional or team service, managing access, and communicating with participants, subject to their rights |
| Check eligibility, administer entries, arrange judging, communicate results, and manage competition records | Contract where necessary for your agreed participation; otherwise legitimate interests in administering a lawful competition and maintaining its integrity |
| Receive and reconcile fees, make refunds, and keep transaction records | Contract for the relevant transaction and compliance with applicable accounting, tax, and other legal obligations |
| Deliver and secure the website, prevent abuse, investigate technical issues, and keep proportionate acceptance evidence | Legitimate interests in operating and protecting the service and evidencing the applicable relationship; legal obligations where applicable |
| Answer enquiries and handle complaints, disputes, or rights requests | Steps you request before a contract, legitimate interests in handling correspondence and legal claims, or compliance with legal duties, as appropriate |
| Publish competition results, credited work, or a profile you choose to make public | The basis identified for that publication: contract where genuinely necessary for the agreed competition, otherwise a justified legitimate interest or consent where required |
| Send optional marketing or use optional analytics or advertising technologies | Audience measurement with Google Analytics 4: legitimate interests, with the Analytics switch in Cookie settings as your opt-out, and consent where the law requires it. Marketing: consent where required; any legally permitted alternative for a particular communication must be identified and include the applicable opt-out |

Legitimate interests do not override your interests or fundamental rights where those require protection. You may object to processing based on legitimate interests as explained in section 13.

Required fields are those needed for the stated function, contract, or legal requirement. If you do not provide necessary information, the affected account, eligibility check, registration, payment, refund, or submission may not be possible. Optional information is not required merely because it could be useful to us.

## 5. Institutions, educators, and teams

An institution or educator may independently determine how it collects student details, assigns coursework, records marks, or manages participation. It is responsible for those activities under its own privacy arrangements. Buildner is responsible for its own processing.

Where an institutional workspace is offered, the relevant access arrangement determines which authorised administrators, educators, and team members can see participation records or materials. Joining such a workspace can involve sharing information with those people. A shared email domain alone is not an explanation of administrator access.

If an institution instructs Buildner to process personal data solely on its behalf, the parties' actual roles and the required data-processing agreement govern that processing. This policy does not, by itself, establish that Buildner is a processor for all institutional information or replace that agreement.

If you provide another person's information, you must have an appropriate basis and authority to do so and give them the relevant notice. Do not treat a team's registration as every member's consent to unrelated marketing.

## 6. Submissions, juries, and publication

Where competition submissions are accepted, relevant materials and participation information are processed to receive entries, check eligibility, organise assessment, communicate outcomes, and administer the competition.

Authorised jurors, reviewers, administrators, and relevant competition partners may receive the information needed for their role. The competition's submission instructions determine whether identifying details must be removed from assessment materials. An entry number does not make the entire registration anonymous, and metadata or the work itself may identify contributors. No absolute anonymity guarantee is given.

Any publication arrangement must identify the work and attribution information intended for release, its purpose, and the applicable basis before submission or publication as required. Public results may identify an entrant, team, institution, country, project title, credited contributors, or awarded work where the competition's stated arrangements provide for that use. Entering a competition does not by itself authorise unrelated publication of private contact, billing, or identity-verification information.

Public material may be indexed, copied, or discussed by people and services outside our control. Removing material from a Buildner page cannot ensure removal of all independent copies. This limitation does not remove duties that apply to Buildner when a valid correction, erasure, or objection request is received.

A juror's opinion about identifiable work can itself be personal data. Access and disclosure requests are assessed under applicable law, including the rights of other people and any lawful confidentiality restrictions. There is no general promise that internal deliberations or third-party information will be disclosed in full.

## 7. Files, tools, and automated processing

Opening a file in a browser and uploading it to a server are different activities. A statement that a file stays on your device applies only to a function that expressly operates that way. Do not assume that account storage, submissions, shared links, support attachments, or third-party processing are local because another Buildner tool runs in the browser.

Files sent through an upload, submission, storage, or support function are handled by the systems and authorised recipients involved in that function. A saved or shared address may contain information in its URL and may be retained in browser history, messages, or request records.

If an AI or other external processing feature is offered, its applicable notice must explain the information transmitted, purposes, recipients, and any distinct use such as model training before that processing starts as required by law. This policy does not grant blanket permission to train models on private student work or to introduce unrelated uses of submissions.

Routine technical checks, sorting, or formatting are not necessarily decisions with legal or similarly significant effects. Any use of solely automated decision-making of that kind requires the specific disclosures, lawful basis, and safeguards required by applicable law. Describing these requirements does not mean that such a decision-making feature is offered.

## 8. Who can receive information

Depending on the service used, recipients may include:

- Authorised Buildner personnel and contractors involved in administration, support, security, payments, or legal matters.
- Hosting, storage, authentication, communications, payment, and other technical providers for the functions they supply.
- Your institution, educator, authorised team representative, or workspace administrator under the applicable participation or access arrangement.
- Jurors, reviewers, organisers, sponsors, or commissioning partners where relevant information is necessary for the disclosed competition role. Sponsorship alone is not permission to use entrant contact details for unrelated marketing.
- The public, publishers, or media recipients for material subject to a disclosed publication arrangement.
- Professional advisers, insurers, courts, regulators, law-enforcement bodies, or other recipients where disclosure is necessary and lawful for a legal obligation, proceeding, or protection of rights.
- A prospective or actual successor to the service in a lawful transaction, subject to applicable purpose, confidentiality, and transparency requirements.

Providers acting as processors must be engaged on the terms required by applicable data-protection law. Some recipients, including institutions, payment providers, or organisers, may act as independent controllers for their own activities and issue their own notices. Naming a recipient category does not authorise unrestricted disclosure to every organisation in that category.

## 9. International processing

Buildner is established in Andorra. Provider systems, institutional participants, jurors, and competition partners may be in other countries. The countries and transfer arrangements relevant to a particular function depend on its actual configuration.

Where processing involves a restricted international transfer, the applicable legal requirements must be met. The transfer may rely on an applicable adequacy decision, contractual safeguards or another mechanism permitted for that transfer. A provider's brand or the location of its main office does not establish that every onward transfer is covered.

Contact **contact@buildner.com** for information about the arrangements applying to your data and how to obtain the relevant safeguards, subject to lawful redactions. Specific transfer information required for the functions in operation forms part of the applicable notice; this general description is not a substitute for identifying those arrangements.

## 10. Retention and deletion

Personal data is kept for the period justified by the purpose for which it is processed and any applicable legal requirement. Relevant criteria include:

- Whether an account or institutional arrangement is active and whether the relevant information remains necessary to supply it.
- The competition's registration, assessment, results, refund, complaint, and dispute stages, together with any separately disclosed results archive.
- Applicable accounting, tax, limitation, evidence-preservation, and regulatory requirements.
- The time needed to investigate a specific security incident, technical issue, complaint, or legal claim.
- The duration of a valid marketing choice or other permission and the limited evidence needed to respect a withdrawal or objection.
- The operation of necessary backup and deletion cycles, with retained copies subject to the same purpose limits.

An expired account, completed competition, or cancelled event does not require immediate deletion of every record where a lawful retention purpose remains. Equally, a possible future use is not a basis for keeping identifiable information indefinitely. Records without a remaining lawful purpose are to be deleted or rendered no longer identifiable.

A lawful results archive may outlast an account or active competition. Requests concerning names, credits, and published work are assessed separately from financial or dispute records. Copyright permissions and privacy rights are separate considerations.

This policy does not promise permanent storage, restoration of a submission, or retention of a usable copy for your benefit. Keep your own copies of materials you need. Actual fixed retention periods, where used, must be reflected in the applicable service or cookie information.

## 11. Cookies, analytics, and marketing

Cookies and similar technologies can support sign-in, session security, preferences, acceptance records, or requested functionality. Optional analytics and advertising may involve additional identifiers, device information, visited pages, and interaction data. Their presence and operation depend on the live site's configuration.

On uni.bnr.ac, Google Analytics 4 (property G-M2CHW676T9, provided by Google Ireland Limited; Google LLC acts as a sub-processor under the EU-US Data Privacy Framework and standard contractual clauses) measures visits, pages and tool use with a random browser identifier. By Buildner's decision it runs from your first page view and stops when you choose Reject optional or switch Analytics off in Cookie settings, which also removes its cookies (`_ga` and `_ga_M2CHW676T9`, set for uni.bnr.ac only, kept for 13 months). Google Analytics 4 does not store IP addresses; no advertising features or Google signals are enabled. Buildner relies on its legitimate interest in understanding how the teaching tools are used, with the switch as your objection, and on consent where the law requires it.

Where consent is legally required for another optional technology, it remains inactive until the relevant consent is given, and withdrawal must be available. Acceptance of service terms, silence, or continued browsing is not a substitute for valid consent. The live cookie information must identify the technologies actually used, their purposes, providers, and durations. A vendor named in another Buildner website's notice is not automatically a provider for Academia Tools.

Operational messages about an account, submission, material competition change, cancellation, or refund are distinct from marketing. Any optional marketing offered is subject to the applicable permission and unsubscribe requirements. You can object to direct marketing at any time by using the unsubscribe facility or emailing **contact@buildner.com**.

Participation information is not made available for unrelated marketing solely because an institution, sponsor, or team leader supplied it. Any separate marketing use needs its own lawful basis and appropriate explanation.

## 12. Security and its limits

Applicable data-protection law requires technical and organisational measures appropriate to the nature of the processing and the risks. No website, transmission method, storage system, or access control can guarantee absolute security, uninterrupted access, or prevention of every unauthorised act.

Protect your sign-in details, use authorised access routes, check sharing settings, and avoid including unnecessary personal information in submissions. Report suspected unauthorised access or disclosure to **contact@buildner.com**.

This policy does not provide an absolute confidentiality or security warranty. That limitation does not exclude Buildner's statutory security, breach-notification, remedial, or compensation duties where they apply.

## 13. Your rights and choices

Depending on the applicable law and the circumstances, you may request access to personal data, correction, erasure, restriction of processing, or a portable copy of relevant data. You may also object to processing based on legitimate interests and exercise applicable safeguards concerning automated decisions.

**You may object to processing for direct marketing at any time.** Where processing relies on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.

Send requests to **contact@buildner.com**, identifying Academia Tools and enough information to locate the relevant records. Proportionate identity or authority checks may be needed before information is disclosed or changed. Avoid sending identity documents unless requested through an appropriate process.

Requests are subject to the conditions, exemptions, and response periods in applicable law. Where the GDPR applies, the ordinary response period is one month, with a permitted extension for complex or numerous requests and the required notice of that extension. A request is not automatically refused because an account has closed or a competition has been cancelled.

You can complain to the **Andorran Data Protection Agency (APDA)** at [apda.ad](https://www.apda.ad/en), and to another competent supervisory authority where applicable, including the authority for your habitual residence, work, or the alleged infringement under the GDPR. You do not have to obtain Buildner's permission or exhaust an internal procedure before exercising that right.

These rights cannot be waived by a general “no liability” statement or by accepting the service terms.

## 14. Younger participants

The service is intended for higher-education and adult professional use. Independent account use and competition entry are subject to the age and eligibility requirements in the applicable terms. An institution must not assume that including a younger student is authorised without checking those requirements and the relevant data-protection arrangements.

If a permitted programme involves minors, the roles, required permissions, age-appropriate information, and any special safeguards must be addressed for that programme. A teacher's or team leader's involvement is not automatically valid parental consent. Contact us if you believe a child's information has been provided contrary to the applicable arrangements.

## 15. Changes, cancellation, and contact

This policy may be updated to reflect changes in processing or applicable requirements. The version date identifies the draft or adopted version. Material new processing requires the notice and, where applicable, consent required by law; posting revised wording does not retrospectively authorise an incompatible use.

The availability of Academia Tools and the continuation of a competition are governed by the applicable terms. Following cancellation or closure, personal data may still be processed where necessary for refunds, communications, legal records, rights requests, or other lawful remaining purposes. Cancellation does not cancel privacy rights.

**Operator:** BUILDNER, SLU  
**Registration number:** 715322-T  
**Address:** Carretera Mas de Ribafeta 6, 3-1, Arinsal, La Massana, AD400, Andorra  
**Privacy contact:** contact@buildner.com