1. Data controller
- Controller: [PENDIENTE] (company name)
- Tax ID (NIF/CIF): [PENDIENTE]
- Address: [PENDIENTE]
- Privacy contact email: [PENDIENTE]
- Data Protection Officer (if applicable): [PENDIENTE]
2. What data we process and why
| Form | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact | Name, email, phone (optional), preferred channel, message | Answering your enquiry | Consent (Art. 6.1.a GDPR) |
| Level test | Answers and result | Estimating your level and, if you enrol, linking it to your request | Consent / pre-contractual steps (Art. 6.1.b) |
| Enrolment | Name, email, phone, country, course, level, schedule, payment method | Managing enrolment, payment and the student relationship | Performance of a contract (Art. 6.1.b) and legal obligations (Art. 6.1.c) |
| Corporate proposal | Company details and tax ID, contact person, job title, email, phone, training needs | Preparing and sending a proposal | Pre-contractual steps (Art. 6.1.b) and legitimate interest (Art. 6.1.f) |
| Reviews | Display name, company, rating, text, email (not published) | Moderating and, where appropriate, publishing the review | Consent (Art. 6.1.a) |
| Marketing | Sending news, only if you have explicitly opted in | Consent (Art. 6.1.a) |
We do not make automated decisions with legal effects. The level test result is indicative only.
3. Retention periods
[PENDIENTE — to be validated] Proposed periods:
- Contact enquiries: 12 months.
- Requests that do not become an enrolment: 24 months.
- Level test results with no linked request: 6 months.
- Student and billing data: as long as required by tax and commercial law.
- Published reviews: while published or until you ask for removal.
4. Recipients and processors
We do not share data with third parties unless legally required. We use the following processors:
- Hosting: [PENDIENTE]
- Cloudflare (content delivery, protection and Turnstile bot verification)
- Stripe (card payments; card data is handled exclusively by Stripe)
- Email delivery: [PENDIENTE]
5. International transfers
[PENDIENTE] If a processor handles data outside the European Economic Area, this will be done with appropriate safeguards (adequacy decision or standard contractual clauses).
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to [PENDIENTE]. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply appropriate technical and organisational measures: HTTPS encryption, restricted access with multi-factor authentication to management panels, least-privilege database access and logs without plain-text personal data.
8. Minors
[PENDIENTE] Enrolment of children under 14 requires the consent of their parents or legal guardians.
Last updated: [PENDIENTE]