PRIVACY POLICY

1. Identity of the Data Controller.

In strict compliance with the provisions of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we hereby inform you that personal data collected via the main domain espanolconcarmen.com and all its subdomains (including escuela.espanolconcarmen.com and clases.espanolconcarmen.com), hereinafter the WEBSITE, will be processed by:

  • Data Controller: Carmen Teixeira Antelo
  • Tax Identification Number (NIF): 25.667.670-S
  • Address: Calle Cardo Cuco, 14, 29018 Málaga (Spain)
  • Email: [email protected]

2. Data we collect and the purpose of processing.

The WEBSITE, across all its domains and subdomains, collects personal data via various forms (purchase, registration, subscription and comments). This data is used exclusively for the following purposes:

  • Management of purchases and student accounts: To process payments, issue invoices and automatically create the user account required to provide the training services (Women’s Talk in Spanish, Readers’ Talk in Spanish or Spanish Laboratory). We collect name, email address, country, IP address and order details via the WooCommerce platform.
  • Sending newsletters and lead generation: With the user’s express consent obtained via landing pages or subscription forms, we collect name and email address to send marketing communications and updates via the MailerLite platform.
  • Customer service: Via email, to answer queries and provide technical support.
  • Website security: We collect IP addresses to prevent fraud, avoid spam comments and detect potential cyber attacks, implementing all available technological and organisational measures within our power to ensure the maximum security of the WEBSITE.

3. Legal basis for data processing.

Your personal data is processed on the following legal grounds:

  • Performance of a contract: For the management of purchases, subscriptions and the creation of a student account.
  • Explicit consent: For subscribing to the newsletter, posting comments and accepting cookies via the CookieYes tool. This consent may be withdrawn at any time.
  • Compliance with legal obligations: For the retention of billing data in accordance with tax regulations.
  • Legitimate interest: To ensure the security of the website and prevent fraud.

4. Data retention periods.

Data will be retained for the period strictly necessary to fulfil the purpose for which it was collected:

  • Tax and billing data: Data relating to completed orders, refunded orders and terminated subscriptions will be retained for 6 years (Article 30 of the Commercial Code).
  • Inactive student accounts: Profiles with no ongoing activity or active subscriptions for 24 months will be anonymised or automatically deleted.
  • Failed, pending or cancelled orders: Data entered during purchase processes that are not completed will be automatically deleted within 7 days.
  • Newsletter subscriptions (MailerLite): These will be retained until the user withdraws their consent or unsubscribes via the link included in each email.
  • Comments: These will be retained indefinitely unless the user requests their deletion.

5. Disclosure of data to third parties (Data Processors).

In order to provide services strictly necessary for the conduct of our business, we share data with the following service providers in accordance with their respective privacy policies:

  • Web hosting and email: Webempresa Europa S.L., a company based in the EU, responsible for hosting the website and managing the email server.
  • Payment platform: Stripe, responsible for processing card payments. The website does not store bank details, only an encrypted token for subscription renewals.
  • Video conferencing: Zoom Video Communications, Inc., for delivering live group classes.
  • Email marketing: MailerLite UAB, a company based in the EU, responsible for managing and sending newsletters.
  • Cookie management: CookieYes, a tool used to record user consent regarding the cookie policy.
  • Security: Cybersecurity, firewall and vulnerability analysis service providers, responsible for ensuring the integrity of the website, analysing traffic and detecting potential threats or anomalous behaviour.
  • Corporate email and social media: Services provided by Google Inc, Meta (Facebook/Instagram), LinkedIn and YouTube are used, involving international transfers of analytical or communications data covered by standard service level agreements.

6. User rights.

Anyone has the right to obtain confirmation as to whether we are processing their personal data. Users may exercise the following rights at any time:

  • Access: To find out what data we are processing about you.
  • Rectification: To correct inaccurate data (also available via the ‘My Account’ panel).
  • Erasure (Right to be forgotten): To request the deletion of your data.
  • Restriction, Portability and Objection: To restrict the use of their data, transfer their data or object to its processing.

To exercise these rights, users must send an email to [email protected], providing the necessary information or documentation to verify their identity. Our top priority is to protect students’ privacy and to resolve any queries, issues or requests quickly, directly and amicably. However, in strict compliance with current legislation, we inform the user that they have the right to refer the matter to the supervisory authority (the Spanish Data Protection Agency) should they consider that their requests have not been properly addressed.