Privacy policy

1. Data controller

• Identity: [PENDIENTE: full name or company name]
• Tax ID (NIF / CIF): [PENDIENTE: NIF or CIF]
• Address: [PENDIENTE: postal address]
• Contact email: [email protected]

2. Personal data we collect

We collect the following data when you fill in the contact form:

• Where you are writing from — a school or a company, to direct your enquiry to the right team.
• Name — to address you personally.
• Email — to send you the proposal or reply to your enquiry.
• School or company — to prepare a proposal suited to your organisation.
• Free-text message — a description of your needs.
• Date and time you accept this policy — to prove your consent.

If you are a user of the private client area, we also process your name, your email, your job title (if you give it), the company you belong to and your progress in courses and exercises, in order to give you access to the training contracted by your company.

We do not collect special categories of data (health, beliefs, etc.) or data from children under 14. We do not carry out automated profiling.

3. Purpose and legal basis for processing

• Replying to your request for information or a commercial proposal. Legal basis: Art. 6.1.b GDPR, steps taken at the request of the data subject prior to entering into a contract.
• Giving you access to the private area and to the training contracted by your company. Legal basis: Art. 6.1.b GDPR, performance of the contract.

4. Data processors and international transfers

To handle contact form submissions we use Formspree (Formspree, Inc., based in the USA), which acts as a data processor. Data is transferred to Formspree under the standard contractual clauses approved by the European Commission and Formspree's participation in the EU-US Data Privacy Framework.

The Website is hosted by Cloudflare (Cloudflare, Inc., based in the USA), which also provides the form's anti-spam protection (Cloudflare Turnstile). Cloudflare acts as a data processor; the transfer takes place under the standard contractual clauses approved by the European Commission and Cloudflare's participation in the EU-US Data Privacy Framework.

The private area uses Supabase (Supabase, Inc., based in the USA) for its database and sign-in. Supabase acts as a data processor under the standard contractual clauses approved by the European Commission.

Videos in the private area are played with Vimeo (Vimeo.com, Inc., USA) and its fonts are loaded from Google Fonts (Google LLC, USA). When they load, your IP address may be sent to their servers. You can read their policies at vimeo.com/privacy and policies.google.com/privacy.

We do not share your data with any other third party unless required by law.

5. Retention period

We keep contact data for as long as needed to handle your request and, afterwards, for the limitation period of any civil and commercial claims that may arise (generally 5 years under the Spanish Civil Code).

Data of private area users is kept while their account is active and, afterwards, for those same legal periods.

6. Your rights

Under the GDPR and the Spanish LOPDGDD, you have the right to:

• Access — know what data we process about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — ask us to delete your data when it is no longer needed.
• Objection — object to processing for marketing purposes.
• Restriction of processing — ask us to suspend processing in certain circumstances.
• Portability — receive your data in a structured, commonly used format.
• Withdrawal of consent — at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at [email protected] stating the right you wish to exercise and attaching a copy of your ID card or an equivalent identity document.

If you believe the processing of your data breaches the regulations, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

7. Cookies and local storage

This website does not use advertising tracking cookies (Google Analytics, Facebook Pixel, etc.), behavioural analytics cookies or social media cookies.

On the public website, the only thing stored in your browser (localStorage) is the light or dark theme preference you choose with the button. It is not a cookie and it is not sent to any server.

In the private area, your browser stores the active session, the section you had open and the chosen theme, which are needed for the service to work. The Vimeo player may set its own cookies when playing a video.

You can delete this data at any time from your browser settings.

8. Security

We take the technical and organisational measures needed to ensure the security of your data and prevent its alteration, loss, processing or unauthorised access, in line with the state of the art at any given time.

9. Changes to this policy

We reserve the right to update this Privacy Policy to adapt it to regulatory changes or changes in our services. We will inform you of substantial changes through the Website or by email if we have yours.