Privacy and cookie policy
1. Data controller
- [Owner (person or company name)]
- Tax ID: [Tax ID (NIF / CIF)]
- [Postal address]
- Email: [Contact email]
2. What data we process
- Account: name, email and password (stored with irreversible encryption; we never know it).
- Purchase: amount, date, PayPal transaction identifiers and the email of the paying PayPal account. We never receive or store card or bank details: payment is handled by PayPal.
- Acceptance of the terms: version of the terms accepted, date, waiver of the right of withdrawal and the IP address it was accepted from.
- Course usage: sign-ins (date and time), lessons watched, viewing time, where you stopped and the percentage of each lesson watched, and the notes you write in the lessons.
- Security: IP address of failed sign-in attempts (deleted after 24 hours).
3. Purposes and legal basis
- Creating and managing your account and giving you access to the course you bought — performance of the contract (art. 6.1.b GDPR).
- Processing the payment, issuing invoices and meeting accounting and tax obligations — performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR).
- Saving your progress so you can carry on where you left off, and letting the instructor follow students' progress and improve the course — performance of the contract and legitimate interest (art. 6.1.b and 6.1.f GDPR). You can object by writing to the email above.
- Protecting accounts against unauthorised access — legitimate interest (art. 6.1.f GDPR).
- Sending you emails about your purchase and your access — performance of the contract. We do not send advertising.
4. How long we keep it
Account and usage data, for as long as you have an account and until you ask us to delete it. Purchase records, for the legally required periods (6 years under the Spanish Commercial Code and 4 years under tax law). Failed sign-in attempts, 24 hours.
5. Recipients
- PayPal (Europe) S.à r.l. et Cie, S.C.A., which processes payment data as an independent controller under its own privacy policy.
- the web hosting provider, as data processor for hosting the website and its database.
- Public authorities where required by law.
We do not sell or pass your data to third parties for commercial purposes.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [Contact email]. If you believe your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the authority of your country.
7. Cookies
This website only uses one technical first-party cookie, wgsess, which is essential to keep you signed in and is deleted when you close the browser. As it is exempt from consent (art. 22.2 LSSI-CE), no cookie banner is shown. We use no analytics or advertising cookies, and fonts are served from our own server. When you pay with PayPal, PayPal may use its own cookies under its own policy.