1. DATA CONTROLLER
Company name: YAE PALOMARES, S.L.
Trade name: YouAndEnglish
Tax ID (NIF/CIF): B-44809432
Registered address: Calle Emilio Ortuño No. 36, 3rd Floor A, Staircase B, 28038 Madrid (Spain)
Email: juan@youandenglish.com
Website: www.youandenglish.com
For any matter relating to data protection, the User may contact us at the email address juan@youandenglish.com. YAE PALOMARES, S.L. has not appointed a Data Protection Officer (DPO), as it is not mandatory; should one be appointed, their contact details will be published here.
2. DATA WE PROCESS
Depending on the relationship the User has with the Academy, we may process the following categories of data:
- Identification and contact data: first name, surname, email address, telephone, country/time zone.
- Account and service data: username, level, language, class history, bookings, attendance, progress, and reviews.
- Billing and payment data: data necessary for billing (card details are processed by the payment gateway, not by the Academy).
- Minors' data: when the service is contracted for a minor, the minor's identification and progress data, provided by their legal guardian.
- Browsing data: data arising from the use of the website and cookies, in accordance with the Cookies Policy.
3. PURPOSES AND LEGAL BASIS FOR PROCESSING
We process personal data for the following purposes and on the following legal bases:
| Purpose |
Legal basis (GDPR) |
Retention |
| Provision and management of the contracted training services and of the User account. |
Performance of the contract (art. 6.1.b). |
For the duration of the contractual relationship. |
| Billing and compliance with legal accounting and tax obligations. |
Legal obligation (art. 6.1.c). |
The legal retention periods (e.g. tax/commercial). |
| Handling of enquiries, requests, and complaints. |
Legitimate interest / consent (art. 6.1.f / 6.1.a). |
Until the request is resolved and for the applicable limitation periods. |
| Sending commercial and informational communications. |
Consent of the data subject; legitimate interest with respect to customers (LSSICE art. 21.2). |
Until the data subject withdraws consent or objects. |
| Service improvement, statistics, and usage analysis. |
Legitimate interest (art. 6.1.f). |
Aggregated data or until objection. |
4. DATA RETENTION PERIODS
Data will be retained for as long as the relationship with the User is maintained and, after its termination, for the periods legally required to address possible liabilities (tax, accounting, and limitation periods for legal actions). When no longer necessary, the data will be blocked and subsequently deleted securely.
5. RECIPIENTS AND DATA PROCESSORS
Data will not be disclosed to third parties except where legally required. However, in order to provide the service, the Academy relies on providers acting as data processors, with whom it enters into the corresponding contracts in accordance with Article 28 of the GDPR, including among others:
- Provider of the videoconferencing platform and virtual classroom.
- Web hosting and email provider.
- Payment gateway(s) for collecting payment for the services.
- Email marketing and customer management (CRM) tool.
- Accounting / tax advisory firm for accounting and tax obligations.
International transfers: some technology providers may be located outside the European Economic Area. In such cases, the Academy ensures that these transfers are covered by adequacy decisions or appropriate safeguards (e.g. the European Commission's Standard Contractual Clauses).
6. MINORS
When the service is contracted for the benefit of a minor, it is the parent or legal guardian who provides the data and gives consent on their behalf. In accordance with Article 7 of the LOPDGDD, the processing of data of minors under 14 years of age based on consent requires the consent of the holder of parental authority or guardianship. The Academy does not knowingly collect data from minors under 14 directly without such intervention.
7. USER RIGHTS
The User may exercise the following rights by submitting a request, proving their identity, to the email address indicated in section 1:
- Access to their personal data.
- Rectification of inaccurate or incomplete data.
- Erasure of data when no longer necessary.
- Objection to processing in certain circumstances.
- Restriction of processing.
- Portability of data to another controller.
- Withdrawal of the consent given, without retroactive effect.
The User has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if they consider that their rights have not been duly addressed.
8. SECURITY MEASURES
The Academy has adopted the appropriate technical and organizational measures to ensure the security, confidentiality, and integrity of the data and to prevent its alteration, loss, unauthorized processing, or unauthorized access, taking into account the state of the art and the nature of the data processed.
9. ACCURACY OF DATA
The User guarantees that the data provided is truthful, accurate, and up to date, and undertakes to communicate any changes. The User shall be responsible for the accuracy of the data and for any damages that may arise from its inaccuracy.
10. CHANGES TO THE PRIVACY POLICY
The Academy may modify this Policy to adapt it to legislative developments or changes in its processing activities. The version in force will be the one published on the website, indicating the date of last update.
YouAndEnglish
