This Privacy Policy governs the processing of personal data provided by users, students, parents, legal guardians and any other persons who interact with The Cottage English School through the website, by email, by telephone, in person or through enrolment and administrative management processes.

Data controller

Data controller: [FULL NAME / COMPANY NAME]
Trade name: The Cottage English School
Tax ID number (NIF/CIF): [TO BE COMPLETED]
Registered office / business address: [TO BE COMPLETED]
Centre address: Plaça Josep Anselm Clavé, 11, 08720 Vilafranca del Penedès, Barcelona
Telephone: 938 92 31 04
Email: thecottage@hotmail.es
Data Protection Officer (DPO): [TO BE COMPLETED]

What personal data we process

The Cottage English School may process, depending on each case, the following categories of personal data:

a) Contact and customer service data

First name and surname, email address, contact telephone number and any other data voluntarily provided by the user through the website form, email, telephone or in-person enquiries.

b) Student data

Student name and any data strictly necessary to manage enrolment, the organisation of the educational service and the academic and administrative relationship.

c) Data of parents or legal guardians

Where the student is a minor, the identifying and contact details of the father, mother or legal guardian may be processed, together with any data necessary to manage authorisations, communications, enrolments, payments and the proper provision of the service.

d) Financial, banking and invoicing data

Where enrolment or the contracting of courses and services is formalised, the data necessary for accounting, administrative and payment management may be processed, including the bank account number where payment is made by direct debit or monthly charge for the service.

e) Other data provided voluntarily

Any information freely provided by the data subject in their communication or submitted documentation.

The Cottage English School undertakes to process only data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is collected.

Purposes of the processing

Personal data may be processed for the following purposes:

To deal with requests for information, enquiries, messages or requests made through the website, by email, by telephone or in person.
To manage the student’s enrolment and the pre-contractual and contractual relationship with the school.
To manage the provision of courses, classes, training activities and services related to learning the English language.
To contact students, parents or legal guardians regarding organisational, academic, administrative or customer service matters.
To manage payments, direct debits, invoicing, accounting and other administrative, tax and commercial obligations arising from the contractual relationship.
To comply with legal obligations applicable to the data controller.
To manage and evidence acceptance of terms, authorisations or documents linked to enrolment.
To send informational or commercial communications related to The Cottage English School’s own services, where prior consent has been given by the data subject or where permitted by law.
To ensure the security, integrity and proper functioning of the systems, procedures and communication channels used by the school.
To deal with the exercise of data protection rights and to manage incidents, complaints or potential liabilities.

Legal basis for the processing

The legal basis legitimising the processing of data will depend on the specific purpose:

a) Consent of the data subject

Where the user sends an enquiry through the website form, email or other contact channels, as well as where the user expressly authorises the sending of commercial communications not covered by another legal basis.

b) Application of pre-contractual measures

Where the processing is necessary to deal with requests prior to entering into a contract, to answer questions about courses, timetables, levels, availability, prices or other matters relating to possible enrolment.

c) Performance of a contract

Where the processing is necessary to manage the student’s enrolment, provide the contracted service, organise groups, formalise the relationship with the school, issue receipts, manage payments and maintain communications inherent to the service.

d) Compliance with legal obligations

Where the processing is necessary to comply with administrative, tax, accounting, commercial, data protection or any other obligations laid down by applicable regulations.

e) Legitimate interests of the data controller

In certain cases, The Cottage English School may process data on the basis of its legitimate interests, for example to defend itself against claims, preserve the security of its systems or reasonably manage the organisational continuity of the service, always respecting the rights and freedoms of the data subjects.

Minors

The Cottage English School provides educational services that may be directed at minors. Therefore:

Where the processing of personal data is based on consent and the minor is under 14 years of age, such consent must be given by the person holding parental authority or guardianship.
Where the law requires the assistance or intervention of legal representatives for the execution of a legal act or transaction, this requirement shall be complied with.
The school may request the identifying and contact details of the father, mother or legal guardian in order to manage the educational, administrative and financial relationship arising from the minor’s enrolment.

The legal representatives guarantee that the data provided is truthful, accurate and up to date, and that they are duly authorised to provide it.

Source of the data

As a general rule, personal data will be provided directly by the data subject or, in the case of minors, by their parents or legal guardians. If the data subject provides third-party data, they guarantee that they have informed those third parties in advance and have a sufficient lawful basis for providing such data.

Recipients of the data

Personal data may only be disclosed or made accessible to third parties where necessary for the fulfilment of the purposes described and always where there is a sufficient legal basis.

Among others, the following may have access to the data:

Banks and payment service providers, for the management of collections or direct debits.
The school’s advisers, administrative managers, accounting or tax service providers.
Technology providers, web hosting providers, email providers, IT maintenance providers or management software providers, in their capacity as data processors.
Public authorities, courts or law enforcement bodies, where there is a legal obligation.
Other third parties where disclosure is necessary for the establishment, exercise or defence of legal claims.

The Cottage English School shall require its providers to comply with data protection obligations through the relevant contracts or other legally required instruments.

International data transfers

As a general rule, no international transfers of data outside the European Economic Area are envisaged unless they are supported by an appropriate legal basis.

However, should technological providers located outside the European Economic Area, or with access from third countries, be used for the provision of certain services, The Cottage English School shall adopt the safeguards required by the applicable regulations, such as adequacy decisions, standard contractual clauses or other legally valid mechanisms.

Data retention period

Data shall be retained for the period strictly necessary to fulfil the purpose for which it was collected and, thereafter, for the periods required by law or for as long as liabilities may arise.

As a general indication, unless a rule requires a different period:

Enquiries and contacts not converted into enrolment or contract: for the time necessary to deal with the request and, at most, for 12 months from the last interaction, unless the data subject requests deletion earlier or another lawful basis exists for retaining it.
Enrolment, academic, administrative and contractual data: throughout the duration of the relationship and, thereafter, blocked for the legally established retention or limitation periods.
Accounting, commercial and supporting business records: for the periods required by the applicable regulations.
Tax data: for the periods established by law.
Banking data for direct debit or monthly charges: for the time necessary to manage payments and, thereafter, blocked for the time necessary to deal with possible liabilities, returns, incidents or claims.
Commercial communications: until the data subject withdraws consent or objects to the processing, as applicable.

Mandatory or optional nature of the data

Forms or data collection channels shall identify, where appropriate, which data is mandatory in order to deal with the request or properly provide the service. Refusal to provide the necessary data may make it impossible to process the enquiry, formalise enrolment or properly perform the service.

Rights of data subjects

Any person has the right to obtain confirmation as to whether or not The Cottage English School is processing personal data concerning them.

In particular, the data subject may exercise the following rights:

Right of access.
Right to rectification.
Right to erasure.
Right to object.
Right to restriction of processing.
Right to data portability.
Right to withdraw consent at any time where the processing is based on consent.
Right not to be subject to automated individual decision-making, where applicable.

To exercise these rights, the data subject may send a written request, together with a copy of an identity document, to:

Email: thecottage@hotmail.es
Postal address: Plaça Josep Anselm Clavé, 11, 08720 Vilafranca del Penedès, Barcelona
For the attention of: Data Protection / Data Protection Officer [TO BE COMPLETED]

Likewise, if the data subject considers that their rights have not been duly respected, they may lodge a complaint with the Spanish Data Protection Agency.

Security and confidentiality

The Cottage English School adopts and shall maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the nature of the processed data, the associated risks and the state of the art.

Among others, measures shall be applied aimed at:

limiting access to personal data to authorised staff;
ensuring the confidentiality, integrity, availability and resilience of systems;
protecting information against loss, alteration, unauthorised access or improper disclosure;
maintaining internal incident management procedures and, where appropriate, personal data breach procedures;
formalising confidentiality undertakings and contracts with data processors;
periodically reviewing and updating internal data protection processes.

Commercial communications

The Cottage English School shall not send commercial communications by electronic means without an appropriate legal basis. Where necessary, the express consent of the data subject shall be requested.

Where there is a prior contractual relationship, communications relating to similar services of The Cottage English School may be sent, always with a simple, free and effective possibility to object.

Social media and third-party services

If The Cottage English School maintains profiles on social media or uses third-party services linked from the website, the data processing carried out by those platforms shall be governed by their own terms and policies. Users are advised to review those policies before interacting with such environments.

Policy updates

This Privacy Policy may be amended in order to adapt it to legal changes, criteria of supervisory authorities, case law developments, changes in the school’s activity or technical modifications to the website. The current version shall be the one published in this section.

Last updated: 03.2026