1. Data controller
- Centre d'Estudis Avanç SL — Tax ID B66676214.
- Rambla del Poblenou 125, 08018 Barcelona (Spain).
- Barcelona Companies Register, Volume 45158, Folio 34, Page 478665, entry 2.
- Privacy and rights exercise: info@academia-avanc.com
- General support and unsubscriptions: hello@academia-avanc.com
- Telephone: +34 93 266 07 40
- WhatsApp Business (support and operational communications): +34 633 246 599
- Data protection officer: not appointed. Enquiries are addressed to info@academia-avanc.com.
2. Data we process
| Category | Examples | When |
|---|---|---|
| Identification and contact | first and last name, email, phone, preferred language | contact, requests, level test, enrolment |
| Legal guardian data | name, email, phone and relationship to the student | when the student is a minor |
| Academic data | written and oral test result, CEFR level, recommendation, attendance, cancellations, work completed | level test and course |
| Enrolment data | course or format chosen, centre, schedule, payment method | enrolment |
| ID document number | ID card, NIE or passport | enrolment only |
| Billing and payment data | amounts, fees, payment status, SEPA mandate reference | contractual relationship |
| Communications | messages sent via forms, email or WhatsApp Business, and transactional emails sent | throughout the relationship |
| Technical data | IP address, minimal technical security logs | browsing |
We do not request or process health data, disability data, special educational needs data or allergy data. Please do not include this type of information in forms or messages.
ID card/NIE/passport number: requested only at enrolment because the administrative and accounting management system (Netabout) requires it to register students. In the MVP, we do not request or store a copy or image of the document. The number is stored encrypted, shown masked, and only administration and secretariat staff can view it in full via an explicit action, with a stated purpose and an audit log. It is never included in emails, URLs, technical logs, analytics, internal alerts, or information visible to teaching staff.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and information requests | pre-contractual measures at the data subject's request |
| Managing the level test and communicating the result and recommendation | pre-contractual measures / performance of the contract |
| Managing place requests and requests for private or semi-private classes (which do not reserve a place or generate a charge) | pre-contractual measures |
| Formalising and managing enrolment, classes, attendance and incidents | performance of the contract |
| Administrative and accounting registration, invoicing and collection, including direct debit | performance of the contract and legal obligation |
| Complying with tax, accounting and record-keeping obligations | legal obligation |
| Sending transactional emails (confirmations, results, appointment notices) | performance of the contract or pre-contractual measures |
| Support and operational communications via WhatsApp Business (+34 633 246 599): class notices, changes and appointments | performance of the contract or pre-contractual measures at the data subject's request |
| Sending commercial communications about courses and promotions | express, separate and revocable consent |
| Publishing images or videos to promote the centre | express, separate and revocable consent |
| Website security and abuse prevention | legitimate interest |
| Handling the exercise of rights and complaints | legal obligation |
We do not make automated decisions with legal effects: the final level is always confirmed by a member of the teaching team, and enrolment is only confirmed after Avanç's administrative validation.
We do not automatically sign up anyone who contacts us to any newsletter.
3.1 WhatsApp Business
Avanç uses a WhatsApp Business account at number +34 633 246 599, controlled by Avanç, solely for support and operational communications (class notices, schedule changes, appointments and administrative matters). It is not used for promotions or newsletters, which require separate consent and are sent by email. WhatsApp is not the only channel available: email and telephone remain available for any matter, and no one is obliged to use WhatsApp. The data processed are the phone number, the name and the content of the messages; the provider's contractual terms, region and transfers are available on request at info@academia-avanc.com.
3.2 Anonymous measurement of transactional emails
The emails we send are delivered through Brevo. Brevo may measure, in an anonymous and aggregated way, whether a message is opened and whether a link is clicked, for the purposes of security, deliverability and service operation (detecting blocked messages, bounces or sender reputation problems).
These measurements are not associated with the recipient: we do not use them to identify anyone, nor to build profiles, segment, score contacts or trigger automations, and we do not receive individual open or click events in our systems. In every send we instruct Brevo that the recipient does not consent to individual tracking (contactPixelTrackingConsent: false); this instruction anonymises the measurement but does not guarantee the technical removal of the image pixel or of link rewriting by the provider.
This is not a website cookie: it is a measurement inherent to the email channel.
4. Minors
Forms concerning minors are completed by their parent or legal guardian, who declares having capacity to do so and is responsible for the accuracy of the data provided.
5. Recipients and data processors
We use providers that process data on Avanç's behalf, under a data-processing agreement. We distinguish between a provider contracted directly by Avanç and a technical sub-processor of another provider.
| Provider | Relationship | Purpose | Data | Contracting entity / region / transfers |
|---|---|---|---|---|
| Lovable | Contracted directly | Web platform and backend (database, authentication, server functions, scheduled tasks) | contact data, level test, requests, enrolment, generated emails | Contractual details available on request at info@academia-avanc.com |
| Lovable's technical sub-processors (including database hosting) | Sub-processor | Hosting and infrastructure | the same | Contractual details available on request at info@academia-avanc.com |
| Typeform | Contracted directly | Level-test and enrolment forms | identification, contact, form answers and document number while used as the enrolment form | Contractual details available on request at info@academia-avanc.com |
| Brevo | Contracted directly | Sending transactional emails | name, email, message content | Contractual details available on request at info@academia-avanc.com |
| Teach'n'Go | Contracted directly | Academic management: classes, attendance, cancellations and work completed | identification, contact, academic data | Contractual details available on request at info@academia-avanc.com |
| Netabout | Contracted directly | Administration and accounting management, including student registration | identification, contact, document number, billing data | Contractual details available on request at info@academia-avanc.com |
| Google (Workspace, Calendar, Meet, Sheets) | Contracted directly | Corporate email, calendar, classes and tests via video call, internal worksheets | identification, contact, appointments | Contractual details available on request at info@academia-avanc.com |
| WhatsApp Business (+34 633 246 599) | Contact channel | Support and operational communications | identification, contact, message content | Contractual details available on request at info@academia-avanc.com |
| Banks | Recipient | Fee collection and direct debit | payment data | in accordance with banking regulations |
| Legal/accounting advisers, public administration and courts | Recipient | Legal obligations | those required by law | — |
While Typeform is used as the enrolment form, Typeform will process the ID document number. Before it is used in production, its DPA, data residency, international transfers and sub-processors must be confirmed.
International transfers: the contractual information of each provider is available on request at info@academia-avanc.com. We do not assert the existence or absence of transfers outside the European Economic Area until we have contractual confirmation from each provider. Where they exist, we will disclose the applicable mechanism (adequacy decision or standard contractual clauses) and any additional safeguards.
6. Retention periods
| Data | Retention |
|---|---|
| Enquiries and contacts without enrolment | up to 12 months from the last contact |
| Place or class requests not formalised | up to 12 months from the request |
| Level-test results | for the duration of the relationship and up to 24 months afterwards, as an academic reference |
| Enrolment and academic data | for the duration of the relationship and the applicable limitation periods |
| Invoices and accounting/tax documentation | the legal commercial and tax retention periods (generally 6 years commercial and 4 years tax, and any others applicable) |
| ID card/NIE/passport number | a provisional and configurable period of 12 months from the end of the relationship, after which it is deleted or anonymised. This period responds to the contractual and administrative need to manage student registration and incidents; it is not yet legally validated and is not linked to the retention period for invoices and accounting documentation, which is kept separately |
| Marketing or image consent and its withdrawal | until revoked and, afterwards, the time necessary to evidence the revocation |
| WhatsApp Business conversations | while necessary for management and, afterwards, up to 12 months from the last message |
| Technical security logs | the minimum necessary periods |
Once these periods have elapsed, the data are deleted or anonymised, unless legally required to be blocked.
7. Rights
You may exercise your rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated decisions by writing to info@academia-avanc.com, stating the right you are exercising and proving your identity. You may withdraw consent given (marketing, image) at any time, without affecting the lawfulness of prior processing or your enrolment. You may also request to unsubscribe from communications at hello@academia-avanc.com or via the unsubscribe link in commercial emails.
If you believe we have not handled your request correctly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the competent supervisory authority.
8. Security
We apply appropriate technical and organisational measures: role-based access control, encryption of the ID document number with a key managed outside the database, masking by default, an audit log of accesses to the full data, minimisation in emails and technical logs, and restricted access by teaching staff to strictly academic data.
9. Changes
This policy may be updated. The version in force will be the one published on the site, identified by version number and date.