Privacy Policy

1. Who is responsible

The data controller for this website is Michelle Garcia Ramos, a self-employed Spanish language tutor trading as My Spanish Academia.

• Tax ID (NIF): 78992862Y
• Registered address: Calle Embajadores, 105, 1C, 28045 Madrid, Madrid, Spain
• Email: [email protected]

No Data Protection Officer has been appointed. None is required here: the controller is a sole trader whose core activity is teaching, not large-scale monitoring or processing of special categories of data (Art. 37 GDPR). Privacy questions go to the address above and are answered by the controller herself.

Full identification of the provider of this website is set out in the Legal Notice.

2. What data we collect

We collect the following personal data when you use this website:

• Account data — name, email address, and profile information you provide when creating an account via Clerk.
• Booking data — lesson dates, times, and booking identifiers collected when you schedule a session via Cal.com.
• Payment data — transaction identifiers and credit balance. Full payment card details are processed directly by Stripe and never pass through our servers.
• Usage data — standard server logs (IP address, browser type, pages visited) generated automatically when you browse the site.

3. Why we process your data

Your data is used exclusively to:

• Create and manage your student account.
• Schedule, confirm, and manage lesson bookings.
• Process payments and maintain your lesson credit balance.
• Send transactional emails related to your bookings or account (no marketing without your consent).
• Comply with legal obligations.

The legal basis for processing is contract performance (Art. 6(1)(b) GDPR) and, where applicable, legitimate interest (Art. 6(1)(f) GDPR). Where processing is based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Third-party processors

We use the following trusted sub-processors. Each operates under its own privacy policy and data processing agreements:

• Clerk — authentication and user account management.
• Stripe — payment processing. Stripe is PCI-DSS Level 1 certified. We never store card details.
• Cal.com — lesson scheduling and calendar management.
• Resend — delivery of transactional email, including contact-form messages and homework notifications. Your name, email address and the content of your message pass through it.
• Hetzner Online GmbH — hosting. The application and its database run on servers located in Germany, inside the EEA.
• Cloudflare — DNS and network delivery for this domain, which processes connection data such as your IP address in order to route and protect traffic.

We do not sell your data to any third party, and we do not use it for advertising or profiling.

5. International data transfers

Clerk, Stripe, Cal.com, Resend and Cloudflare are companies based in the United States. Using their services means some of your personal data is transferred to and processed in a country outside the European Economic Area (EEA). Hosting and the database, by contrast, remain within the EEA (Germany).

These transfers are carried out under appropriate safeguards, specifically the Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR), which each of these providers has incorporated into their data processing agreements. You can request a copy of the applicable safeguards by contacting us at [email protected].

6. Data retention

We retain your account and booking data for as long as your account is active or as needed to provide services. Payment records are kept for the period required by applicable tax and accounting law (typically 5–7 years). You may request deletion at any time (see Section 7).

7. Your rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Spanish data protection authority, AEPD (Agencia Española de Protección de Datos — aepd.es), or with the supervisory authority of your country of residence.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

8. Automated decision-making

We do not use any form of automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22 GDPR).

9. Cookies

The public pages of this site load no third-party scripts and set no analytics, advertising or tracking cookies. The only things stored are a first-party record of your light/dark appearance choice and, once you sign in, the session cookies that keep you signed in — both strictly necessary or exempt under Art. 22.2 LSSI-CE.

That is why you are not shown a consent banner: there is nothing here to consent to. Each cookie is named and explained in the Cookie Policy. If non-essential cookies are ever introduced, a consent banner will appear first and they will not load until you accept.

10. Children and minors

Accounts on this site are for adults only. You must be 18 or over to create an account, purchase lesson credits or book a lesson. We do not knowingly allow a minor to register.

Minors are welcome as students, but the contract is always with an adult: a parent or legal guardian creates the account, pays, and books the lessons. In doing so they confirm that they hold parental authority over the student and consent to the processing of the student's data on their behalf.

Where a minor attends lessons, the only data we process about them is what the guardian chooses to give us — typically a first name, level and learning goals — plus the lesson records themselves. The legal basis is the guardian's consent (Art. 6(1)(a) GDPR) together with performance of the contract they entered into.

Under Spanish law (Art. 7 LOPDGDD) a person aged 14 or over may consent to the processing of their own data; below 14, only a parent or guardian can. Because no account may be opened by anyone under 18, this site does not rely on a minor's own consent for anything. If you believe a minor has created an account or given us their data without their guardian's involvement, write to [email protected] and we will delete it.

11. Changes to this policy

We may update this policy occasionally. The "Last updated" date at the top of this page will reflect any changes. Continued use of the site after an update constitutes acceptance of the revised policy.