Privacy Policy
1. Data Controller
The controller responsible for the processing of personal data collected through this website is:
Inmaculada Concepción López Puerto
Trading name: Spanish Business Class
Country of establishment: Portugal
Email: inma_29_95@hotmail.com
[PENDING: LEGAL FORM]
[PENDING: NIF/NIPC]
[PENDING: BUSINESS OR FISCAL ADDRESS]
2. Scope and adults only
The services are intended for adults aged 18 or over. Spanish Business Class does not knowingly offer accounts or paid services to minors.
3. Personal data collected
Spanish Business Class may collect personal data when a person visits the website, submits a form, books a level assessment or tutoring session, creates an account, purchases a service, accesses a course, or contacts Spanish Business Class.
Contact and account information
This may include:
- name and surname;
- email address;
- account username;
- password hash;
- profile picture, where voluntarily uploaded;
- information included in enquiries or messages;
- Spanish language level;
- assigned course or plan;
- course progress and learning history;
- tutoring credits and tutoring history;
- appointment dates, times, and status;
- consent records and communication preferences.
The website stores a cryptographic representation of the password and does not have access to the user’s plain-text password.
Purchase and billing information
This may include:
- name and surname;
- billing address;
- country;
- email address;
- order history;
- purchased products or services;
- amounts paid;
- payment method;
- payment status;
- transaction and order identifiers;
- invoicing information.
Technical information
Where applicable, the website may process:
- IP address;
- browser type;
- device and operating-system information;
- session and login information;
- cookies and similar identifiers;
- cookie and consent preferences;
- date and time of access;
- security and technical logs.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Contact enquiries | Taking steps at the user’s request prior to entering into a contract |
| Level test before purchase | Taking steps at the user’s request prior to entering into a contract |
| Level test after purchase | Performance of a contract |
| Account and student area | Performance of a contract |
| Course access and progress | Performance of a contract |
| Tutoring and appointments | Performance of a contract or taking pre-contractual steps for a free assessment |
| Purchases | Performance of a contract |
| Accounting and invoicing | Compliance with a legal obligation |
| Transactional emails | Performance of a contract or managing a request |
| Promotional campaigns | Consent |
| Security logs | Legitimate interest in protecting the site, limited and proportionate |
5. When personal data is required
Some personal data is required to respond to a request, create an account, process a purchase, assign a course or organise a tutoring session. If the required information is not provided, Spanish Business Class may be unable to complete the requested action or provide the corresponding service.
Information marked as optional, including marketing consent and the optional profile picture, is not required to purchase or access the educational services.
6. Contact and level-test enquiries
When a user submits an enquiry or requests a level test, the provided data (such as name, email, and language level responses) is used to answer the request, organise a preliminary videocall, and recommend a course.
This information is processed locally on the website and sent via the email provider.
7. Accounts and student area
Account creation is necessary to access private materials, manage tutoring sessions, and track learning progress. Spanish Business Class uses WordPress and TutorLMS as local software to manage these accounts and course progression.
8. Purchases, billing and Stripe
Spanish Business Class processes purchases and billing through WooCommerce, installed locally on the website. Payments are securely processed by Stripe. Spanish Business Class does not store the full credit or debit card details.
Stripe acts as a payment service provider and may process technical data to prevent fraud and secure transactions according to its own privacy documentation.
9. Courses, progress and personalised content
Course progress, quiz responses, and learning history are maintained through TutorLMS to provide the educational service. Videos hosted directly by Spanish Business Class as protected MP4 files do not involve external platforms. Progress tracking is not considered an automated decision with legal effects, as it merely executes the predefined rules of the course.
10. Tutoring, bookings and videocalls
Users may book live tutoring sessions or level tests. Data necessary to manage the booking (name, email, date, time) is stored on the website.
The website does not automatically sync data via API to Google Calendar. Links to live sessions (via platforms such as Google Meet or Microsoft Teams) are generated manually by the teacher and inserted into the website so that an email with the access link can be sent to the student.
11. Marketing communications
Spanish Business Class may send promotional emails, newsletters, or educational content exclusively to users who have given prior express consent, for example by selecting an optional marketing checkbox in a website form.
Consent may be withdrawn at any time. When a user unsubscribes, their email address may be securely retained in a suppression list strictly to ensure their decision is respected and to prevent future mailings.
12. Cookies and external media
The website uses cookies and similar technologies for essential functions, security, and the maintenance of sessions and the shopping cart.
External media, such as YouTube videos, is disabled by default and requires the user’s prior choice before loading.
No analytics or advertising tracking platform is currently active. The cookie banner includes Analytics and Marketing categories so that any future integration can remain disabled until the user gives the corresponding consent.
For more details, please review our Cookie Policy.
13. Providers and recipients
To operate the website and provide its services, Spanish Business Class relies on external service providers. These providers only receive the data necessary for their specific functions.
- IONOS SE: Hosting provider for the website and local databases.
- Google Gmail: Email delivery provider used to send enquiries, account messages, transactional communications and authorised promotional messages.
- Stripe: Payment processor for managing purchases.
- Google / YouTube: Provider of externally hosted video content. YouTube receives technical data only when the user enables Functional and external media and loads an external video.
WordPress, WooCommerce and TutorLMS are installed and primarily operate within the website’s hosting environment. Their software publishers are not treated as recipients of student data solely because the software is installed. Any separate external integration or service that receives personal data is described independently in this policy.
14. International data transfers
Some providers may process personal data in countries outside the European Economic Area. Where this occurs, the provider may rely on an applicable adequacy decision, participation in the EU–U.S. Data Privacy Framework where valid for the relevant entity and service, Standard Contractual Clauses, or another lawful transfer mechanism.
Further information about the safeguards used by each provider is available in their official privacy and international-transfer documentation.
15. Data retention
Personal data is retained only for as long as necessary for the purposes outlined in this policy:
- Contact enquiries and level tests (without purchase): Retained while necessary to respond, conduct the evaluation, and perform reasonable follow-up. Afterwards, they are deleted or anonymised.
- Account and course data: Retained during the contractual relationship and afterwards for the limited period necessary to manage the account, respond to claims, comply with legal obligations or provide records requested by the student. Data that is no longer necessary will be deleted or anonymised.
- Appointments and tutoring records: Retained while necessary to provide the tutoring service, manage the course history and respond to possible incidents or claims. Information that is no longer required will be deleted or anonymised.
- Purchases and billing: Retained for the periods required by applicable accounting and tax laws in Portugal.
- Marketing data: Retained until consent is withdrawn or the user unsubscribes. Afterwards, the minimum information necessary may be retained in a suppression record for as long as reasonably necessary to respect the withdrawal and prevent further promotional messages.
- Security logs: Retained for a limited and proportionate time to investigate and prevent security incidents.
16. Security
Spanish Business Class implements reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, loss, or misuse. These measures include access controls, encrypted connections (HTTPS), secure password hashing, and regular updates of local software.
However, no electronic transmission or storage system can be guaranteed to be absolutely secure.
17. User rights
Users have the right to:
- access their personal data;
- request the correction of inaccurate data;
- request the deletion of their data;
- restrict the processing of their data;
- object to data processing;
- object at any time to the processing of personal data for direct-marketing purposes;
- request data portability, where applicable;
- withdraw their consent at any time without affecting prior lawful processing.
To exercise these rights, users may contact:
The exercise of these rights is generally free of charge. Spanish Business Class may request additional information to verify the identity of the requester where necessary.
18. Complaints to the supervisory authority
If a user considers that their data protection rights have been infringed, they have the right to lodge a complaint with the competent supervisory authority.
In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD): https://www.cnpd.pt/.
19. Automated decision-making
Spanish Business Class does not use personal data for automated decision-making that produces legal effects or similarly significantly affects the user. Level assignments and course progress are either manually reviewed or follow predefined contractual criteria.
20. Changes to this policy
This Privacy Policy may be updated to reflect legal, technical, or operational changes. When a material change occurs, users may be notified via email or a prominent notice on the website.
21. Contact
For any questions regarding this Privacy Policy or the processing of personal data, please contact:
Inmaculada Concepción López Puerto
Email: inma_29_95@hotmail.com
22. Last updated
Last updated: 12 June 2026