Clases con LeaEspañol

Borrador pendiente de revisión por la gestoría.

Draft awaiting review by our accountant (gestoría). It is not final yet, and the details in square brackets still have to be filled in. The Spanish version is the one that applies.

Privacy policy

Draft of 14 October 2026

This policy explains what personal data Clases con Lea handles, why, for how long, and what rights you have. The EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Spain’s Organic Law 3/2018 on data protection and digital rights (LOPDGDD) apply.

1. Data controller

Clases con Lea is one self-employed teacher; there is no data protection officer. [CONFIRMAR CON LA GESTORÍA: que no hace falta nombrar uno.] For any question about your data, write to [EMAIL].

2. What data we handle, why, and on what legal basis

a) When you get in touch to ask about lessons

If you write by WhatsApp or through the contact form, we use what you send (name, phone or email, your message and, if you give them, the future student’s level or age) only to reply and, if you wish, arrange lessons.

Legal basis: steps taken at your request before entering into a contract (GDPR art. 6.1.b).

b) Students and families: giving and running the lessons

To teach, we handle the student’s name, level and group, attendance, test and homework results and notes on their progress. For the parent or guardian, or the adult student who pays, we handle their name and contact and payment details, and for invoices the payer’s full name, tax number (NIF) and address. We do not ask for children’s identity numbers (DNI or NIE).

Legal basis: the contract for the lessons (GDPR art. 6.1.b). Where a parent or guardian contracts the lessons, the child’s data needed to teach them is handled under that contract and the legitimate interest in teaching the child and following their progress (GDPR art. 6.1.f). Invoices and income records are kept because tax law requires it (GDPR art. 6.1.c).

c) The student’s account on this website

Each student can have a username and password for the lessons area. The account holds no email address for the student: the username is stored as an internal address that receives no mail. The account keeps their tests, games and results, homework marked as done and the notices they send, such as a request to cancel a lesson. So that each account is used by one person, it can be open on only one device at a time.

Legal basis: the contract for the lessons (GDPR art. 6.1.b).

d) Optional uses

Anything not needed for the lessons, such as recording a student’s voice for speaking practice or using a photo of them, happens only with prior written consent, which can be withdrawn at any time without affecting the lessons (GDPR art. 6.1.a).

e) Drawings of Lea

The drawings of Lea, the character who stands for the teacher on the website, are made with Google’s Gemini artificial intelligence. Only the drawing instructions and earlier portraits of Lea are sent to Google, never data about students or families.

f) Visit statistics

To know whether the website is useful, we count how many times a day the home page is opened, the WhatsApp or share button is pressed and the form is sent. Only each day’s total is kept: no cookies, no IP address and nothing that could tell who visited. These totals are not personal data.

3. Children

In Spain, a person can consent to the use of their own data from the age of 14 (LOPDGDD art. 7). Below that age, a parent or guardian consents and exercises the child’s rights. A child’s lessons are always contracted by a parent or guardian. In addition, for any optional use of the data of a student under 16 we ask for a parent’s or guardian’s permission, which meets both the current rule and the bill now before parliament that would raise the age to 16.

4. Who else handles the data (processors)

We do not sell or pass on data to anyone. Some providers handle data on our behalf, only to provide their service and under a data processing agreement:

WhatsApp is a contact channel you choose. Messages travel through WhatsApp’s service (Meta), which handles them under its own terms and privacy policy. If you would rather not use WhatsApp, use the contact form or write to [EMAIL].

Data will also be given to the Spanish tax agency and other authorities where the law requires it.

5. International transfers

Google, Netlify and Meta are companies based in the United States, so some data may be handled outside the European Economic Area, for example for technical support or security. These transfers rely on the EU-US Data Privacy Framework, which these companies have joined, and on the standard contractual clauses approved by the European Commission. [CONFIRMAR CON CADA PROVEEDOR.]

6. How long we keep data

Whatever the law requires us to keep is kept blocked: it can only be used for courts, authorities or claims (LOPDGDD art. 32).

7. Your rights

You can ask for access to your data, to correct or delete it, to restrict its use, to object to it, and for data portability, and you can withdraw any consent you have given at any time. Write to [EMAIL] or by WhatsApp saying which right you wish to use; if needed, we will ask you to show who you are. We will reply within one month. The rights of a child under 14 are exercised by a parent or guardian.

If you think your data has not been handled properly, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es or C/ Jorge Juan 6, 28001 Madrid, Spain.

8. Security

The lessons area opens only with a username and password. Each student sees only their own work and their class’s material; only the teacher sees all students’ data. The connection is always encrypted (HTTPS).

9. Cookies

What this website stores in your browser is explained in the cookie policy.

10. Changes

If this policy changes, the new version will be published on this page with its date.