Privacy Policy

Data controller

The centre where the student is enrolled (Málaga, Benalmádena or Madrid) is the data controller. Its full identification and tax details appear on the invoices and can be requested at any time by writing to the centre's contact email.

Data we process

• Family data: name, tax ID, address, phone and email.
• Student data: name, date of birth, level, allergies and health information relevant to their safety, attendance and artistic progress.
• Billing and payment data (full card details are handled by Stripe, not by us).
• Images of their artwork and, if you give separate consent, photographs of the child.
• The mood the student voluntarily selects when arriving at the studio.

Purposes and legal basis

• Managing enrolment, classes and payments: performance of the contract (art. 6.1.b GDPR).
• Handling allergies and health needs: vital interests and explicit consent (arts. 6.1.d and 9.2.a GDPR).
• Complying with accounting and tax obligations: legal obligation (art. 6.1.c GDPR).
• Sending service notices (fees, make-up classes, holidays, reports and invoices): performance of the contract.
• Sending promotions and news: consent, which can be withdrawn at any time.
• Publishing images of the child: specific consent of the parent or legal guardian.

Children's data

The account is always created by the parent or legal guardian, who authorises the processing of the child's data. Under article 7 of Spanish Act LOPDGDD, children under fourteen cannot give consent themselves.

Retention periods

We keep the data while the relationship with the centre lasts and, afterwards, blocked for the legal periods: six years for accounting records (Commercial Code) and four years for tax obligations (General Tax Act). Images are deleted when you withdraw consent.

Recipients and transfers

We share data only with providers required to deliver the service, acting as processors under a signed agreement: payment gateway (Stripe), email provider (Resend), platform hosting and, where legally required, the tax authorities and our accountants. Some providers may process data outside the European Economic Area under the Standard Contractual Clauses approved by the European Commission. We never sell data to third parties.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to the centre's contact email. If you believe your request has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security

We apply appropriate technical and organisational measures: hashed passwords, role-based access, encrypted communications and backups. We will never ask for passwords or card details by email or phone.

The Spanish version of this document prevails in the event of any discrepancy.