PRIVACY POLICY

Last updated: 21/06/2026

1. Who is responsible for your personal data?

The data controller is:

Trading name: English with Mandy
Legal name: [FULL LEGAL NAME]
Tax identification number: [NIF/NIE/CIF]
Professional address: [FULL BUSINESS ADDRESS]
Privacy email: [PRIVACY EMAIL]
Telephone: [TELEPHONE, IF APPLICABLE]

This Privacy Policy explains how personal data is processed when you visit englishwithmandy.com, submit an enquiry, book or pay for a lesson, attend an online class, purchase a package, subscribe to communications or otherwise interact with English with Mandy.

2. Whose data may be processed?

Personal data may relate to:

• website visitors;
• prospective and current adult students;
• parents, guardians and other persons purchasing lessons;
• children and teenage students;
• persons paying on behalf of a student;
• individuals contacting the provider;
• suppliers and professional contacts.

Where a parent or guardian books lessons for a child, the adult is responsible for providing accurate information and confirming that they are authorised to act on the child’s behalf.

3. Personal data that may be collected

Depending on your interaction, the following data may be processed.

Identification and contact data

Name, surname, email address, telephone number, country, preferred language, postal address and account details.

Booking and contractual data

Selected service, lesson date and time, time zone, attendance history, booking status, cancellation requests, package balance, communications and acceptance of contractual terms.

Student and educational data

Age or age range, language level, learning goals, academic needs, lesson progress, homework, teacher notes, feedback, test results and information voluntarily shared during lessons.

Only information reasonably necessary to provide and adapt the educational service should be collected.

Parent or guardian data

Identity, contact details, relationship to the child, billing details, consents and communications relating to the child’s lessons.

Payment and transaction data

Transaction reference, amount, currency, date, payment status, refund information and billing data.

Payments may be processed by [PAYMENT PROVIDER]. Where payment is processed directly by that provider, English with Mandy will normally not receive or store the complete card number or card security code. The precise payment flow must be confirmed before publication of this Policy.

Video-conferencing and lesson data

Display name, email address, meeting identifiers, connection details, audio, video and information shared during an online lesson.

Lessons are not recorded by default. Any recording must be clearly notified in advance and supported by a valid legal basis and, where required, separate express consent.

Technical and usage data

IP address, browser, device type, operating system, language, approximate location derived from the IP address, access times, security logs and website interactions.

Communications

Emails, contact-form submissions, messages, complaints, lesson-related communications and customer-service records.

Marketing and preference data

Communication preferences, newsletter subscription, consent records and interaction with marketing communications.

Accessibility or sensitive information

Students should not provide health information or other sensitive data unless it is necessary to arrange an accommodation or provide the service safely.

Where limited health, disability, learning-support or other special-category data must be processed, this will be done only where a valid legal basis exists and, when required, with explicit consent. For a child, the appropriate parent or guardian authorisation will also be obtained.

4. Why is personal data processed?

Responding to enquiries

Data is used to answer questions, provide information and arrange an initial consultation.

Legal basis: Steps requested before entering into a contract and, where applicable, legitimate interests in managing enquiries.

Managing bookings and providing lessons

Data is used to schedule lessons, send meeting links, assess the student’s level, prepare classes, monitor progress, communicate with students or guardians and deliver the contracted service.

Legal basis: Performance of a contract or steps requested before entering into a contract.

Managing lessons involving children

Data is used to communicate with parents or guardians, organise age-appropriate lessons, maintain safeguarding standards and provide the educational service.

Legal basis: Performance of the contract with the parent or guardian, compliance with legal obligations, legitimate interests in protecting students and, where necessary, consent.

Processing payments, refunds and invoices

Data is used to collect fees, confirm payment, issue invoices, prevent fraudulent transactions and manage refunds or payment disputes.

Legal basis: Performance of the contract, compliance with tax and accounting obligations and legitimate interests in preventing fraud and defending legal claims.

Conducting video lessons

Data is used to establish the video call and allow interaction between the teacher and student.

Legal basis: Performance of the educational contract.

Recording is not necessary for ordinary lesson delivery. Where a recording is proposed, the purpose, retention period, recipients and legal basis will be explained separately.

Managing customer support and complaints

Data is used to respond to requests, investigate incidents, resolve disputes and retain evidence of relevant communications.

Legal basis: Performance of the contract, compliance with legal obligations and legitimate interests in resolving disputes and defending legal claims.

Website security and operation

Technical data is used to maintain the website, detect misuse, prevent attacks, troubleshoot errors and protect accounts and information.

Legal basis: Legitimate interests in maintaining a secure and functional service and, where applicable, legal obligations.

Sending service communications

Essential messages may include booking confirmations, reminders, lesson links, cancellations, payment notices and changes affecting a contracted service.

Legal basis: Performance of the contract. These are not marketing communications.

Sending marketing communications

Newsletters, offers and promotional messages may be sent where the recipient has consented or where another lawful basis permits them.

Legal basis: Consent or another basis permitted by applicable electronic-marketing law.

Consent may be withdrawn and marketing communications may be opposed at any time.

Complying with law and protecting rights

Data may be processed to comply with tax, accounting, consumer-protection, data-protection or judicial obligations, and to establish, exercise or defend legal claims.

Legal basis: Legal obligation and legitimate interests.

5. Data relating to children

Bookings for students under 18 must be made or authorised by a parent or legal guardian unless the provider expressly permits another legally valid arrangement.

The provider may request reasonable information to verify the identity and authority of the adult making the booking.

Where processing is based on consent:

• a student aged 14 or over may, in circumstances permitted by Spanish law, provide consent for certain data-processing activities;
• for a child under 14, consent must be provided or authorised by the person holding parental responsibility or legal guardianship;
• regardless of the child’s age, the contract and payment should ordinarily be managed by an adult responsible for the student.

Information directed at children will be provided in clear and age-appropriate language where necessary.

Only data reasonably necessary for the lessons should be collected. Children should not disclose addresses, passwords, identity documents, financial information, private family information or other unnecessary sensitive details during a class.

The provider will not publish a child’s name, image, voice, testimonial, lesson recording or work for promotional purposes without the appropriate separate authorisation.

6. Video lessons and recordings

Lessons may be delivered through [VIDEO-CONFERENCING PROVIDER].

Students and guardians must ensure that:

• the student joins from an appropriate and reasonably private environment;
• the meeting link is not shared with unauthorised persons;
• no other person secretly observes, records or participates in the lesson;
• the student does not display private documents or unnecessary personal information;
• devices and accounts are reasonably secured.

Neither the provider nor the student may record, photograph, screenshot, transcribe or distribute a lesson without prior authorisation and a valid legal basis.

If recording is proposed for feedback, training or another specific purpose, separate information and consent arrangements will be provided. A refusal to consent to optional recording will not prevent access to ordinary unrecorded lessons.

7. Where does the data come from?

Data may be obtained:

• directly from the student;
• from a parent, guardian or person making the booking;
• through website forms and the booking system;
• from payment, video-conferencing or scheduling providers;
• from communications with the provider;
• automatically from devices, cookies and security logs.

A person providing data about another individual confirms that they are authorised to do so and that the information is accurate.

8. Is providing data compulsory?

Information marked as required is necessary to process an enquiry, booking or payment.

Failure to provide required information may mean that the provider cannot accept the booking or deliver the service.

Consent for optional marketing, testimonials, publication of images or lesson recordings is not required to purchase ordinary lessons.

9. Who may receive the data?

Data may be disclosed or made accessible to:

• website hosting and technical-support providers;
• booking and scheduling platforms;
• payment processors and financial institutions;
• video-conferencing providers;
• email, cloud-storage and communication providers;
• accounting, tax, legal and professional advisers;
• fraud-prevention and cybersecurity providers;
• competent public authorities, courts or regulators where legally required;
• replacement teachers or authorised collaborators, only where applicable and with appropriate confidentiality and data-protection arrangements.

Current providers should be identified before publication:

Website hosting: [PROVIDER AND COUNTRY]
Booking platform: [PROVIDER AND COUNTRY]
Payment processor: [PROVIDER AND COUNTRY]
Video platform: [PROVIDER AND COUNTRY]
Email provider: [PROVIDER AND COUNTRY]
Cloud storage: [PROVIDER AND COUNTRY]
**