PRIVACY POLICY

Last updated: 12/10/2026

1. Who is responsible for your personal data?

The data controller is:

Trading name: English with Mandy
Legal name: Mandy Wieser
Email address: contact@englishwithmandy.com

This Privacy Policy explains how personal data is processed when you visit englishwithmandy.com, contact English with Mandy, purchase or book a lesson or lesson package, attend an online lesson or otherwise use the services provided through this website.

2. Whose personal data may be processed?

Personal data may relate to:

• website visitors;
• prospective and current students;
• parents or legal guardians;
• persons purchasing lessons on behalf of another student;
• individuals who contact English with Mandy;
• suppliers and professional contacts.

Where lessons are provided to a minor, the booking, payment and contractual relationship should ordinarily be managed by a parent or legal guardian.

3. What personal data may be collected?

Only personal data reasonably necessary for the relevant purpose will be collected.

Depending on how you interact with English with Mandy, this may include the following categories.

Identification and contact data

This may include:

• name and surname;
• email address;
• telephone number;
• country or time zone, where necessary for lesson scheduling;
• account information where a customer account is created.

Booking and service data

This may include:

• lesson or service selected;
• lesson date and time;
• booking status;
• cancellations or rescheduling;
• lesson-package balance;
• attendance information;
• communications relating to the booking or service.

Student and educational information

Where necessary to provide the lessons, this may include:

• age or age range;
• English-language level;
• learning objectives;
• areas the student wishes to improve;
• lesson progress;
• homework or exercises;
• teacher notes;
• feedback relevant to the educational service.

Only information reasonably necessary to provide and adapt the teaching service will be processed.

Parent or guardian information

Where the student is a minor, information may include:

• name and contact details of the parent or guardian;
• relationship to the student;
• booking and payment information;
• communications concerning the student’s lessons.

Payment and transaction information

Where lessons or packages are purchased online, information may include:

• transaction reference;
• amount;
• currency;
• date;
• payment status;
• refund information;
• information necessary for invoicing or accounting.

Payments may be processed through an external payment provider.

Where card payments are processed directly by that provider, English with Mandy does not normally receive or store the complete card number or card security code.

Online lesson information

Where lessons are delivered using a video-conferencing service, information processed through that service may include:

• display name;
• email address;
• meeting information;
• audio and video transmitted during the lesson;
• information voluntarily shared during the lesson.

Lessons are not recorded by default.

If a lesson is to be recorded for any specific purpose, the student or, where appropriate, their parent or guardian will be informed in advance. Where legally required, separate consent will be requested.

Website and technical data

When the website is accessed, certain technical information may be processed automatically by the website, hosting provider or security systems, such as:

• IP address;
• browser and device information;
• operating system;
• date and time of access;
• security and server logs;
• information generated through cookies or similar technologies where applicable.

More information about cookies is available in the Cookie Policy.

Communications

English with Mandy may process communications such as:

• emails;
• contact-form submissions;
• lesson-related messages;
• requests;
• complaints;
• customer-support communications.

Optional marketing information

If a user voluntarily subscribes to marketing communications, English with Mandy may process:

• email address;
• marketing preferences;
• consent records;
• unsubscribe requests.

Marketing consent is not required to purchase or attend lessons.

4. Why is personal data processed?

Responding to enquiries

Personal data may be used to answer questions, provide information about lessons and respond to requests from prospective students.

Legal basis: taking steps at the request of the data subject before entering into a contract and, where applicable, legitimate interests in managing communications and enquiries.

Managing purchases and bookings

Personal data may be used to:

• create and manage customer accounts;
• process lesson or package purchases;
• manage bookings;
• manage available lesson balances;
• schedule, cancel or reschedule appointments;
• send booking confirmations and reminders.

Legal basis: performance of a contract or taking steps before entering into a contract.

Providing English lessons

Personal data may be processed to:

• prepare and deliver lessons;
• assess the student’s level and learning objectives;
• adapt teaching to the student;
• monitor lesson progress;
• provide educational feedback;
• communicate with students or their parents or guardians.

Legal basis: performance of the educational service contract.

Processing payments, invoices and refunds

Personal data may be processed to:

• collect payment;
• confirm transactions;
• manage refunds;
• issue invoices or other accounting records;
• comply with tax and accounting requirements;
• resolve payment disputes.

Legal basis: performance of a contract and compliance with legal obligations.

Providing online lessons

Personal data may be processed through a video-conferencing platform in order to establish the online lesson and allow communication between the teacher and student.

Legal basis: performance of the educational service contract.

Customer support and complaints

Personal data may be processed to:

• answer customer requests;
• investigate problems;
• manage complaints;
• resolve disputes;
• retain relevant evidence where necessary.

Legal basis: performance of a contract, compliance with legal obligations and legitimate interests in managing and defending legal claims.

Website operation and security

Technical information may be processed to:

• operate the website;
• maintain security;
• detect attacks or misuse;
• investigate technical problems;
• protect user accounts and information.

Legal basis: legitimate interests in maintaining a secure and functional website and, where applicable, compliance with legal obligations.

Service communications

English with Mandy may send communications necessary for the service, including:

• purchase confirmations;
• booking confirmations;
• reminders;
• Zoom or other lesson links;
• cancellations;
• rescheduling information;
• payment or refund notices;
• important changes affecting a booked service.

Legal basis: performance of the contract.

These communications are not marketing communications.

Marketing communications

Marketing emails or promotional communications will only be sent where legally permitted.

Where consent is used as the legal basis, the user may withdraw that consent at any time.

Legal basis: consent or another legal basis permitted by applicable electronic-marketing legislation.

Compliance with legal obligations

Personal data may also be processed where necessary to comply with:

• tax and accounting obligations;
• consumer-protection requirements;
• data-protection obligations;
• requests from competent public authorities;
• judicial or administrative requirements.

Legal basis: compliance with a legal obligation.

5. Data relating to minors

English with Mandy may provide English lessons to children and teenagers.

Bookings and payments for minors should ordinarily be made or authorised by a parent or legal guardian.

Only information reasonably necessary to provide the educational service should be collected from a minor.

Where processing relies specifically on consent:

• a person aged 14 or over may provide consent to the processing of their personal data where permitted by Spanish law;
• where the child is under 14, consent must be provided or authorised by the person holding parental responsibility or legal guardianship;
• this does not affect situations in which Spanish law requires parental or guardian involvement for the underlying legal act or contract.

Parents, guardians and students should avoid providing unnecessary information such as identity documents, financial information, passwords, private family information or other sensitive personal information during lessons.

A minor’s name, image, voice, testimonial, lesson recording or educational work will not be published for promotional purposes without the appropriate separate authorisation.

6. Sensitive personal data

English with Mandy does not normally require health information or other special-category personal data in order to provide ordinary English lessons.

Students and parents should therefore avoid providing this type of information unless it is genuinely necessary for the educational service or to arrange an appropriate accommodation.

Where special-category personal data must exceptionally be processed, it will only be processed where a valid legal basis under applicable data-protection law exists and, where required, explicit consent will be obtained.

7. Video lessons and recordings

Online lessons may be delivered through a third-party video-conferencing provider.

Students should:

• join using an appropriate device and internet connection;
• avoid displaying unnecessary personal information;
• keep meeting links private;
• take reasonable measures to protect their accounts and devices.

Lessons are not recorded as part of the ordinary service.

Neither English with Mandy nor the student should record or distribute a lesson without appropriate prior authorisation and a valid legal basis.

If recording is proposed for a specific purpose, such as educational feedback or promotional use, the relevant information will be provided separately before recording begins.

Refusing consent to an optional recording will not prevent access to ordinary unrecorded lessons.

8. Where does personal data come from?

Personal data may be obtained:

• directly from the student;
• from a parent or legal guardian;
• from the person purchasing a lesson;
• through contact forms;
• through the booking system;
• from payment or scheduling providers where necessary;
• through communications with English with Mandy;
• automatically from the website, hosting systems, security logs or cookies.

Where someone provides personal data relating to another person, they should ensure that they are authorised to provide that information.

9. Is providing personal data compulsory?

Certain information is necessary in order to respond to an enquiry, create an account, process a payment, make a booking or provide a lesson.

Where information is marked as required, failure to provide it may mean that English with Mandy cannot process the relevant request or provide the requested service.

Optional processing, such as marketing communications, testimonials, promotional images or optional lesson recordings, is not required in order to purchase ordinary lessons.

10. Who may receive personal data?

Personal data may be accessed, where necessary, by service providers supporting the operation of English with Mandy, including providers of:

• website hosting and technical services;
• booking and scheduling systems;
• payment processing;
• video conferencing;
• email and communications;
• cloud storage;
• cybersecurity and fraud prevention;
• accounting, tax, legal and other professional services.

These providers may act as data processors or, in some cases, as independent data controllers under their own legal obligations.

Personal data may also be disclosed to public authorities, courts, regulators or other competent bodies where disclosure is required by law.

Personal data is not sold to third parties.

11. International data transfers

Some technology providers used to operate the website or provide the services may process personal data outside the European Economic Area.

Where an international transfer of personal data takes place, it will only be carried out where a lawful transfer mechanism is available under applicable data-protection legislation.

Depending on the provider and destination, this may include:

• a European Commission adequacy decision;
• participation in an applicable recognised adequacy framework;
• Standard Contractual Clauses approved by the European Commission;
• another safeguard permitted by the GDPR.

Where applicable, additional safeguards will be used where necessary.

Information regarding the transfer mechanism applicable to a particular provider may be requested by contacting:

contact@englishwithmandy.com

12. How long is personal data kept?

Personal data will not be kept for longer than necessary for the purpose for which it was collected.

The applicable retention period will depend on the type of information and the reason for processing it.

In general:

• enquiry data will be kept for as long as necessary to respond to the enquiry and for a reasonable period afterwards where necessary for follow-up;
• customer, booking and lesson information will be retained for the duration of the customer relationship and, afterwards, for as long as reasonably necessary to manage possible claims or legal obligations;
• payment, invoicing and accounting information will be retained for the periods required by applicable tax, accounting and other legal obligations;
• complaint and dispute information may be retained for as long as necessary to resolve the matter and for the applicable limitation period;
• security logs will be retained only for the period reasonably necessary for security, troubleshooting and fraud-prevention purposes;
• marketing information processed on the basis of consent will normally be retained until consent is withdrawn or the user objects to receiving further communications.

When personal data is no longer required, it will be deleted, anonymised or securely blocked where applicable law requires information to be retained for possible legal responsibilities.

13. Your data-protection rights

Depending on the circumstances, individuals may exercise the following rights under applicable data-protection law:

• Right of access – to obtain confirmation as to whether personal data is being processed and access that data.
• Right to rectification – to have inaccurate or incomplete personal data corrected.
• Right to erasure – to request deletion of personal data where the legal requirements are met.
• Right to restriction of processing – to request that processing be restricted in certain circumstances.
• Right to object – to object to processing based on legitimate interests or to direct marketing.
• Right to data portability – to receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller.
• Right to withdraw consent – where processing is based on consent, consent may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are subject to the conditions and limitations established by applicable law.

14. How can you exercise your rights?

Requests concerning personal data may be sent to:

English with Mandy
Email: contact@englishwithmandy.com

The request should clearly identify the right the person wishes to exercise and provide sufficient information to identify the relevant data.

Where there are reasonable doubts concerning the identity of the person making the request, additional information may be requested solely to verify identity.

Requests will be handled in accordance with the time limits and requirements established by applicable data-protection legislation.

15. Right to lodge a complaint

If you believe that your personal data has been processed in breach of applicable data-protection law, you have the right to lodge a complaint with the competent supervisory authority.

For English with Mandy, the relevant Spanish supervisory authority is:

Agencia Española de Protección de Datos (AEPD)

You may contact the AEPD directly using the complaint procedures available through its official website.

This right does not prevent you from contacting English with Mandy first in order to try to resolve the matter directly.

16. Automated decision-making and profiling

English with Mandy does not make decisions that produce legal effects, or similarly significant effects, based solely on automated processing of personal data.

The website is not intended to create behavioural or educational profiles for automated decision-making purposes.

Third-party service providers, particularly payment or security providers, may use automated systems such as fraud-prevention tools in accordance with their own privacy policies and applicable law.

17. Cookies and similar technologies

The website may use cookies and similar technologies necessary for its operation and, where enabled, additional technologies for preferences, analytics or other purposes.

Non-essential cookies will only be used where permitted by applicable law and, where required, after obtaining the user’s consent.

Further information is available in the Cookie Policy and through the website’s cookie-management system.

18. Data security

English with Mandy takes reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• alteration;
• disclosure;
• destruction;
• misuse.

Access to personal data is limited to persons and service providers who reasonably require it for the purposes described in this Privacy Policy.

However, no internet-based service can guarantee absolute security.

19. Changes to this Privacy Policy

This Privacy Policy may be updated where necessary to reflect:

• changes to the services;
• changes to the booking or payment systems;
• new technology providers;
• changes in data-processing practices;
• changes in applicable law.

The current version will always be published on this website together with its last-updated date.

Material changes will be communicated where required by law.

20. Contact

For questions concerning this Privacy Policy or the processing of personal data, please contact:

English with Mandy
Legal name: Mandy Wieser
Email: contact@englishwithmandy.com