Privacy Policy

Last updated: 2026-08-15 · Version 3

1. Data controller

• Owner: Elena Glintchevskaia Glintchevskaia
• Tax ID (NIF): 02301550D
• Trading name: HTL Escuela de Empresa Online
• Address: Carrer Diputación 282, 08009 Barcelona, Spain
• Email: practicas@htlescueladeempresaonline.com
• Phone: +34 93 14 15 199 · +34 654 893 748
• Data Protection Officer (DPO): none appointed — the activity does not fall within the cases of GDPR Art. 37. For any data-protection matter, please use the contact details above.

2. Data we process

• Identification: first name, last name, date of birth, nationality, ID document (DNI/NIE/passport).
• Contact: email, postal address, phone.
• Academic: enrolled course, chosen language, Moodle progress, grades, certifications, and the messages you exchange with campus tutors (including the virtual tutor — see sections 8, 11 and 14).
• Company tutor data: first name, last name and work email of the tutor designated by the company in the internship annex, processed to create their campus account and send them the academic follow-up of the intern.
• Billing: company name, tax ID and fiscal address (for company customers).
• Payment: we do not store card data. Payments are processed directly by Stripe or PayPal.
• We do not process special categories of data (health, racial origin, political opinions, etc. — GDPR Art. 9).

3. Source of data

Data is collected directly from you when you fill in our forms. For enrollment via a corporate pack, some identification data may initially be provided by your employing company, which acts as the entity handling your registration. The company tutor's data is provided by the company itself when completing the internship annex.

4. Minimum age

This service is intended for users aged 18 or over. Stripe and PayPal require full legal age to use their payment methods, and signing the internship agreement requires full contractual capacity. Users aged 14 to 17 may only enrol in person, with written authorisation from the holders of parental authority.

5. Purposes of processing

• Manage your enrollment and internship agreement (convenio).
• Create and maintain your Moodle account.
• Issue invoices and meet tax and accounting obligations.
• Issue enrollment and completion certificates.
• Academic communications (reminders, deadlines, course completion).
• Academic support through virtual tutors — automated assistants powered by artificial intelligence that answer course-content questions via the campus messaging; queries the assistant cannot resolve are passed to the human team. The assistant always identifies itself as such.
• Live chat support (only if you opt in).
• Measure the effectiveness of our online advertising, i.e. which advert led to an enrollment (only if you accept optional cookies).

6. Legal basis

• Contract performance (GDPR art. 6(1)(b)): your enrollment is a contract for educational services.
• Legal obligation (art. 6(1)(c)): invoice retention under Spanish General Tax Law 58/2003 art. 66.
• Consent (art. 6(1)(a)): for non-essential cookies and for marketing communications when you are not a customer of ours.
• Legitimate interest (art. 6(1)(f)): platform security, fraud prevention and direct marketing to our own customers about services similar to those they contracted (GDPR recital 47; see section 15).

7. Consequences of not providing the data

The data requested is necessary to formalise your enrollment, issue invoices and manage the internship agreement. If you do not provide it, we cannot deliver the service.

8. Processors

We have data processing agreements (GDPR Art. 28) in place with the following providers:

• Stripe Payments Europe Ltd. (Ireland, with processing in the USA) — card payments.
• PayPal (Europe) S.à r.l. (Luxembourg, with processing in the USA) — PayPal payments.
• 123automate (seal.123automate.it and pdf.123automate.it services, hosted in the EU — Sweden and France) — PDF document generation and electronic sealing (PAdES) of internship agreements and annexes.
• Anthropic, PBC (USA) — automated generation of the virtual tutor's replies: the text of your messages to the tutor is sent to its API (Claude) to produce the answer. Under its data processing agreement, Anthropic does not use these messages to train its models.
• tawk.to inc. (USA) — live chat, only if you accept optional cookies.
• Google Ireland Ltd. / Google LLC (Ireland / USA) — advertising conversion measurement (Google Ads), only if you accept optional cookies.
• Raiola Networks S.L. (Spain) — web and Moodle hosting.
• Google Ireland Limited (Ireland, with processing in the USA) — advertising effectiveness measurement (Google Ads). Only if you accept optional cookies, we send the advert click identifier together with the date and amount of the enrollment, without your name, email or any other identifying data.

9. Disclosures to third parties

• Bank — to process wire transfers.
• Public authorities — Spanish Tax Agency and other bodies when required by a statutory rule.

10. Joint controllership (enrollment via company)

When a company enrols students through a corporate pack and views their progress from its company panel, the company and the controller act as joint controllers for the academic data visible to the company, in accordance with GDPR Art. 26. The relationship is governed by the agreement signed with the contracting company.

11. International transfers

Transfers to the United States (Stripe, PayPal, tawk.to, Google) rely on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework and, additionally, on Standard Contractual Clauses approved by the European Commission.

The transfer to Anthropic, PBC (USA, virtual tutor) relies on the Standard Contractual Clauses approved by the European Commission (GDPR Art. 46(2)(c)), incorporated into its data processing agreement.

12. Retention period

• Active account: while the contractual relationship lasts.
• Invoices and tax data: 6 years from issuance (Spanish General Tax Law 58/2003 art. 66).
• Academic data and certificates: 5 years from course completion. After that period we keep only what is strictly necessary to issue duplicates on request.
• Cookie consent log: 3 years from the last user action.
• Record of account data changes: for the duration of the contractual relationship we keep the history of changes to your identifying data and your sign-in email (previous value, new value, date and who made the change), as proof of account traceability (legitimate interest, art. 6.1.f GDPR). Unconfirmed email-change requests expire after 3 days and are closed.
• Browser cookies: see Cookie Policy.

13. Your rights

You can exercise the following rights by emailing practicas@htlescueladeempresaonline.com or by postal mail to our address, including a copy of your ID document:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): delete your data when no longer necessary.
• Restriction: limit processing in certain cases.
• Objection: object to legitimate-interest-based processing.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent at any time (without retroactive effect).

You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

• Website: www.aepd.es
• Address: C/ Jorge Juan 6, 28001 Madrid, Spain
• Phone: 901 100 099 · 912 663 517

14. Automated decisions

We do not perform automated decision-making with legal effects concerning you or individual profiling. Internal progress statistics are aggregated and used solely to improve the service.

The virtual tutor generates its replies automatically using artificial intelligence, but it makes no decision with legal or similarly significant effects on you: it does not assess, grade or resolve requests. Any query requiring a decision is always passed to the school's human team.

15. Marketing communications

We send marketing emails in two cases, and only in those two:

• With your express consent, where you have given it (art. 21.1 of Spanish Law 34/2002 LSSI-CE).
• Without prior consent, where you are already a customer: if we obtained your details lawfully when you enrolled, signed an internship agreement or contracted anything else with us, and the message concerns our own services similar to those you contracted — our courses, the internship module and school news (art. 21.2 LSSI-CE). The legal basis is our legitimate interest in direct marketing to our own customers (GDPR art. 6(1)(f) and recital 47).

You can object at any time, free of charge and without giving reasons: through the unsubscribe link included in every message, or by writing to practicas@htlescueladeempresaonline.com with the subject «BAJA». Unsubscribing takes effect immediately and affects neither your enrollment nor any service you contracted.

Unsubscribing does not stop the emails needed to run your course or internship — signature invitations, invoices, course-ending notices, messages from your tutor: those are not marketing communications, they are part of the service.

We keep your contact details for this purpose until you object. We neither share nor sell your data to third parties for them to send you their own advertising.

16. Changes to this policy

If we modify this policy, we will notify you by email and ask for fresh consent where required. A version history is available on request.

See also: Cookie Policy · Legal Notice.