Privacy policy

1. Who is responsible for your data

• Controller: Noguera y Valdés, S.L. (single-member company), owner of Gándara International School
• Tax ID (NIF): B27829449
• Address: Lugar de Moureira, 1, Mañufe, 36388 Gondomar (Pontevedra), Spain
• Email: info@gandaraschool.com
• Phone: 986 369 778 and 676 367 580
• Data protection officer: Pablo Pazos Rey, pablo@gandaraschool.com

2. What data we process, why and on what legal basis

We process the data you give us (or, for your children, the data you give us as their mother, father or guardian) through the website, by email, by phone or on WhatsApp, and the minimum technical data of your visit to the website (section 2.10).

2.1. Enquiries and visit requests

• Data: name, email, phone and whatever you tell us in your message.
• Purpose: to reply to you and, if you ask, to arrange a visit to the school.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) of the General Data Protection Regulation, GDPR) or, if the enquiry is not about a place or a service, our legitimate interest in answering it (Art. 6(1)(f) GDPR).

If you write to us on WhatsApp, the conversation is end-to-end encrypted and WhatsApp Ireland Limited provides the service under its own terms and privacy policy. We only use the conversation to help you.

2.2. Applications for a place and open days

• Data: of the mother, father or guardian (name, email and phone) and of each child (name, date of birth, current school and year applied for), plus the expected start date, the services you are interested in, how you heard about us and your comments.
• Purpose: to handle the application for a place or the open day registration, contact you and, where appropriate, start the admission process.
• Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).

2.3. Re-enrolment (current families)

• Data: of the mother, father or guardian (name, email and phone) and of each pupil (name, date of birth, current year and next year), services chosen, payment method, amounts and comments, plus acceptance of the Educational Commitment.
• Purpose: to handle the re-enrolment, the reservation of the place and the services for the school year, and their invoicing and payment.
• Legal basis: performance of the contract for the educational service (Art. 6(1)(b) GDPR) and compliance with accounting and tax obligations (Art. 6(1)(c) GDPR).

2.4. Camps and birthday parties

• Data: of the person making the registration or booking (name, email and phone) and of the child (name and age), the dates, the options chosen and your comments.
• Health data: for camps, if you tell us about allergies, intolerances or special needs, we use this only to ensure the child's safety and care during the activity. For birthday parties, we ask you to tell us only which allergies there are and how many children have them, without names.
• Purpose: to handle the registration or booking, organise the activity and charge for it.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR). For health data in camp registrations, your explicit consent (Art. 9(2)(a) GDPR), which you give in a separate box on the form and can withdraw at any time; without it we cannot adapt the activity to those needs.

2.5. Complaints, suggestions and compliments

• Data: whatever you include in your message.
• Purpose: to handle it, reply to you and improve the service. We keep an internal record of complaints and how they were resolved.
• Legal basis: our legitimate interest in handling requests and improving the service (Art. 6(1)(f) GDPR) and, where applicable, compliance with consumer law (Art. 6(1)(c) GDPR).

2.6. School communications

• Data: name and email.
• Purpose: to keep you informed about the school, its activities and its events.
• Legal basis: if you are a school family, performance of the educational contract to keep you informed about school life (Art. 6(1)(b) GDPR); otherwise, your consent (Art. 6(1)(a) GDPR).
• You can stop receiving them at any time using the link in each email or by writing to info@gandaraschool.com.

2.7. Job applications

• Data: the data in your CV and any you give us during the selection process.
• Purpose: to assess your application for the position you applied for or, if you agree, for future vacancies.
• Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR) and, to keep your application for future vacancies, your consent (Art. 6(1)(a) GDPR).

2.8. Images of pupils on the website

Photos and videos showing pupils are published only with their family's authorisation (Art. 6(1)(a) GDPR). The authorisation can be withdrawn at any time by writing to info@gandaraschool.com and the image will be removed from the website.

2.9. Cookies and advertising measurement

The website only uses advertising cookies (Google Ads) if you accept them in the cookie notice, for the sole purpose of finding out which ads bring us visit requests (Art. 22(2) of Spanish Law 34/2002, LSSI, and Art. 6(1)(a) GDPR). They are not used to show you personalised ads. You can change your choice at any time in Cookie settings, where you will also find details of each cookie and how long it lasts.

2.10. Technical browsing data

• Data: IP address, browser, page requested and time of the request.
• Purpose: to serve the website, make the forms work and protect them against abuse. Our hosting and forms providers (Netlify and Supabase) record this data.
• Legal basis: our legitimate interest in the operation and security of the website (Art. 6(1)(f) GDPR).

3. Children's data

This website is intended for adults. Children's data is provided by their mother, father or guardian, who confirm that they hold parental responsibility or guardianship and are authorised to provide it. We do not collect data directly from children under fourteen (Art. 7 of Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights).

4. Do you have to provide the data?

The fields marked as required on each form are needed to handle your request; if you do not provide them, we cannot process it. Health information is optional, but without it we cannot adapt the activity to the child's needs.

5. How long we keep the data

After these periods, the data is deleted or anonymised.

6. Who we share the data with

We do not sell or disclose your data. We only share it with public authorities when required by law (for example, the Consellería de Educación of the Xunta de Galicia, the Spanish Tax Agency or the courts) and with the banks that handle payments.

In addition, the following providers work with the data on our behalf, under a contract that requires them to protect it and to use it only for the tasks we give them:

• Netlify, Inc. (United States): website hosting.
• Supabase Pte. Ltd. (Singapore): database for the forms, stored in the European Union (Frankfurt, Germany).
• Google Cloud EMEA Limited (Ireland), with Google Workspace for Education: email and documents.
• Plus Five Five, Inc. (Resend, United States): sending confirmation emails, internal notifications with the form data and school communications.
• Our accounting, tax and employment advisers.

If you accept advertising cookies, Google receives the measurement data explained in the cookie notice and processes it as an independent controller, under its privacy policy. The website also loads its fonts from Google Fonts, so your browser sends your IP address to Google when you visit it. The video on the “About Us” page only loads if you press play; from then on, the terms of YouTube (Google) apply.

7. International transfers

Some providers are outside the European Economic Area or may access the data from outside it. In those cases, the transfer is covered as follows:

• Netlify and Resend (United States) and Google (a group whose parent company is in the United States): by their participation in the EU-US Data Privacy Framework, which the European Commission considers adequate, and by the standard contractual clauses approved by the Commission that are included in their contracts.
• Supabase (Singapore): the data is stored in the European Union; any access from outside it is covered by the standard contractual clauses in its data processing agreement.

8. Your rights

You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting the lawfulness of processing carried out before. To do so, write to pablo@gandaraschool.com stating which right you wish to exercise; if we cannot identify you, we will ask you to prove your identity. We will reply within one month.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency, after contacting our data protection officer first if you wish.

We do not make decisions based solely on automated processing, nor do we create profiles.

9. Security

We apply technical and organisational measures appropriate to the risk to protect your data: access limited to the staff who need it, encrypted communications and providers that comply with the GDPR.

10. Changes to this policy

We may update this policy when our processing or the law changes. The current version is always the one published on this page, with the date of its last update.