1. Overview
At Spanish Boutique, we are committed to protecting the privacy of our adult students. This Privacy Policy explains what personal information we collect, how we use it, and your rights under data protection law (the UK GDPR and the Data Protection Act 2018).
2. Data Controller
For the purposes of data protection legislation, the Data Controller is Spanish Boutique, contactable at contact@spanish-boutique.com or through the contact form on this site.
3. Personal Data We Collect
- Your account: your name, email address and, if you sign in with Google, your profile picture. If you sign up with an email address and password instead, your password is stored only in hashed form.
- Your use of the service: your bookings, your time zone, your settings and your class credit balance.
- Payments: subscriptions and extra classes are paid through Stripe. We receive a record of what you bought and its status; we never see or store your card details.
- Security: while you are signed in, we record the IP address and browser of each session, so that you can review your active sessions and so that we can protect your account.
- Messages: when you write to us through the contact form, your name, email address and message are sent to us by email.
4. How and Why We Use Your Data
We process your personal data on the following lawful bases:
- Performance of a Contract: to run your account, take payment, schedule your classes, send you booking confirmations, calendar invitations and reminders, and deliver your live Spanish lessons.
- Legitimate Interests: to answer your messages, follow up on feedback, keep the website secure and prevent abuse.
- Legal Obligation: to keep financial records required for tax and accounting purposes (for example, reporting income to HMRC).
We do not use your data for advertising or profiling.
5. Who We Share It With
We do not sell or rent your personal information. We share only what each of these service providers needs to do its job:
- Stripe, to process payments.
- Google, which hosts the live classes on Google Meet and the sign-in with Google. When you join a class, Google processes your participation under its own privacy policy.
- Resend, which delivers our emails.
- Our hosting and database providers, which run the website and store its data.
Some of these providers are based outside the UK, including in the United States. Where your data is transferred abroad, it is protected by the safeguards UK law requires, such as the UK International Data Transfer Addendum or the UK–US Data Bridge.
6. Data Retention
We keep your account data for as long as your account exists. You can delete your account at any time from your settings: this cancels any active subscription and erases your account data from our database. Invoices and payment records, held in our Stripe account, are kept for as long as tax and accounting rules require (typically six years after the end of the financial year they relate to).
7. Your Rights
Under data protection law, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we process it;
- receive your data in a portable format.
To exercise any of these rights, write to us at contact@spanish-boutique.com or through the contact form on this site. We will reply within one month. If you believe your data has been handled incorrectly, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.