1. Identity of the Data Controller

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter "GDPR") and Ley Orgánica 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (hereinafter "LOPDGDD"), the following information is provided regarding the entity responsible for processing your personal data:

• Business name: Escuela de Wok
• Address: Calle Tutor 42, Madrid, Spain
• Email: info@escueladewok.com
• Website: www.escueladewok.com

Escuela de Wok acts as Data Controller in respect of all personal data collected through this website and in the context of the services it provides.

2. Personal Data We Collect

Depending on how you interact with our website and services, we may collect and process the following categories of personal data:

2.1 Data provided directly by you

• Identification data: full name, national identity document number (where legally required).
• Contact data: email address, telephone number, postal address.
• Reservation and enrollment data: course selection, preferred dates and times, number of participants.
• Health and dietary data: food allergies, intolerances, and relevant medical conditions disclosed voluntarily for safety purposes.
• Billing data: payment card details (processed exclusively by our certified payment provider), billing address, and fiscal identification number where an invoice is requested.

2.2 Data collected automatically

• Technical data: IP address, browser type and version, operating system, referring URLs, and pages visited on our website.
• Cookie data: session and preference cookies as described in our Cookie Policy.

We do not collect special categories of personal data (as defined in Article 9 GDPR), except for health and dietary information voluntarily disclosed by users for safety purposes, which is processed strictly on the basis of explicit consent and solely to protect the vital interests of participants.

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, each resting on a specific legal basis under Article 6 GDPR:

3.1 Management of course enrollment and service delivery

Purpose: to process your reservation, confirm your place, send booking confirmations, provide pre-class information, and deliver the course.

Legal basis: performance of a contract to which you are party (Article 6(1)(b) GDPR).

3.2 Billing and fiscal obligations

Purpose: to issue invoices, process payments, and comply with Spanish fiscal and accounting obligations.

Legal basis: compliance with a legal obligation applicable to the controller (Article 6(1)(c) GDPR); specifically, obligations under Ley 37/1992 (IVA) and the Spanish Commercial Code.

3.3 Health and safety management

Purpose: to accommodate dietary requirements and manage participant safety during classes.

Legal basis: explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR) and protection of vital interests (Article 9(2)(c) GDPR).

3.4 Communication and customer service

Purpose: to respond to queries, complaints, or requests submitted through our contact channels.

Legal basis: legitimate interest of the controller in maintaining effective communication with users (Article 6(1)(f) GDPR).

3.5 Marketing and promotional communications

Purpose: to send newsletters, promotional offers, and information about new courses, where you have provided your consent.

Legal basis: consent (Article 6(1)(a) GDPR). You may withdraw consent at any time by clicking "unsubscribe" in any communication or by contacting us at info@escueladewok.com. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

3.6 Website analytics and improvement

Purpose: to analyse website traffic and user behaviour in aggregate form in order to improve the functionality and content of our website.

Legal basis: legitimate interest (Article 6(1)(f) GDPR), balanced against users' privacy interests and subject to cookie consent where applicable.

4. Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal retention obligations:

• Enrollment and contract data: retained for the duration of the contractual relationship and for a period of 5 years thereafter, in accordance with Spanish civil and commercial law.
• Fiscal and billing data: retained for a minimum of 10 years from the date of the last transaction, as required by Spanish tax law (Ley General Tributaria).
• Health and dietary data: retained for the duration of the course and deleted within 30 days of its conclusion, unless a longer period is required for legal claims.
• Marketing communications data: retained until you withdraw consent or opt out.
• Website analytics data: retained in anonymised or aggregated form indefinitely; individual IP logs are deleted after 13 months.

Upon expiry of the applicable retention period, data will be securely deleted or anonymised.

5. Recipients and International Transfers

Escuela de Wok does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties strictly for the purposes described in Section 3:

• Payment processors: certified payment service providers operating under PCI DSS standards, acting as independent data controllers for payment processing.
• Email service providers: platforms used to send booking confirmations and, where applicable, marketing communications, acting as data processors under a data processing agreement.
• Website hosting and IT service providers: acting as data processors under appropriate contractual safeguards.
• Public authorities: where disclosure is required by applicable law, court order, or regulatory requirement.

All third-party service providers engaged by Escuela de Wok are required to process personal data solely on our documented instructions and to maintain appropriate technical and organisational security measures.

We do not transfer personal data to countries outside the European Economic Area (EEA). Should any such transfer become necessary in the future, it will be carried out only in accordance with Chapter V of the GDPR, using appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

6. Your Rights as a Data Subject

Under the GDPR and LOPDGDD, you have the following rights in relation to your personal data:

• Right of access (Article 15 GDPR): you may request confirmation of whether we process your personal data and obtain a copy of such data.
• Right to rectification (Article 16 GDPR): you may request the correction of inaccurate or incomplete data.
• Right to erasure / 'right to be forgotten' (Article 17 GDPR): you may request the deletion of your data when it is no longer necessary for the purposes for which it was collected, among other grounds.
• Right to restriction of processing (Article 18 GDPR): you may request that we limit the processing of your data in certain circumstances.
• Right to data portability (Article 20 GDPR): you may receive a copy of the data you have provided to us in a structured, commonly used, and machine-readable format.
• Right to object (Article 21 GDPR): you may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making: you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, please submit a written request to info@escueladewok.com, including your full name and a copy of your national identity document or equivalent for identity verification purposes. We will respond within one calendar month of receipt of your request, as required by Article 12 GDPR.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos – AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, if you consider that the processing of your data infringes applicable data protection law.

7. Security Measures

Escuela de Wok implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 GDPR. These measures include:

• Encrypted data transmission via HTTPS/TLS protocols.
• Access controls restricting data access to authorised personnel only.
• Regular security assessments and staff training on data protection.
• Secure and certified third-party payment processing with no storage of full card details on our systems.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware of the breach, and affected individuals without undue delay, in accordance with Articles 33 and 34 GDPR.

8. Cookies

Our website uses cookies and similar tracking technologies. A cookie is a small text file stored on your device when you visit a website. We use the following types of cookies:

• Strictly necessary cookies: required for the website to function. No consent is required for these.
• Analytical/performance cookies: used to understand how visitors interact with our website. These require your consent.
• Marketing cookies: used to deliver relevant promotional content. These require your consent.

You may manage your cookie preferences through our cookie consent banner or through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For full details, please refer to our Cookie Policy.

9. Minors

Our website and services are not directed at children under the age of 14. We do not knowingly collect personal data from children under 14 without verified parental or guardian consent, as required by Article 8 GDPR and Article 7 LOPDGDD. If we become aware that we have inadvertently collected data from a child under 14 without appropriate consent, we will delete such data promptly.

For participants aged 14 to 16, enrollment requires written consent from a parent or legal guardian, who will be considered the data subject for the purposes of rights exercise.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. The updated version will be published on our website with a revised effective date. We encourage you to review this Policy periodically. Where changes are material, we will endeavour to notify registered users by email.

11. Contact and Data Protection Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us at:

Escuela de Wok · Calle Tutor 42, Madrid, Spain · info@escueladewok.com