PRIVACY POLICY – EXTENDED INFORMATION

SEPTEMBER 2026 VERSION

The Privacy Policy forms part of the General Terms and Conditions governing the following websites

• https://ispschools.es/
• https://britishschoolmalaga.com/
• https://britishschoolvilareal.com/
• https://altillointernational.com/
• https://fontenebroschool.com/
• https://internacionalaravaca.edu.es/
• https://ladyelizabethschool.com/
• https://laudesanpedro.com/
• https://newtoncollege.es/
• https://palaciodegranda.com/
• https://britishschoolalmeria.com/

In accordance with applicable data protection regulations (Regulation (EU) 679/2016, General Data Protection Regulation, and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights), you are informed as follows:

Who is the controller responsible for the processing of the data?

COLEGIOS LAUDE, S.L.U.

Av. De Europa 24. Puerta A, Bajo A. Edificio Torona (28108 Madrid)

 NIF: B84600188

Telephone: 686 090 053

Data Protection Officer: dpo.external@ispschools.com.

You may contact us by any means to communicate with us.

We reserve the right to modify or adapt this Privacy Policy at any time. We recommend that you review it periodically, and if you have registered and access your account or profile, you will be informed of any changes.

If you belong to any of the following groups, please consult the relevant information below:

• Website or email contacts.

 What data do we collect through the Website?

If you visit the website, we may process your IP address, the operating system or browser you use, and even the duration of your visit, on an anonymous basis. If you provide us with data through the contact form, we will process your identification data and any data you share with us in the form in order to contact you through the means provided, such as email, telephone calls or WhatsApp.

For what purposes will we process your personal data?

To manage the requested service, respond to your request or process your application.

What is the legal basis for the processing of your data?

The consent of the user or the existence of a contractual relationship between the parties.

For how long will we keep your personal data?

For as long as you remain linked to us or until you exercise a right that entails the deletion of your data.

• Processing of data of users of the Educational Platforms.

 What data do we process?

We may process your identification, contact and academic data, information relating to permissions, grades, etc., all depending on your user profile (student, parent, guardian, teacher, etc.)

For what purposes?

The data included in the educational platforms will be processed by the Controller for the purpose of managing the relationship the School has with each User, depending on their profile.

What is the legal basis?

The existence of a contractual relationship between the parties.

For how long will we keep the data?

For the duration of the contractual relationship and, once it has ended, for the legal limitation periods established for the exercise of legal actions.

• Social Media contacts.

 What data do we process?

We will process your identification data and the data you share with us within the framework of the relevant social network.

For what purposes will we process your personal data?

To manage the requested service, respond to your requests, or process your applications. To create, foster and maintain a community of followers within the social network.

What is the legal basis for the processing of your data?

The consent of the user or the existence of a contractual relationship between the parties. In this case, the processing is based on acceptance of a contractual relationship within the environment of the relevant social network, and in accordance with its Privacy Policies, so it is advisable for the user to consult them. The controller may only consult or unsubscribe data in a restricted manner, as it has a specific profile. This data will be processed for as long as the user allows through the various interactions that each social network permits. Any rectification of data or restriction of information or posts must be carried out by the user through their profile settings on the social network itself.

For how long will we keep your personal data?

For as long as you remain linked to us or until you exercise a right that entails the deletion of your data.

• Processing of CV data of candidates, job/internship applicants.

 What data do we process?

The controller will collect data from candidates through its employment portal accessible from its website. It will process the identification, contact, academic and professional data that the candidate includes when submitting their application.

For what purposes?

• • Organisation of selection processes for the recruitment of employees.
  • Scheduling of job interviews and evaluation of applications.

 What is the legal basis for the processing?

The legal basis for the processing described is the existence of a pre-contractual relationship between the parties.

For how long will we keep your data?

One year after receipt of a curriculum vitae, the controller will proceed to its secure destruction.

WHISTLEBLOWING MAILBOX

  What data do we process?

 The data you share with us in your report and, should you decide not to make an anonymous report, your identification and contact data.

For what purposes?

The personal data collected through the information channel is processed for the sole purpose of processing the communications or information received, sending the reporting person the relevant communications on the status of processing or the results thereof, unless they have objected to this; and, where appropriate, carrying out all actions aimed at verifying the plausibility of the facts reported in order to determine whether to close the file, adopt the relevant measures, or refer it to the competent authority in each case.

What is the legal basis?

Compliance with a legal obligation.

For how long will we keep the data?

All personal data that may have been communicated and that relate to conduct not covered by the scope of the law will be deleted immediately. If the information received contains personal data included within special categories of data, it will be deleted immediately, without being recorded or processed, as will any information provided, or part of it, in the event that it is shown not to be truthful, from the moment such circumstance becomes known, unless such lack of truthfulness may constitute a criminal offence, in which case the information will be kept for as long as necessary while the judicial proceedings are ongoing.

Data that is processed is kept in the information system only for the time strictly necessary to decide on the appropriateness of initiating an investigation into the reported facts. This period may not exceed three months from receipt of the information, unless, due to its particular complexity, the period has been extended by a further three months. Communications that have not been acted upon are kept in anonymised form. Where it is agreed to initiate the relevant investigation, the data will be processed for as long as the investigation lasts. A register of information is kept available to the competent judicial authorities in accordance with the requirements and limits established in Law 2/2023. Under no circumstances will data be kept for a period exceeding ten years.

• Smoothwall

 What data do we process?

We will process your identification data and, should a potential threat be detected, the data captured by the application.

For what purposes will we process your personal data?

To safeguard the moral integrity of students and to enforce the ethos of Colegios Laude S.L.U.

What is the legal basis for the processing of your data?

For staff, the existence of a contractual relationship between the parties, understood within the framework of the employer’s management powers established under the Workers’ Statute, and for students, the public interest in guaranteeing the best interests of the minor.

For how long will we keep your personal data?

For as long as the investigation into the potential threat is being processed.

• OTHERS

 Processing of third parties’ data.

As a general rule, the Controller will only process data provided by the data subjects themselves. Should it receive data from third parties, it must first inform such persons and request their consent, or otherwise Colegios Laude, S.L.U. shall be exempt from any liability for failure to comply with this requirement.

Commercial communications by electronic means

Should the user have previously given their express consent to this, or where this is covered by the controller’s legitimate interest, communications of interest will be sent to the email address provided.

Security measures

Colegios Laude, S.L.U. places great importance on the security of all personally identifiable information and has adopted an optimal level of security, putting in place the resources and adopting the technical and organisational measures appropriate to the state of the art in technology to prevent the loss, misuse, alteration, unauthorised access to, or theft of personal data. For example, our security and privacy policies are reviewed periodically and improved as necessary, and only authorised staff have access to user information. At Colegios Laude, S.L.U. we make efforts and dedicate resources to improving our pages and their functionalities every day so that users can browse safely.

Disclosure to third parties

Users’ personal data may be disclosed to:

• The Spanish State Tax Administration Agency, International School Partnership Ltd and banks and financial institutions for the collection of payment for the service, and other public administrations with jurisdiction in the matter by virtue of the nature of the entity and the services provided, for the correct fulfilment of the Controller’s legal obligations.
• Data processors necessary for the provision of the service, who will have signed a service provision contract obliging them to maintain the same level of privacy as the controller.

International transfers

Colegios Laude, S.L.U. is part of International School Partnership Ltd, an international education group headquartered in the United Kingdom. For this reason, data transfers to the United Kingdom will take place, carried out under the European Commission’s Adequacy Decision, which recognises that the United Kingdom ensures a level of data protection equivalent to that required under European regulations.

Additionally, the use of certain digital tools and platforms necessary for the provision of the service may involve your data being processed outside the European Economic Area (EEA). Where this occurs, such transfers will always be carried out ensuring an adequate level of protection, through the mechanisms provided for under European data protection regulations (such as the Standard Contractual Clauses approved by the European Commission or other equivalent safeguards recognised by the General Data Protection Regulation), so that your rights and freedoms remain protected regardless of the country in which the data is located.

User rights

Data protection regulations grant the user a series of rights, which must be honoured by the Controller:

• To know whether or not your data is being processed.
• To access the personal data being processed.
• To request the rectification of data if it is inaccurate.
• To request the deletion of data if it is no longer necessary for the purposes for which it was collected, or if you withdraw the consent given.
• To request the restriction of the processing of data, in certain cases, in which case it will only be kept in accordance with applicable regulations.
• To data portability, whereby data will be provided in a structured, commonly used or machine-readable format; or may be sent to the newly designated controller. This is only valid in certain cases.
• To lodge a complaint with the Spanish Data Protection Agency or the competent supervisory authority.
• To withdraw consent for any processing to which you had consented, at any time.

To facilitate this process, and in compliance with the principle of data accuracy, if any data is amended, the Controller would appreciate being informed of such amendment.

To exercise the aforementioned rights, the user may request a form from the controller, or use those prepared by the Spanish Data Protection Agency or third parties. Forms may be submitted in person, sent by post, or by email to the address of the Data Protection Officer: dpo.external@ispschools.com

Depending on the right exercised, the Controller will take a maximum of one month to respond from receipt of the request, and two months if the matter is highly complex, in which case the user will be notified.

In addition, we inform you that you may always turn to the Spanish Data Protection Agency (www.aepd.es) to request its protection or to lodge a complaint in relation to the processing of personal data.

Cookies

The Website uses Cookies. If you wish to obtain further information, you may do so by accessing our Cookies Policy.

Changes to the Privacy Policy

The Controller may modify or adapt the Privacy Policy and the Processing of Personal Data, so we recommend that you check it periodically to stay up to date.