Privacy policy
Information for students and prospective students, in accordance with articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
1. Who processes your data
The data controller is Iberia Language Academy, S.L., CIF B75780593, Carrer d’Aragó 403-405, entresuelo 1, 08013 Barcelona.
For anything relating to the protection of your data, you can contact us at administracion@ilabarcelona.com or on (+34) 932 494 676.
2. What data we process
Depending on your relationship with the school, we process the following categories of data:
- Identification and contact data: name and surname, identity document, address, telephone number and email address.
- Academic data: level, course, attendance, grades and certificates.
- Billing and payment data.
- Emergency contact details.
- Where you provide them voluntarily, data on allergies, health conditions or specific learning needs, which are special categories and receive reinforced protection.
- Your image, only where you give express consent through the specific form.
- Browsing data: IP address, browser and device type, server logs, country of connection, and information collected by cookies and similar technologies, in accordance with the cookie policy.
3. Where we obtain your data
In most cases the data comes from you. The school obtains it in the following ways:
- From the forms on this website, when you request information, book a level test or enrol.
- From your direct contact with the school, when you call, write to us or visit in person.
- From your browser or device, automatically, in accordance with the cookie policy.
- From third parties, when you approach the school through a partner school, an education agency or a course portal, or when you respond to an advertisement on a social network.
Where data comes from a third party, the school receives only what is needed to deal with your enquiry, namely your contact details and the course you are interested in, and informs you of this processing in the first communication it sends you, in accordance with article 14 GDPR.
4. Purpose and legal basis
Each processing operation has a defined purpose and rests on a specific legal basis:
| Processing | Legal basis | Retention period |
|---|---|---|
| Enrolment and academic record | Performance of the teaching contract (art. 6.1.b) | Five years from the last enrolment |
| Handling information requests | Legitimate interest and pre-contractual steps (arts. 6.1.f and 6.1.b) | Twelve months from the last contact |
| Specific needs and learning support | Explicit consent (art. 9.2.a) | For the duration of the academic relationship |
| Invoicing and accounting | Legal obligation (art. 6.1.c) | Six years (art. 30 of the Commercial Code) |
| Issuing certificates | Performance of the contract (art. 6.1.b) | Ten years |
| Accommodation | Performance of the contract (art. 6.1.b) | Five years from the end of the stay |
| Informational and commercial communications | Revocable consent (art. 6.1.a) | Until you withdraw consent |
| Use of your image for promotional purposes | Explicit and revocable consent (art. 6.1.a) | Until you withdraw consent |
Once these periods end, the data is blocked under article 32 LOPDGDD and remains available only to judges, courts, the Public Prosecutor and the competent authorities for the limitation period of any actions arising. After that period it is securely erased or anonymised.
5. Who else has access to your data
To provide its services, the school works with suppliers who access personal data as processors, with whom it has signed the contracts required by article 28 GDPR: the firm Openges, for payroll, tax and accounting; the academic and commercial management platforms; the invoicing services and payment gateways; and the email and communication platforms. The full, current list is held by the school and available on request.
For accommodation, the necessary data is shared with the host family or shared flat, limited to what is essential for the service.
Some of these suppliers are located outside the European Economic Area, mainly in the United States. In those cases the transfer is covered by the standard contractual clauses approved by the European Commission, under article 46 GDPR.
Beyond these cases, the school does not share your data with third parties except where required by law.
6. Your rights
You may exercise the following rights at any time:
| Access | Find out what data of yours we process and obtain a copy. |
| Rectification | Correct inaccurate data or complete data that is missing. |
| Erasure | Ask for your data to be deleted when it is no longer necessary or when you withdraw your consent. |
| Restriction | Ask for processing to be suspended while a claim is checked. |
| Objection | Object to your data being processed on grounds relating to your particular situation. |
| Portability | Receive your data in a structured, commonly used format, or have it transmitted to another controller. |
| Withdrawal of consent | Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand. |
To exercise them, write to administracion@ilabarcelona.com stating the right you wish to exercise and attaching a copy of your identity document. The school responds within one month at most.
If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), the competent supervisory authority.
7. Use of your image
The school does not use photographs or recordings of you for informational, promotional or commercial purposes without your express written consent, which is requested through a specific form separate from the contract.
You may withdraw that consent at any time. From that moment your image is no longer used and, wherever possible, is removed from the school’s channels.
8. Information security
The school applies the technical and organisational measures required by article 32 GDPR: encryption of information, two-step verification on the platforms that support it, regular backups, access control by profile on a least-access basis, six-monthly review of permissions, and activity logging that ensures access can be traced.
All staff have signed a confidentiality undertaking and receive specific data protection training.
9. Cookies
This website uses its own and third-party cookies for its operation and for statistical analysis of visits. You can review the detail and set your preferences in the cookie policy, available on the website.
10. Links to other websites
This website may contain links to other pages of interest. Once you leave the school’s site through one of those links, the school no longer has control over the destination page and is not responsible for the protection or processing of any data you provide there. We recommend reviewing the privacy policy of each site you visit.
11. Validity and updates
The school reviews this policy once a year and whenever there is a change in its processing operations or in the applicable legislation. Changes are published on the website and, where substantial, communicated to students.
Last reviewed: August 2026.