Privacy Policy

This privacy policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data (GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), as well as, where not contrary to the aforementioned regulations, Organic Law 15/1999 on the Protection of Personal Data (LOPD) and its implementing regulations, and/or any regulations that may replace or update them in the future.

Our organisation is committed to ensuring the privacy of your personal data. The personal data provided is necessary to provide our services and is processed lawfully, fairly, and transparently, ensuring adequate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, by applying appropriate technical and organisational measures.

Through this document, we aim to provide you with transparent and fair information regarding the processing of your personal data carried out by this organisation.

I.- DATA CONTROLLER

IDENTITY: XABIA INTERNATIONAL COLLEGE, S.A. C.I.F. / N.I.F.: A03927571 ADDRESS: CTRA. CABO LA NAO, 21, 03730 XABIA (ALICANTE) TELEPHONE: 966472121 E-MAIL: primary@xabiainternationalcollege.com DATA PROTECTION OFFICER: dpo@procoden.es

II.- RECIPIENTS OF PERSONAL DATA

1.- The personal data provided will not be transferred unless specified in specific processing activities. 2.- Optionally, to contract cloud computing services and/or services for email communications and other related IT services, personal data may be:

Transferred to IT service companies located within the European Economic Area (EEA), or
Transferred to IT service companies outside the EEA under the Privacy Shield framework, ensuring adequate protection measures to guarantee data security. More information can be found at: https://www.privacyshield.gov/welcome 3.- Optionally, data may be transferred to government authorities and other organisations when required to comply with legal obligations.

III.- LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

For each specific processing activity of personal data, we will inform you of the legal basis that legitimises it.

IV.- RIGHTS

RIGHT OF ACCESS You have the right to obtain confirmation from the data controller on whether or not your personal data is being processed, and if so, the right to access your personal data and the following information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the data has been or will be disclosed, the retention period or criteria used to determine it, the right to request rectification or erasure of personal data, the right to restrict processing, the right to object to processing, the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), and information on the appropriate safeguards when data is transferred to third countries.

RIGHT TO RECTIFICATION You have the right to request the correction of your personal data if it is inaccurate, including the right to complete any incomplete data.

RIGHT TO ERASURE You have the right to request the deletion of your personal data when it is no longer necessary for the purpose for which it was collected or if the processing is otherwise unlawful, except when the data processing is necessary to comply with legal obligations or for the formulation, exercise, or defence of legal claims.

RIGHT TO RESTRICTION You have the right to request the restriction of processing of your personal data, meaning that, in certain cases, you can request us to temporarily suspend the processing or retain the data beyond the required time.

RIGHT TO WITHDRAW CONSENT You have the right to withdraw the consent you have provided at any time, as specified in the section "Exercise of Rights" or in specific processing activities such as commercial communications or newsletters. However, this right does not affect the legality of prior processing based on consent before its withdrawal.

RIGHT TO DATA PORTABILITY You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller when the processing is based on consent and carried out by automated means.

RIGHT TO OBJECT You have the right to object to the processing of your personal data based on our legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or for the formulation, exercise, or defence of legal claims.

RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY If you believe your personal data has been improperly processed, you may contact us or lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.agpd.es/portalwebAGPD/index-ides-idphp.php

EXERCISING YOUR RIGHTS You can exercise your rights by sending a letter to the postal address provided above or via email at primary@xabiainternationalcollege.com, attaching a copy of your ID, NIE, Passport, or equivalent document in both cases.

V.- PROCESSING OF PERSONAL DATA. GENERAL PROVISIONS

The personal data requested in each specific processing activity is appropriate, relevant, and limited to what is necessary in relation to the purposes for which they are processed, thus complying with the principle of data minimisation.

Providing the requested personal data is essential; failure to do so will result in our inability to provide the requested service.

The transfer of personal data, where applicable, is necessary for contract execution and maintenance or to comply with a legal obligation applicable to the data controller.

DIGITAL ASSISTANT – “CHATBOT” OR “ONLINE CHAT” If this website uses online chat software, provided as a self-service to offer users quick responses to common questions and to improve customer service, the following data will be processed during interactions with the chatbot: IP address and any personal data entered in the chatbot’s conversation function. This data will not be used to identify the visitor unless voluntarily provided. The legal basis for this processing is Article 6(1)(f) of the GDPR.

E-COMMERCE FORM Personal data will be processed to manage online purchases, process orders and returns, send delivery updates, manage payments, handle complaints, validate legal age for contracting, and for the formulation, exercise, or defence of legal claims. The legal basis for this processing is the explicit consent given when selecting “I have read and accept the privacy policy.” Personal data will be transferred to the transport company for order delivery and to payment service providers. Data will be retained unless consent is withdrawn or as required by law.

COMMERCIAL COMMUNICATIONS OR NEWSLETTER FORM Personal data will be processed to manage newsletter subscriptions and send personalised or general information about our products or services via various channels such as phone, email, SMS, or mobile applications. Data analysis may be conducted to determine user preferences. Consent for this processing is given when selecting “I have read and accept the privacy policy.” Users can unsubscribe via links provided in communications. If WhatsApp is used, data will be transferred to WhatsApp Ireland Limited within the EEA. Data will be retained until consent is withdrawn.

IMAGES/PHOTOGRAPHS Personal data will be processed to manage authorisation for capturing images/photographs of individuals or groups during activities. Images may be published on the website, social media, and other communication channels only if the individuals are over 18 years old. For minors, images will be used internally. The legal basis is explicit consent given through a signed authorisation form. Data will be retained until consent is withdrawn.