Privacy Policy
Last Updated: December 2025
1. Data Controller
Welcome English School ("we", "us", or "our") is the data controller responsible for your personal data. We operate the LingoLugo platform and services.
Contact Details:
Welcome English School
Calle Conde 24
27001 Lugo, Spain
Email: info@lingolugo.com
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Name - to personalise your learning experience
- Email address - for account access and communications
- Password - stored securely using encryption (we never see your actual password)
- Date of birth - to verify you meet our minimum age requirement (14 years in Spain)
2.2 Learning Data
As you use our services, we collect:
- Exam answers and scores
- Writing submissions
- Progress and completion data
- Teacher feedback and corrections
2.3 Voice Recordings (With Your Consent)
For speaking practice exercises, we collect voice recordings. This requires your explicit consent, which you can withdraw at any time through your profile settings.
- Recordings are stored securely on EU-based servers
- Your teacher may listen to provide feedback
- Recordings are automatically deleted after 90 days
- You can delete individual recordings at any time
2.4 Technical Data
We automatically collect:
- IP address (anonymised for analytics)
- Browser type and version
- Device information
- Pages visited and time spent
2.5 Demo Requests & Sales Enquiries
If you request a demo of LingoLugo for your school (for example through the form on our "For Schools" page), we collect the details you provide so that we can respond and set up your demo:
- Your name, work email, and role
- Any message you choose to send us (which may include details about your school)
- A record of the terms you accepted and when (see Section 3)
We use this information only to verify the request, contact you about the demo, and provide you with demo access. The lawful basis is our taking steps at your request prior to a possible contract, and our legitimate interest in responding to business enquiries. We keep demo-enquiry records for as long as needed to follow up, and routinely remove enquiries that do not progress.
Marketing about LingoLugo. Because you've contacted us about using LingoLugo at your school, we may also send you occasional emails about our own platform — product updates, tips, and offers. We rely on our legitimate interest in marketing our own, similar services to people who have enquired about them. We will never share or sell your details to anyone else, or market other companies' products to you, and you can opt out at any time using the unsubscribe link in any such email or by contacting us.
3. Legal Basis for Processing
Under GDPR, we process your data based on:
| Data Type | Legal Basis | GDPR Article |
|---|---|---|
| Account information | Contract performance - necessary to provide our services | Art. 6(1)(b) |
| Learning data | Contract performance - core to the educational service | Art. 6(1)(b) |
| Voice recordings | Consent - you explicitly agree before recording | Art. 6(1)(a) |
| Analytics cookies | Consent - managed through our cookie banner | Art. 6(1)(a) |
| Essential cookies | Legitimate interest - necessary for website function | Art. 6(1)(f) |
| Demo requests & sales enquiries | Pre-contractual steps at your request / legitimate interest in responding to enquiries | Art. 6(1)(b) / 6(1)(f) |
| Marketing emails (our own services) | Legitimate interest in direct marketing of our own similar services, with opt-out at any time | Art. 6(1)(f) |
4. How We Use Your Information
- Providing and personalising our language learning services
- Processing your exam submissions and providing feedback
- Enabling teacher review of your speaking and writing exercises
- Sending service-related communications (account updates, feedback notifications)
- Improving our platform based on usage patterns
- Preventing fraud and ensuring platform security
- Complying with legal obligations
5. Data Retention
We keep your data only as long as necessary:
| Data Type | Retention Period |
|---|---|
| Account information | Until you delete your account, plus 30 days for backup recovery |
| Learning progress & scores | Duration of your account |
| Voice recordings | 90 days from submission, or until you delete them |
| Writing submissions | Duration of your account |
| Payment records | 7 years (Spanish tax law requirement) |
| Analytics data | 26 months (anonymised) |
6. Third-Party Services
We use carefully selected third-party services to operate our platform:
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Amazon Web Services (AWS S3) | File storage (voice recordings) | Audio files | EU (Ireland) |
| MongoDB Atlas | Database hosting | Account and learning data | EU |
| Stripe | Payment processing | Payment details (we don't store card numbers) | EU with US processing |
| Google Analytics 4 (via Google Tag Manager) | Website analytics — only after you accept analytics cookies | Anonymised usage data | US (with EU data controls) |
| Microsoft Clarity | Usage analysis (anonymised session replays and heatmaps) — only after you accept analytics cookies | Interaction data (clicks, scrolling, pages visited) | US/EU (Microsoft Azure) |
| Google Ads | Measuring our own advertising campaigns (conversion attribution) — only after you accept advertising cookies | Ad-click and conversion data | US (with EU data controls) |
| Google Sign-In | Account authentication | Email, name (if you choose this login method) | US |
| Render | Web hosting | Website traffic | US with EU options |
7. International Data Transfers
Some of our service providers are based outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) - approved by the European Commission
- EU-US Data Privacy Framework - for US providers that are certified
- Adequacy decisions - where the destination country has been deemed adequate by the EU
8. Your Rights
Under GDPR, you have the following rights:
- Right to Access - Request a copy of all data we hold about you
- Right to Rectification - Correct any inaccurate information
- Right to Erasure - Request deletion of your data ("right to be forgotten")
- Right to Restrict Processing - Limit how we use your data
- Right to Data Portability - Receive your data in a machine-readable format
- Right to Object - Object to processing based on legitimate interests
- Right to Withdraw Consent - Withdraw consent at any time (e.g., for voice recordings)
To exercise any of these rights, contact us at info@lingolugo.com. We will respond within 30 days.
9. Right to Complain
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency:
Agencia Espanola de Proteccion de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Website: www.aepd.es
Phone: +34 901 100 099
10. Children's Privacy
In accordance with Spanish law (LOPDGDD), our services are available to users aged 14 and above. Users under 14 require parental or guardian consent. If you believe we have collected data from a child under 14 without proper consent, please contact us immediately.
11. Cookies
We use cookies to improve your experience. Analytics cookies (Google Analytics 4 and Microsoft Clarity) and advertising cookies (Google Ads) are only set after you accept them in our cookie banner — each purpose can be granted separately — and until then, or if you decline, none are stored. You can change or withdraw your choice at any time using the "Cookie preferences" link in the footer of every page. For the full list of cookies and durations, see our Cookie Policy.
12. Data Security
We implement appropriate security measures including:
- Encryption of data in transit (HTTPS/TLS)
- Secure password hashing
- Regular security updates
- Access controls and authentication
- Regular backups
While we take reasonable precautions, no method of transmission over the Internet is 100% secure.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Posting a notice on our website
- Sending an email to registered users (for material changes)
- Updating the "Last Updated" date at the top of this page
14. Contact Us
For any questions about this Privacy Policy or our data practices, please contact:
Welcome English School
Calle Conde 24
27001 Lugo, Spain
Email: info@lingolugo.com