Privacy Policy
Last Updated: December 2025
1. Data Controller
Welcome English School ("we", "us", or "our") is the data controller responsible for your personal data. We operate the LingoLugo platform and services.
Contact Details:
Welcome English School
Calle Conde 24
27001 Lugo, Spain
Email: info@lingolugo.com
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Name - to personalise your learning experience
- Email address - for account access and communications
- Password - stored securely using encryption (we never see your actual password)
- Date of birth - to verify you meet our minimum age requirement (14 years in Spain)
2.2 Learning Data
As you use our services, we collect:
- Exam answers and scores
- Writing submissions
- Progress and completion data
- Teacher feedback and corrections
2.3 Voice Recordings (With Your Consent)
For speaking practice exercises, we collect voice recordings. This requires your explicit consent, which you can withdraw at any time through your profile settings.
- Recordings are stored securely on EU-based servers
- Your teacher may listen to provide feedback
- Recordings are automatically deleted after 90 days
- You can delete individual recordings at any time
2.4 Technical Data
We automatically collect:
- IP address (anonymised for analytics)
- Browser type and version
- Device information
- Pages visited and time spent
3. Legal Basis for Processing
Under GDPR, we process your data based on:
| Data Type | Legal Basis | GDPR Article |
|---|---|---|
| Account information | Contract performance - necessary to provide our services | Art. 6(1)(b) |
| Learning data | Contract performance - core to the educational service | Art. 6(1)(b) |
| Voice recordings | Consent - you explicitly agree before recording | Art. 6(1)(a) |
| Analytics cookies | Consent - managed through our cookie banner | Art. 6(1)(a) |
| Essential cookies | Legitimate interest - necessary for website function | Art. 6(1)(f) |
4. How We Use Your Information
- Providing and personalising our language learning services
- Processing your exam submissions and providing feedback
- Enabling teacher review of your speaking and writing exercises
- Sending service-related communications (account updates, feedback notifications)
- Improving our platform based on usage patterns
- Preventing fraud and ensuring platform security
- Complying with legal obligations
5. Data Retention
We keep your data only as long as necessary:
| Data Type | Retention Period |
|---|---|
| Account information | Until you delete your account, plus 30 days for backup recovery |
| Learning progress & scores | Duration of your account |
| Voice recordings | 90 days from submission, or until you delete them |
| Writing submissions | Duration of your account |
| Payment records | 7 years (Spanish tax law requirement) |
| Analytics data | 26 months (anonymised) |
6. Third-Party Services
We use carefully selected third-party services to operate our platform:
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Amazon Web Services (AWS S3) | File storage (voice recordings) | Audio files | EU (Ireland) |
| MongoDB Atlas | Database hosting | Account and learning data | EU |
| Stripe | Payment processing | Payment details (we don't store card numbers) | EU with US processing |
| Google Analytics | Website analytics | Anonymised usage data | US (with EU data controls) |
| Google Sign-In | Account authentication | Email, name (if you choose this login method) | US |
| Cookiebot | Cookie consent management | Consent preferences | EU |
| Render | Web hosting | Website traffic | US with EU options |
7. International Data Transfers
Some of our service providers are based outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) - approved by the European Commission
- EU-US Data Privacy Framework - for US providers that are certified
- Adequacy decisions - where the destination country has been deemed adequate by the EU
8. Your Rights
Under GDPR, you have the following rights:
- Right to Access - Request a copy of all data we hold about you
- Right to Rectification - Correct any inaccurate information
- Right to Erasure - Request deletion of your data ("right to be forgotten")
- Right to Restrict Processing - Limit how we use your data
- Right to Data Portability - Receive your data in a machine-readable format
- Right to Object - Object to processing based on legitimate interests
- Right to Withdraw Consent - Withdraw consent at any time (e.g., for voice recordings)
To exercise any of these rights, contact us at info@lingolugo.com. We will respond within 30 days.
9. Right to Complain
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency:
Agencia Espanola de Proteccion de Datos (AEPD)
C/ Jorge Juan, 6
28001 Madrid
Website: www.aepd.es
Phone: +34 901 100 099
10. Children's Privacy
In accordance with Spanish law (LOPDGDD), our services are available to users aged 14 and above. Users under 14 require parental or guardian consent. If you believe we have collected data from a child under 14 without proper consent, please contact us immediately.
11. Cookies
We use cookies to improve your experience. Our cookie banner (powered by Cookiebot) allows you to manage your preferences. For detailed information, see our Cookie Policy.
12. Data Security
We implement appropriate security measures including:
- Encryption of data in transit (HTTPS/TLS)
- Secure password hashing
- Regular security updates
- Access controls and authentication
- Regular backups
While we take reasonable precautions, no method of transmission over the Internet is 100% secure.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Posting a notice on our website
- Sending an email to registered users (for material changes)
- Updating the "Last Updated" date at the top of this page
14. Contact Us
For any questions about this Privacy Policy or our data practices, please contact:
Welcome English School
Calle Conde 24
27001 Lugo, Spain
Email: info@lingolugo.com