DATA PRIVACY NOTICE
School Directory Subscription

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 of April of 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and the Organic Law 3/2018 of December 5, 2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPD GDD), we inform you that the personal data provided in this form will be processed as follows:

​

Data Controller: Anya van der Drift - My Barcelona School (the “Provider”), NIE: Y2035820N 
Postal Address: Carrer Espinoi 11, 08023 Barcelona, Email: hello@mybarcelonaschool.com (hereinafter, “My Barcelona School”)

​

Purpose of Personal Data Processing for Directory Subscription and Related Services

​

For providing the subscription to the public Directory and related services, your personal data will be used for the following purposes:

​

1. Communications with the School Contact Person: To communicate and/or contact you, in your capacity as the staff contact person of the school or educational institution listed in our public Directory (hereinafter the “School Contact Person”), to manage the subscription to our public Directory and the additional services related thereto, including invoicing, statistical analysis and reporting, publication of your school in the public Directory, operation of the Public Directory, and promotional activities, inclusion in the Open Days and Events Calendar and publication on our social media platforms of your school’s participation and listing in the public Directory.

2. Subscription Management, Administrative and Legal Compliance: To manage, develop, execute and maintain the subscription to our public Directory and the provision of any additional services related thereto, as set forth in this Privacy Policy and in the service agreement executed with your school, including performing the necessary commercial and administrative tasks and complying with related legal and/or contractual obligations.

3. Publication and Operation of the Directory: To publish your school in the public Directory and to operate the public Directory, including processing any personal data provided by the school for this purpose.

4. Promotional Services related to your School´s public Directory Listing: To carry out promotional services related to your school’s participation in our public Directory, including inclusion in our Open Days and Events Calendar, and publication on our social media platforms, by linking to your school’s Directory listing, which may display images, pictures, videos, and other content provided by the school. When conducting promotional services, My Barcelona School will not display pictures, images and/or videos of any individuals provided by the school directly in its social media platforms; such content may only appear within the Directory listing itself, as uploaded and controlled by the school.

5. Invoicing: To issue invoices in connection with the subscription to our public Directory.

6. Contact by interested parties: To enable potential clients to contact your school via its listing in our public Directory.

​

Non-Personal Data Services: Certain services provided to the school, such as SEO optimization, do not involve the processing of personal data and are therefore outside the scope of this Privacy Policy.

​

Data we collect: We may collect the following types of personal data: 

​

• From the School Contact Person: 
  First name, last name, business email address (e.g., school email address). If you provide a personal mobile number, we will use it solely for business-related purposes.

• About Other School Staff, Admissions Team Members and Head of Departments (“Staff Members”).
  Identity and contact details (e.g., name, business email address), as well as images, pictures, and/or videos where provided by the School Contact Person. This information is not collected directly from these individuals but is submitted by the school as primary data controller. The provisions under the section ‘Third-Party Data Submission Responsibilities’ below apply to the submission and processing of this data.

• About Students (including minors), families and/or third parties.
  Identity data, including images, pictures, and/or videos, provided by the school for placement in its Directory listing. This information is not collected directly from students, families and/or third parties but is submitted by the school as primary data controller. Where images, pictures and/or videos of students under 14 are submitted, the school must ensure that parental or guardian consent has been obtained prior to submission. The provisions under the section ‘Third-Party Data Submission Responsibilities’ below apply to the submission and processing of this personal data.

​

Data We Collect About the School (Business Data): We may collect the following business-related data from the school for invoicing and subscription purposes:

​

• Transaction and Financial Data: Business name, Business address, Tax ID number (for invoicing purposes) and details of the subscription chosen.

• School Information: Other aggregate, non-personal information about the school, including but not limited to any school policies and practices (hereinafter “School Information”), is collected as part of the subscription form for the public Directory purposes.

​

This School Information does not need to be treated as personal data for the purposes of this Privacy Policy, except where it includes “Staff Members” (including other School staff, Admissions Team Members and Heads of Departments) personal data or personal data of any individuals, - including families, students (including minors), or any other third parties -, submitted by the School Contact Person. In such cases, the provisions under the section ‘Third-Party Data Submission Responsibilities’ below shall apply.

​

When providing School Information, please submit only broad, non-specific, aggregate-level data and do not include any personal, sensitive, or identifiable data that could directly or indirectly identify individual students or families; this includes details that could directly or indirectly reveal a child’s identity or their special educational needs or support provisions.

​

In cases where such data may still be considered personal data under the GDPR, the School Contact Person, on behalf of the school as data controller, is responsible for ensuring and warrants compliance with data protection laws prior to providing such data to us. This includes ensuring that a valid legal basis exists for its transfer and communication to us, and for our subsequent processing of the data in accordance with this Privacy Policy and the services provided under the agreement signed with your school for the subscription to the public Directory. Where necessary, this responsibility includes obtaining appropriate consent from, or providing required notices to, the relevant data subjects.

​

Sensitive Data: No sensitive or special category personal data (e.g., health, ethnicity, religion) should be submitted via the Directory submission form, unless expressly authorized in writing by My Barcelona School.

​

School as Data Controller

​

When the school collects and submits personal data (including personal data of school´s staff, heads of departments, admissions team members, and students (including minors), as well as related images, pictures, and/or videos of such individuals, and images, pictures, and/or videos of families and/or any third parties) to My Barcelona School for inclusion in the Directory or related services, the School acts as the original Data Controller of that personal data. This means the School is responsible for ensuring that your personal data is collected, shared and processed lawfully, in compliance with the GDPR and applicable data protection laws, and that, before disclosing any personal data to us, the school shall provide all necessary information to the individuals concerned, and shall ensure that a valid legal basis exists, including obtaining any necessary consents, such as parental or guardian consent where applicable, for both the transfer of such personal data to us and its subsequent processing by us for the purposes of the school Directory subscription and related services as described in this Privacy Policy.

​

My Barcelona School acts as data controller in respect of the personal data once it has been received and processes such personal data in relation to the school directory subscription and related services in accordance with this Privacy Policy. 

​

My Barcelona School and the School do not act as joint controllers.

​

Lawfulness of personal data processing

​

1. The legal basis for personal data processing is the performance of a contractual relationship with your school resulting from its subscription to our School public Directory and related services, namely invoicing, statistical analysis, reporting, and promotional services related to your school’s participation in our public Directory, including inclusion in our Open Days and Events Calendar and publication on our social media platforms of your school’s participation and listing in the public Directory.

2. Where applicable, we process personal data to comply with legal obligations arising from such subscription and related services mentioned above, or to which the provider is subject under applicable laws.

3. Where a contractual relationship exists, failure to provide the required personal data necessary for the performance of the contract may result in our inability to fulfill our obligations under the contract or to provide the associated services.

​

Your Responsibility for the Personal Data Provided

​

You, as the School Contact Person, on behalf of your school as the Data Controller, acknowledge and confirm that the personal data and School Information you provide to us through the form is accurate, complete, and lawful. If you need to correct or update the personal data you submitted via the form, please contact us at hello@mybarcelonaschool.com. 

​

Data retention:

​

Your personal data will be retained for the duration of our contractual relationship with your school which is listed in our Directory and for the period necessary to comply with applicable legal obligations. Once the purpose for which the personal data was collected has been fulfilled, the personal data will be restricted and stored only for the duration of the applicable statute of limitations for any related legal claims. After this period has expired, the personal data will be securely and permanently deleted. 

​

If My Barcelona School determines that personal data was submitted without proper authorization, such data will be deleted. 

​

This retention policy applies to all personal data, including pictures, images, and/or videos of students (including minors), families, third parties and Staff Members.

​

Transfers to third parties and international transfers:

​

1. Your personal data may be accessed or transferred to third parties (e.g., tax authorities or other public administrations), when required by applicable law from time to time; to financial entities for the management of payments, and to service providers such as, IT professionals, tax advisors, lawyers, and/or hosting, storage, and backup providers, including third-party platform providers, such as website hosting, form management, and cloud storage services. Such transfers will be made solely for purposes related to administrative, technical, or operational support, legal compliance, and/or to exercise or defend legal claims.

2. My Barcelona School engages third party service providers (www.wix.com) for the hosting and storage of personal data, which may be located outside the EU/EEA, or may involve transferring such data to countries outside the EU/EEA. As a result, your personal data may be transferred to, or stored in, countries outside the European Union (EU) or European Economic Area (EEA), including jurisdictions that may not provide the same level of data protection as within the EU/EEA. Any transfers of personal data outside the EU/EEA are conducted in compliance with applicable data protection laws and are subject to appropriate safeguards as set out in the Wix's Data Privacy Policy and Wix´s Data Processing Agreement (DPA) both available at https://www.wix.com/about/privacy. In particular, as per the current DPA, personal data is initially transferred to Wix.com Ltd., located in Israel, a country for which the European Commission has issued an adequacy decision (Commission Decision 2011/61/EU). Any further transfers by Wix to an Adequate Country will be conducted under the applicable adequacy decision published by the relevant data protection authority. For any other transfers outside the EU/EEA, appropriate safeguards are implemented and may include the use of Standard Contractual Clauses (SCCs) approved by the European Commission or any similar mechanism, and any other appropriate safeguards required under Article 46 of the GDPR or any equivalent provision. 

​

Wix’s Data Processing Agreement (DPA) applies by default to all users of its platform, including The Barcelona School. This DPA forms part of Wix’s Data Privacy Policy and is publicly available at https://www.wix.com/about/privacy. It governs international data transfers and outlines the safeguards Wix implements. Should you wish to obtain a copy of these safeguards, you may contact Wix’s Data Protection Officer at privacy@wix.com. Please note that the terms of Wix’s DPA and the safeguards it outlines may be amended from time to time. Any updates or amendments will be made available on Wix’s website at the link above and will be effective as of the date of posting.

​

For more information on how Wix processes and protects your personal data, please consult Wix’s Data Privacy Policy linked above.

​

Data subject´s Rights Likewise, we inform you that:

​

• You have the right to request access, rectification, portability and deletion of the personal data, the limitation and opposition to its processing and the right not to be subject to automated individual decision-making, by contacting My Barcelona School by email to hello@mybarcelonaschool.com, with the subject "Rights Exercise", providing a document showing your identity and including the following information (name, surname, validity of the document), being able to hide the rest of the data that is not necessary, indicating the type of right you wish to exercise.

• You also have the right to file a complaint with the national data protection supervisory authority, which in Spain is the Spanish Data Protection Agency (www.aepd.es), if you consider that the processing of personal data by My Barcelona School does not comply with current data privacy regulations.

​

Third-Party Personal Data Submission Responsibilities: 

​

Depending on the type of third-party personal data submitted, the School Contact Person is responsible for ensuring and represents and warrants compliance with all applicable data protection laws and the requirements set out below.

​

1. Staff Members personal data: If you, as the School Contact Person on behalf of your school as the Data Controller, submit Staff Members (including other School staff, Admissions Team Members and Heads of Departments) personal data, you must ensure that you are authorized to do so. 
   
   Before providing us with any personal data of any Staff Member, the School Contact Person (on behalf of the school, as primary data controller) must ensure and warrants that: 
   
   School´s Obligations for Pictures, images and/or videos of Staff Member: In the event that you, as the School Contact Person, provide pictures, images and/or videos of any Staff Members (including other School staff, Admissions Team Members and Heads of Departments) via the Directory submission form, you, on behalf of the school as primary Data Controller, must ensure and represent and warrant that, before providing such personal data to My Barcelona School:
   
   (i) The School has ensured compliance with all applicable data protection laws and regulations in relation to the submission and subsequent processing of such pictures, images, and/or videos.
   
   Right to withdraw consent for Staff Members. 
   Data subjects - Staff Members - can withdraw their consent at any time, and the school must ensure that Staff Members are informed of this right and can request withdrawal via the school. 
   
   For clarity, the school remains solely responsible for collecting and maintaining valid consent (including parental or guardian consent, where applicable) prior to providing such pictures, images and/or videos to My Barcelona School.
   
   You, as the School Contact Person on behalf of the school, acknowledge, agree, represent and warrant that your school remains solely responsible, as the original Data Controller, for ensuring that any Staff Members personal data submitted to My Barcelona School via the form is shared lawfully and in compliance with data privacy laws. My Barcelona School will process such personal data as an independent Data Controller for the purposes of the school subscription to the public Directory and related services as described in this Privacy Policy. For the avoidance of doubt, My Barcelona School shall not be liable for any failure by the School to comply with its obligations under applicable data protection laws or this Privacy Policy.
    

2. Students (including minors), Families and/or Third Parties Personal Data: If you, as the School Contact Person acting on behalf of the school, submit personal data of any third party, student (including minors), and/or their families, you must ensure that you are authorized to do so.
   
   Accordingly, you acknowledge and agree that My Barcelona School is not required to directly inform such third parties, families, students and/or parents or guardians (if students are under 14), pursuant to the exception set out in Article 14(5)(a) of the GDPR, because this information has already been provided by you, acting on behalf of your school. For the avoidance of doubt, the school remains solely responsible for fulfilling the information obligations under Articles 13 and 14 GDPR with respect to such individual.
   Moreover, If you, as the School Contact Person acting on behalf of the school, submit personal data of any third party, including but not limited to, families and/or students (including minors), you, on behalf of the school, confirm, represent and warrant that your school, as the primary Data Controller of such personal data, has obtained all necessary and documented consents (including parental or guardian consent where applicable), and/or has a valid legal basis, and/or has provided the necessary notices, for submitting and communicating personal data (and, where relevant, any aggregate data that could still be considered personal data) of students (including minors), families, or other third parties.
   The School is responsible for verifying the age of all students whose personal data, images, photographs, or videos are provided to My Barcelona School for inclusion in the School Directory. For all students under the age of 14, the Educational Institution warrants that parental or legal guardian consent has been obtained prior to submission of any personal data for the purposes indicated in this Privacy Policy. 
   
   For the avoidance of doubt, the School is expected to take reasonable measures to verify that parental or guardian consent has been obtained, in line with available technology and best practices.
   
   You, as the School Contact Person acting on behalf of the school, further confirm, represent and warrant that the personal data submitted is accurate, limited to what is necessary for the subscription services, and complies with applicable data protection laws. This includes ensuring that families, students, or their parents or guardians (where parental or guardian consent is required), and/or any third parties have been informed and, where applicable, have consented to —or that a valid legal basis exists and they have received all required notices for— their personal data (and, where relevant, any aggregate data that could still be considered personal data) being communicated to us and subsequently processed for the purposes of the school subscription to the public Directory and related services as described in this Privacy Policy, including but not limited, to the services mentioned in the prior paragraph, and that the age of all the students has been verified. 
   
   School´s Obligations for Pictures, images and/or videos of students (including minors), families and/or third parties: In the event that you, as the School Contact Person, provide pictures, images and/or videos of any students (including minors) as well as any families and/or third parties appearing in such materials, via the Directory submission form, you, on behalf of the school as primary data controller, must ensure and represent and warrant that, before providing such personal data to My Barcelona School: 
   
   (i)  Such students or their parents or guardians (where parental or guardian consent is required), families and/or third parties, have been informed and have granted their express, informed and freely given consent in accordance with applicable data protection laws, for the transfer and communication of their pictures, images and/or videos.
   
   (ii)  The School has ensured compliance with all applicable data protection laws and regulations in relation to the submission and subsequent processing of such pictures, images, and/or videos. 
   
   The school remains solely responsible for collecting and maintaining valid consent (including parental or guardian consent, and verifying the student´s age, where applicable) prior to providing such pictures, images and/or videos to My Barcelona School.
   
   Right to withdraw consent for students (including minors), families and/or third parties 
   Data subjects - students (including minors), families and/or third parties - can withdraw their consent at any time, and the school must ensure that students and/or their parents or guardians (where parental or guardian consent is required), families and/or third parties, are informed of this right and can request withdrawal via the school. 
   
   These individuals may also exercise this right directly with My Barcelona School, via the contact details provided in Data Subject Rights section above, in which case My Barcelona School will attend to such withdrawal, remove the relevant pictures, images and/or videos, and inform the school accordingly. 
   
   You, on behalf of the school, acknowledge and agree that your school remains solely responsible, as the original Data Controller, for ensuring that any third party, families and/or students (including minors) personal data submitted to My Barcelona School via the form is shared lawfully and in compliance with data privacy laws. My Barcelona School will process such personal data as an independent Data Controller for the purposes of the school subscription to the public Directory and related services as described in this Privacy Policy. For the avoidance of doubt, My Barcelona School shall not be liable for any failure by the School to comply with its obligations under applicable data protection laws or this Privacy Policy.
    

3. Parental Consent Age Threshold
   For the purposes of this Privacy Policy, parental or guardian consent is required for students under the age of 14.
    

4. Age Verification for Minors, Parental Consent and Parental Rights. For students under the age of 14, My Barcelona School relies on the Educational Institution to verify the student’s age and ensure that parental or guardian consent has been obtained prior to submitting any data with us. 
   
   Parents or legal guardians have the right to access, correct, or request the deletion of their child’s personal data at any time. Requests can be submitted directly to the Educational Institution or to My Barcelona School, via the contact details provided in Data Subject Rights section above, and we will take appropriate steps to comply in accordance with applicable data protection laws.
    

5. Provision of pictures, images and/or videos. The provision of pictures, images, and/or videos of students (including minors), families, third parties, and/or Staff Members (including heads of departments, staff, and/or admissions team members) is not mandatory for the publication or listing of the School in the public Directory. The School Contact Person may provide such pictures, images, and/or videos at their own discretion, ensuring and warranting, on behalf of the School as Data Controller, that the transfer and subsequent processing of any such materials for the purposes of the School Directory Subscription and related services as described in this Privacy Policy complies with applicable data protection laws, including the obtaining of valid consent, parental or guardian consent where required, and/or application of anonymization or pixelation where legally mandated (e.g., for students under 14 or other legally required cases) prior to submission.

​​

Updates to This Policy:

 

We reserve the right to update this Data Privacy Policy from time to time. Any changes will be published on our website at www.mybarcelonaschool.com under the footer link Directory Privacy Policy. 

 

We encourage you to review this Privacy Policy periodically to stay informed about how we process personal data.

 

Authority and Representation

 

By submitting this form, you confirm that, as the School Contact Person, you are duly authorized to act on behalf of your School and to submit the personal data and other information provided for the purposes set out in this Privacy Policy, and you agree to the terms herein. You further represent and warrant that you have the authority to bind the School to the terms set forth herein and agree to comply with all applicable obligations.