1. Data controller

Carmen Lucas Marín (Carmen y Olé), Tax ID (NIF) 77810844G, C/ Barbero de Sevilla 6, 41006 Seville, Spain. Email: info@carmenyole.com. This policy complies with the EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

​

2. What data we process

Only what you give us or what we need to provide our services: name, email, phone or WhatsApp number, city, Spanish level, availability, your learning goals, booking and payment details (payments are handled by the payment provider; we never see your full card number) and any messages you send us. We also collect browsing data through cookies, as explained in our Cookie Policy.

​

3. Why we use your data, on what legal basis and for how long

Answering your enquiries (form, email, WhatsApp, Instagram). Legal basis: your consent and pre-contractual steps. Kept: until your enquiry is resolved, plus 12 months.

Managing the waiting list and the "Let's meet" call. Legal basis: pre-contractual steps at your request. Kept: until you join a group, or 12 months without a reply.

Providing the lessons you buy (bookings, student area, online classes, materials). Legal basis: performance of a contract. Kept: for as long as you are a student.

Invoicing and tax obligations. Legal basis: legal obligation. Kept: 6 years (Spanish Commercial Code).

Sending you emails about groups, news and free resources. Legal basis: your consent, which you can withdraw at any time. Kept: until you unsubscribe.

Measuring advertising and improving the website. Legal basis: your consent (cookies). Kept: see our Cookie Policy.

We do not make automated decisions or create profiles that have legal effects on you.

​

4. Who else can access your data

We never sell or share your data. Only the service providers we need to run our services can access it, under data processing agreements, plus our accountant for bookkeeping. We may also disclose data to public authorities when required by law.

Wix.com: website, bookings, payments, student area, forms, blog and emails (Wix Email Marketing).

Stripe (Wix Payments): payment processing.

Google (Forms, Sheets, Meet, Classroom, Google Ads): waiting list, online classes, materials and advertising.

Koalendar: booking the "Let's meet" call and trial lessons.

Zoho Mail: email.

Meta (WhatsApp, Instagram, Facebook) and ManyChat: messaging, social media replies and advertising.

TikTok: measuring advertising.

Accountant: bookkeeping and tax obligations.

​

5. International transfers

Some providers (Google, Meta, TikTok, Stripe, ManyChat, Wix) may process data outside the European Economic Area. They do so with appropriate safeguards: European Commission adequacy decisions (such as the EU-US Data Privacy Framework or the decision for Israel) or standard contractual clauses.

​

6. Your rights

You can ask to access, correct or delete your data, object to or restrict its processing, request data portability, and withdraw your consent at any time by emailing info@carmenyole.com. We reply within one month at most. If you are not satisfied with our response, you can complain to the Spanish Data Protection Agency (www.aepd.es).

​

7. Minors

Lessons for minors are always booked by a parent or legal guardian, who provides the student's details. For children under 14, we only process their data with the consent of the parent or guardian (Article 7 LOPDGDD). We never use images of minors on social media or send them marketing communications.

​

8. Security

We apply reasonable technical and organisational measures to protect your data and only use providers that offer security guarantees.

​

9. Changes

We may update this policy. The current version and its date will always be published here.

​

Last updated: October 2026.