1. INTRODUCTION

In ONDARE ACADEMIA INTERNACIONAL SL, we are committed to the protection of privacy and the correct use of personal data that we treat and that you provide us, both online on this website and, where appropriate, any of its subdomains and microsites, and off-line.

Please read this policy carefully and make sure that you understand and agree with it before providing us with your personal data. If you do not agree with it, please do not use this web site or its services or provide us with your personal information.

By accessing this site, using any of its services or providing us with your data, whether online or offline, we will take this as a clear affirmative action by which you give us your consent (where required) to process your data for the purposes set out below.

2. WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR DATA?

ONDARE ACADEMIA INTERNACIONAL SL , NIF B75393165

Postal Address: Paseo De Cervantes S/n, Estadio De Mendi 01007 - (Vitoria-gasteiz) - Álava

E-mail: dpd@bkndagroup.com

If you have any questions, complaints or claims about the processing of your data, you can raise it directly to our DPO at the above e-mail address before, where necessary, submitting it to the Data Protection Agency. We will respond within a maximum of two months from receipt of the complaint.

3. HOW HAVE WE OBTAINED YOUR DATA?

3.1 Obtained from the person concerned.

If you have contacted us to request information or register on the web or you are a current or potential student of the academy, you have provided us with your personal data, in order to maintain contact and communication with you, provide you with the requested services, and maintain the pre-contractual or contractual relationship with you.

By providing us with your data, you guarantee that you are authorized to do so, and that the information is true, up to date, and does not infringe any contractual restriction or third party rights. You are responsible for keeping your data and your profile correct and updated, declining all responsibility ONDARE ACADEMIA INTERNACIONAL SL in case of not doing so.

3.2 Automatically collected when you visit our website:

When you visit our website we collect information through cookies and other tracking and web analytics technologies. This means that data is sent from your browser to our servers to optimize our services and improve your user experience. This data may be automatically collected and stored by us or by third parties on our behalf. You can consult our cookie policy.

3.3 Communication of data by a person other than the interested party.

In the event that it is not the data subject himself but a third party who provides us with data from him, (agreed Clubs or entities or organizations with which we reach agreements, legal representatives of minors, or relatives ...) the categories of data that we treat can be, depending on each specific case: identification data, personal characteristics, academic and professional, economic, and even specially protected data relating to the health of the person concerned.

Specially protected data relating to the health of the data subject are subject to special protection and the legitimacy to process them is the express consent of the data subject. Therefore, it is the responsibility of the third party who provides us with data both to have the prior and express consent of the data subject to use their data and communicate them to us, and to inform them of the processing of the same by us, exonerating us from any liability in case of any claim by the data subject, responsibility assumed solely and exclusively by the person who has communicated the data to us on behalf or in the interest of the data subject.

With respect to other people's data, you must respect their privacy, taking special care when communicating or publishing their personal data. Only the owner can authorize the processing of their personal data. The publication of third parties' data without their consent may infringe, in addition to data protection regulations, those relating to the right to honour, privacy or self-image of such third parties.

It is the responsibility of those who provide data of third parties: a) to have their prior and express consent to use them, and b) to inform them of the treatment that we will carry out with their data. By accepting this privacy policy, you expressly guarantee that you have the authorization for such contribution, exonerating us from any liability in case of any claim by any interested party.

4. WHAT TYPE OF DATA DO WE PROCESS?

The categories of data we process may be:

o Obtained from the person concerned: Identifying data (name and surname, ID number, image/voice); contact data (telephone, postal address, email address), family data (siblings there is a discount); date of birth; place of birth; age; sex; nationality; mother tongue and languages they master; physical or anthropometric characteristics (height weight, height...); education; qualifications; student history; school they have studied in; academic qualifications; health data.

o Navigation data: IP address of the user, the date and time of the visit, the URL of the site from which the user comes, the pages visited on our website, information about the browser used, type and version of the browser, operating system…

o Communicated by a third party: the same as those obtained from the person concerned.

5. WHY DO WE PROCESS YOUR DATA AND WHAT IS LEGAL BASIS FOR PROCESSING IT?

SUMMARY CHART OF PURPOSES AND THEIR LEGAL BASIS

The data you provide us with, as well as all the data generated during the development of the relationship we have with you, may be processed for different purposes and with different legal bases.

6. HOW LONG WILL WE KEEP YOUR DATA?

We will keep the personal data you provide us with for as long as the contractual, pre-contractual or commercial relationship is maintained and, once these have ended, for as long as the person concerned does not request their deletion. Even if deletion is requested, we may keep them for as long as necessary and limit their processing, solely for the following purposes:

· To comply with the legal/contractual obligations to which we are subject,

· and/or during the legal periods foreseen for the prescription of any liability on our part, .

· and/or the exercise or defence of claims arising from the relationship maintained with the data subject.

In coordination with the above criteria, the deletion of personal data, either in computerised records or on paper, may be carried out, at the organisation's discretion, depending on logistical needs and/or storage space requirements that make it advisable to delete information or documentation.

7. TO WHICH RECIPIENTS MAY WE COMMUNICATE YOUR DATA?

We inform you that the data you provide may be communicated to third parties for the fulfilment of purposes directly related to the legitimate functions of the transferor and transferee, such as:

1. To banking entities that manage payment services: for the management of collections and payments.

2. To entities or organizations to which there is a legal obligation to communicate data (for example, tax authorities to comply with fiscal and tax obligations or administrations with competence in this area to obtain certificates of residence for students so that they can manage visas in their countries of habitual residence if they are required to enter Spain).

3. To insurance companies: for the contracting of medical insurance or any other type of insurance for students, as well as to the medical centres arranged by these insurance companies in the event that medical care is necessary for the student.

4. Travel agencies to organise possible trips for students during their stay at the academy.

5. Suppliers of technological and analytical services.

6. Educational centres where students will be studying in Vitoria during their stay at the academy in order to manage their enrolment.

8. INTERNATIONAL DATA TRANSFERS

We will ensure that personal data is always processed and located within the European Economic Area. However, in certain circumstances, we may make international transfers of data, for example, where necessary for the performance of a contract between the data subject and us. Also, where appropriate, for example when using service providers located outside the European Union, who may have access to personal data, for the provision of services ancillary to our business (hosting, housing, SaaS, remote backups, computer support or maintenance services, e-mail managers, sending e-mails and e-mail marketing, file transfer, etc.).

These entities may be different and vary over time, but we will try to choose entities either belonging to countries that have a level of protection equivalent to the European level of data protection, or that have the appropriate guarantees to achieve that level, or they will be carried out on the basis of one of the exceptions provided for in the GDPR.

9. WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA?

You may, where appropriate, exercise your rights of access, rectification, deletion, limitation and opposition to their processing, as well as other rights, at the postal or e-mail address indicated at the beginning of this privacy policy; in both cases by means of a written and signed request, attaching a copy of your ID card or passport or other valid document that identifies you. In the event of modification of your data, you must notify us at the same address, and this entity declines all responsibility in the event of failure to do so.

· Right of access: You can ask us what personal data we are processing and even request a copy of this data.

· Right of rectification: You can ask us to rectify inaccurate personal data or to complete incomplete personal data, including by means of an additional declaration

· Right to erasure (right to be forgotten): You can ask us to delete your personal data when: it is no longer necessary for the purposes for which it was collected, you withdraw your consent, there has been unlawful processing of the data or in compliance with a legal obligation.

· Right to limitation of processing: You can ask us to limit the processing of your data, in which case we will only keep them for the exercise or defence of claims.

· Right to object: You may object to the processing of your data if such processing is based on the legitimate interest of the data controller or is for advertising purposes.

· Right to object to automated decisions: You can object to being subject to a decision based solely on automated processing of your personal data, including profiling, which produces legal effects concerning you or significantly affects you. E.g. analysing or predicting aspects related to job performance, financial situation, health, personal preferences or interests, etc. In this case we may profile your preferences, if you do not object.

Once we have received any of the above requests, we will respond to you within the legally established deadlines. You may complain to the Spanish Data Protection Agency. If you would like more information about the rights you can exercise and to request model forms for exercising your rights, you can visit the website of the Spanish Data Protection Agency, www.aepd.es.