Privacy Policy

Last updated: 26 September 2025.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, and your rights under the EU General Data Protection Regulation (GDPR) and Spanish law.

Identification Data

Data Controller: Raul Minguez Molina
Tax ID (NIF): 52507699X
Contact Email: info@spainstudyadvisors.com
Phone: +34 686 103 672
Website: https://spainstudyadvisors.com
Purpose of this website: It provides educational guidance and resources to support students in accessing higher education opportunities at Spanish universities.

Data controller for the processing activities described in this policy.

Privacy Summary

What we collect: form data (SureForms), booking info (Zcal), CRM records (Jetpack CRM), consent logs (Complianz), technical logs (Hostinger/LiteSpeed and, if enabled, QUIC.cloud), and analytics (GA4) only after consent.

Why: reply to enquiries, provide services, run the site securely, and measure performance (with consent).

Legal bases: consent, contract (including pre-contractual steps), legitimate interests, legal obligations.

Sharing/processors: Hostinger, LiteSpeed/(QUIC.cloud if enabled), SureForms/SureMail/OttoKit, Jetpack CRM, Zcal, Complianz, Google Analytics (consent only). International transfers use appropriate safeguards (e.g., SCCs).

Retention: enquiries/booking data for service & follow-up, CRM as needed for operations/legal, consent logs per compliance, analytics per GA retention, server logs for short technical periods.

Your rights: access, rectification, erasure, restriction, objection, portability; withdraw consent anytime; complain to the AEPD. Cookies banner offers Accept / Reject / Configure.

What personal data we collect and why

1) Forms — SureForms

When you submit a form, we collect the fields you provide (e.g., name, email, phone, message, and any other fields) plus technical data (browser/agent) for spam prevention and security. Submissions may be stored in our website database (SureForms → Entries) and sent by email to our team. If Jetpack CRM is connected, form data may be synchronized to our CRM to manage your enquiry.
Legal bases: consent and/or contract (pre-contractual steps).

2) Client relations — Jetpack CRM

We use Jetpack CRM to manage enquiries and client records. Data may include contact details, communication history, services of interest, and notes necessary to respond.
Legal bases: contract, legitimate interests (responding and keeping records).

3) Bookings — Zcal

When you book an appointment, we collect information necessary to schedule and communicate with you (e.g., name, email, time zone, selected time slot, and any message you include). Zcal processes data to manage availability, calendar invitations, and reminders. Zcal may set functional cookies or process limited technical data to provide the service.
Legal bases: contract and consent (for reminders/marketing where applicable).

4) Email & automations — SureMail and OttoKit (SureTriggers)

We may use automation tools to send notifications, reminders, and transactional emails after you submit a form or book a meeting. These tools process identifiers like your name and email to deliver the relevant message.
Legal bases: contract (service messages) and consent (marketing, if applicable).

5) Multilingual — Polylang

Polylang provides content in multiple languages. It may set a cookie to remember your language preference.
Legal basis: legitimate interests (localized experience).

6) Performance & optimization — LiteSpeed Cache (and QUIC.cloud, if enabled)

We use caching to improve speed and reliability. Caching may store a temporary copy of pages and static assets. Cache files are temporary and are not accessed by third parties except for technical support or, if QUIC.cloud is enabled, for delivery via its CDN/online services.
Legal basis: legitimate interests (site performance).

7) Cookies & consent — Complianz | GDPR/CCPA Cookie Consent (and Complianz – Terms & Conditions)

We use Complianz to show a consent banner, categorize cookies, and record consent based on your browser/device (IP is anonymized for consent logs). Cookies that are not strictly necessary are set only after consent.
Legal bases: consent (non-essential cookies) and legitimate interests (security/essential cookies).

8) SEO & design utilities — Rank Math SEO, Spectra, Starter Templates

These plugins help structure content, add schema/meta data, or provide design blocks. They generally do not collect personal data from visitors beyond technical, non-identifying information necessary for functionality.
Legal basis: legitimate interests.

9) Hostinger plugins — Hostinger AI, Hostinger Easy Onboarding, Hostinger Tools

These tools assist with site setup, diagnostics, and performance. They are intended for administrators and typically do not process visitor personal data beyond necessary technical information.
Legal basis: legitimate interests.

10) Analytics — Google Analytics (GA4)

We use GA4 only after your consent via the cookie banner. IP anonymization is enabled and we do not use GA to identify individual users. We implement Consent Mode so if you refuse consent, analytics cookies are not set and only essential pings are sent. Under Spanish guidance, analytics cookies generally require prior consent.
Legal basis: consent.

Cookies

• Non-essential cookies (e.g., analytics, marketing) are disabled by default and activate only after you give consent via the Complianz banner. Our banner provides Accept / Reject / Configure options with equal prominence, and you can change your choice at any time.
• Essential cookies (for security, load balancing, language preference) may be set without consent.
• Access our cookie policy here.

Embedded content from other websites

Articles on this site may include embedded content (e.g., videos, images, articles). Embedded content from other sites behaves as if you visit the other site and may collect data, use cookies, embed third-party tracking, and monitor your interaction (including if you have an account and are logged in to that site). Check those providers’ privacy policies.

Who we share your data with (categories of recipients)

We share data only when needed to run our services and under appropriate safeguards:

• Hosting & infrastructure: our web host Hostinger; and, where enabled, QUIC.cloud (via LiteSpeed) for caching/CDN.
• Communication & automation: SureMail, OttoKit, and our email service provider to send transactional messages.
• CRM: Jetpack CRM to manage enquiries and client records.
• Bookings: Zcal to schedule appoitments.
• Consent management: Complianz to record cookie consent.
• Analitics: Google Analytics (GA4; loads only after consent).

Some providers may be outside the European Economic Area (EEA). Where data is transferred internationally, we ensure appropriate safeguards (e.g., Standard Contractual Clauses and supplementary measures).

Legal bases for processing

Depending on the activity, we rely on one or more of: consent, contract (including pre-contractual steps), legitimate interests (e.g., to secure and optimize our site, handle enquiries, maintain records), and legal obligations (e.g., accounting/compliance).

How long we retain your data

• Forms (SureForms): retained as long as needed to manage your enquiry and for a short operational period (e.g., up to 12 months) unless law requires longer.
• CRM records (Jetpack CRM): retained while you are a prospect/client and as required for legal/accounting purposes.
• Booking data (Zcal): retained for scheduling and follow-up (e.g., up to 12 months after the appointment).
• Consent logs (Complianz): retained to demonstrate compliance.
• Analytics (GA4): retained per our GA data retention settings (aggregated).
• Server logs: retained for short technical periods to ensure security and performance.

We periodically review retention and delete or anonymize data that is no longer needed.

Your rights under GDPR

You have the right to access, rectify, erase, restrict, object to processing, and data portability. Where processing is based on consent, you may withdraw consent at any time (this does not affect prior lawful processing). We respond within one month (extensions possible for complex cases). You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

To exercise your rights, contact us at info@spainstudyadvisors.com.

International data transfers

Some providers may be located outside the EEA. Where data is transferred internationally, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and additional measures where necessary.

Security

We use technical and organizational measures to protect your data, including HTTPS (TLS), access controls, regular updates, and least-privilege practices. No method of transmission or storage is 100% secure; we work to continuously improve our safeguards.

Children’s privacy

Our services are not directed to children under 14. If you are under 14, you must have parental/guardian consent to use our services. If you believe a child provided us personal data without such consent, please contact us at info@spainstudyadvisors.com so we can delete it.

Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the “Last updated” date. Material changes may also be communicated by email or banner notice.

Contact

If you have questions about this Policy or your data, contact:

Email: info@spainstudyadvisors.com