Privacy Policy (Data Protection)

Who is responsible for processing your data?

ESCUELAS DE IDIOMAS BERLITZ DE ESPAÑA S.A. is the entity responsible for processing your personal data. This company’s details are: NIF A08280042, registered address at C/ Ferraz 82, 28008 Madrid (Spain), telephone 915416215, and contact email berlitz@berlitz.es.

Data Protection Officer (DPO): You may contact our Data Protection Officer at the email address berlitz@berlitz.es.

Joint Controllers: Your data is processed under a joint controllership with NorthSun Education Group S.R.L., NIF 369770444, with registered address at Viale de la Carrera 109, 63900 Fermo, Italy. The DPO contact for NorthSun Education Group is marketing@northsun.education. Data subjects can request information on the essential terms of the joint controllership arrangement by sending an email to berlitz@berlitz.es.

For what purpose do we process your personal data?

We process the information that you provide in order to manage your requests and deliver the services you engage us for. This includes handling inquiries and information requests, preparing quotes or contracts, providing the language training services you have contracted, and managing billing and administration related to those services. Additionally, unless you object, we may use your information to offer you products or services from Berlitz that are similar to those you have already contracted or shown interest in, in order to inform you of promotions or updates that may be relevant to you.

Categories of personal data we process for clients and suppliers include:

· Identification data (e.g. name, surname, ID number).

· Postal or electronic contact addresses (physical address, email).

· Commercial information (e.g. details about the products or services you have with us, inquiries made, preferences).

· Economic and transaction data (e.g. payment information, billing details, transactions).

· Browsing data (information from your use of our website or online services).

· Image/voice (e.g. photographs or audio recordings, which may occur in the context of our services or facilities).

Please note that in no case do we process special categories of personal data (sensitive data such as those revealing racial or ethnic origin, political opinions, religious beliefs, health information, etc.).

All the aforementioned data has been obtained either directly from you – for example, through your request for information, the presentation of a commercial offer, or when entering into a service contract with us – or through your company in cases where your employer or organization has provided us with your details (for instance, if your company arranges language training services with us and gives us your contact information as a participant or contact person).

It will be your responsibility (or your company’s) to provide us with updated personal data if any changes occur, in order to keep your information accurate and current.

How long will we keep your data?

We will keep personal data related to individuals (potential customers, customers, and suppliers) for as long as a mutual interest exists – for example, while you are in contact with us regarding our services or while you maintain a contractual relationship with us.

If you become a customer or supplier, your data will be retained for the duration of our business relationship and, after that, for the period necessary to comply with legal obligations. This means that once your relationship with us has ended, we will delete or anonymize your personal information when it is no longer needed for the purposes for which it was collected. However, we may keep your data blocked (securely stored and isolated) for the time required by applicable laws to attend to any responsibilities or legal requirements that may arise (for example, for tax and accounting regulations or to handle possible complaints).

In summary, we will store your data only for as long as is necessary to fulfill the purposes described above, and in accordance with the retention periods mandated by law. When those periods expire, your data will be securely erased or archived in a way that makes it inaccessible for routine use.

What is the legal basis for processing your data?

The legal basis that permits us to process your personal data is as follows:

· Execution of a contract and pre-contractual steps: If you are a customer or supplier (or a potential customer who has requested information or a quote), the primary legal basis for processing your data is the performance of the contract you have entered into with Berlitz, or the application of pre-contractual measures at your request. In other words, we need to process your data to provide you with the services you have asked for or to take steps you have requested before entering into a contract (for example, processing an inquiry or preparing an enrollment proposal).

· Legitimate interest in business operations: In certain cases, we process your data based on the legitimate interests of our company. Specifically, Berlitz has a legitimate interest in promoting and marketing its products and services. This means we may process the contact information of clients or prospective clients for direct marketing purposes related to our services (such as sending updates or offers about language courses or related services), provided this use does not override your rights and freedoms. We consider this to be beneficial for you as well, as it keeps you informed of improvements or opportunities. Importantly, you have the right to object at any time to the processing of your data for direct marketing, and if you do so, Berlitz will stop processing your data for that purpose.

· Consent: In situations where neither contract performance nor legitimate interest can serve as a lawful basis (for example, if we wanted to send you promotional communications from third parties or perform any action that requires consent under applicable law), we will request your explicit consent. In such cases, you have the freedom to grant or deny your consent, and if you have given consent, you may also withdraw it at any time. Withdrawal of consent will not affect the legality of any processing carried out prior to your withdrawal.

· Compliance with legal obligations: Berlitz will also process and retain certain data as necessary to comply with legal obligations. For instance, laws regarding tax, accounting, labor, or data protection may require us to process or keep certain personal data. In these cases, the processing of your data is based on compliance with those legal obligations.

In summary, depending on the context, your data may be processed because it is necessary for a contract or service, because Berlitz has a justified legitimate interest (from which you may opt out), because you have given consent, or because we must fulfill certain legal requirements.

To which recipients will your data be disclosed?

We will not sell, rent, or transfer your personal data to third parties for their own marketing purposes. In particular, we will not disclose your personal information to any third-party company that intends to use it for direct marketing or similar promotional activities, unless you have given us your explicit consent to do so.

As a general rule, your data will only be communicated to third parties in the following situations:

· Legal obligations: We may communicate your data to competent public authorities, courts, or regulators when we are legally required to do so. For example, tax data might be sent to the Tax Agency, or information could be provided to law enforcement or judiciary under a court order or legal requirement. Such disclosures will only be made in compliance with the law.

· Service providers (data processors): In order to carry out our services and business operations, it might be necessary for us to share your data with trusted third-party service providers who perform functions on our behalf. These may include, for instance, technology and IT service providers, cloud storage companies, payment processing entities, or other suppliers that assist us in delivering our services. When we engage such providers, we ensure they can only access your information to perform the tasks we have hired them for, and they are contractually obligated to use your data solely under our instructions and to keep it protected. These collaborations do not constitute a transfer of your data for the providers’ own purposes, but rather a processing of data on behalf of Berlitz (under strict confidentiality and security conditions).

Apart from the above cases, we will not share your personal data with any other third parties. If in the future we consider it necessary to disclose information to other recipients for reasons beyond those listed, we will inform you and, if required, obtain your consent or ensure another valid legal basis is in place.

What are your rights when you provide us with your data?

Right of Access: You have the right to know whether Berlitz is processing your personal data, and if so, to obtain a copy of that data and information about how we process it.

Right to Rectification: If any of your personal information is inaccurate or incomplete, you have the right to request its correction or update.

Right to Erasure (Right to Be Forgotten): You can request the deletion of your personal data when, for example, the data is no longer necessary for the purposes for which it was collected, you withdraw your consent (and no other legal basis for processing exists), or you believe the data has been unlawfully processed. We will assess and, if appropriate, honor such requests in accordance with applicable laws.

Right to Restriction of Processing: You have the right to request that we limit the processing of your data in certain circumstances. This means we would store your data but temporarily suspend any other processing activities. You can exercise this right, for instance, if you contest the accuracy of your data (while we verify it) or if you need the data preserved for the establishment, exercise or defense of legal claims.

Right to Object: You have the right to object to the processing of your personal data when such processing is based on our legitimate interest. This includes the right to object at any time to the processing of your data for direct marketing purposes. If you exercise this right, we will stop processing your data for those purposes unless we have compelling legitimate grounds to continue that outweigh your rights, or for the defense of legal claims.

Right to Data Portability: When processing is based on your consent or the performance of a contract and carried out by automated means, you have the right to request that we provide you or a third party you designate with a copy of your personal data in a structured, commonly used, machine-readable format. This allows you to move, copy, or transfer your data easily from one IT environment to another in a safe and secure way.

Right to Withdraw Consent: In cases where we process your data based on your consent, you have the right to withdraw that consent at any time. If you withdraw consent, we will cease the processing in question. Please note that withdrawing consent does not affect the lawfulness of processing that was carried out based on consent before its withdrawal.

To exercise any of your rights, you can contact Berlitz by sending a written request, along with a copy of a document that proves your identity (such as your ID card or passport), through either of the following channels:

· Postal mail: Addressed to ESCUELAS DE IDIOMAS BERLITZ DE ESPAÑA S.A., C/ Ferraz 82, 28008 Madrid, Spain.

· Email: Send an email to berlitz@berlitz.es with the subject “Data Protection – Exercise of Rights” and include your identification information and the specific request regarding your personal data.

We will review and respond to your request in accordance with the applicable data protection laws. Typically, we will reply within one month of receiving your request, although this period may be extended by two further months if necessary due to the complexity or number of requests (in which case we will inform you of the extension and the reasons for it).

Finally, we remind you that you also have the right to file a complaint with the relevant supervisory authority if you believe your data is being misused or if you are not satisfied with the way we have handled any request to exercise your rights. In Spain, this supervisory authority is the Agencia Española de Protección de Datos (AEPD) – the Spanish Data Protection Agency. You can find more information about how to submit a complaint on the AEPD’s website (www.aepd.es).

Berlitz is committed to protecting your privacy and personal data. We encourage you to contact us with any questions or concerns regarding the processing of your information, and we will be happy to assist you.