PRIVACY POLICY
Last updated: 11 November 2026
This policy explains how INTO LINGUA, S.L. (“Break Into English”, “we”) processes your personal data when you visit breakintoenglish.com, book a trial lesson, take classes or apply to teach with us. It complies with the EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).
1. Data controller
- Controller: INTO LINGUA, S.L., NIF B72810187
- Address: Calle Princesa, 31, 2º 2ª, 28008 Madrid, Spain
- Privacy contact: [email protected] (subject: “Data Protection”)
- Phone: +34 620 545 772
We have not appointed a Data Protection Officer, as our activity does not require one.
2. Data we process
- Identity and contact: first and last name, email, phone or WhatsApp number.
- Student profile: employment situation, age (only if the student is under 18), country and city of residence, availability, English level, goals and topics of interest.
- Learning records: lesson history, teacher notes, homework, level-test results and progress.
- Billing: billing name and address, company name and tax ID for business clients, and payment records. Card details are handled by our payment provider; we never see or store full card numbers.
- Communications: emails, WhatsApp messages and video-call scheduling details.
- Teacher applicants: CV, qualifications, experience, contact details and interview notes.
- Referral programme: the name and email of a friend you refer to us.
- Browsing data: IP address, device and browser type and pages visited, collected through cookies only if you consent (see our Cookie Policy).
- Lessons: We do not record lessons.
We only ask for the data we need. Fields marked as mandatory are required to provide the service; without them we cannot handle your request.
3. Purposes, legal basis and retention
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Arrange your free trial lesson and answer enquiries | Pre-contractual steps at your request, art. 6.1(b) | Until resolved; deleted 12 months after last contact if you don’t sign up |
| Deliver classes, manage your account and send your student book | Performance of a contract, art. 6.1(b) | While you are a student, then blocked for up to 5 years to handle possible claims |
| Invoicing, accounting and tax obligations | Legal obligation, art. 6.1(c) | 6 years (art. 30 Spanish Commercial Code) |
| Newsletter and marketing emails (e.g. Business English Tips Weekly) | Consent, art. 6.1(a); for current or former students, legitimate interest under art. 21.2 LSSI-CE | Until you unsubscribe or withdraw consent |
| Contact a friend you refer | Legitimate interest, art. 6.1(f), only after you confirm your friend agrees to be contacted | One contact; deleted after 3 months if they don’t sign up |
| Teacher recruitment | Pre-contractual steps at the applicant’s request, art. 6.1(b); consent to keep the CV for future vacancies, art. 6.1(a) | Until the process ends, or 12 months with consent |
| Website analytics and improvement | Consent, art. 6.1(a), and art. 22.2 LSSI-CE | As set out in our Cookie Policy |
| Quality control, satisfaction surveys and defence of legal claims | Legitimate interest, art. 6.1(f) | For as long as needed for that purpose |
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. When the retention period ends, we delete or anonymise your data.
4. Children
We teach children aged 10 and over. Under Article 7 LOPDGDD, children under 14 cannot consent to the processing of their data: their parents or legal guardians must complete our forms, give consent and act as our contact. Students aged 14 to 17 may consent to data processing themselves, but contracts and payments must be made by their parents or guardians. We collect only the data needed to teach and never send marketing to minors.
5. Marketing emails
We only send you marketing emails if you ticked the optional box to receive them, or if you are or have been a student and they concern services similar to those you bought. Every email includes an unsubscribe link; you can also write to [email protected].
6. Recipients
We do not sell your data. We only share it with the following recipients, as far as necessary:
| Recipient | Purpose |
|---|---|
| Your teacher (employee or contractor) | Preparing and giving your lessons; bound by confidentiality and a data-processing agreement |
| IONOS, hosting provider (IONOS SARL, 7 place de la Gare, 57201 Sarreguemines, France) | Hosting the Website and its forms on servers in Germany (EU) |
| Cloudflare, Inc. | Content delivery network and protection against attacks |
| Video platforms you choose: Zoom, Google Meet or Microsoft Teams | Running your online lessons; their own privacy policies apply |
| Google (Analytics, Tag Manager) | Website statistics with your consent |
| Systeme.io | Sending newsletters and marketing emails |
| Brevo (Sendinblue SAS, France) | Sending service-related and marketing emails |
| Tally BV (Belgium) | Managing some of the Website’s forms, such as the contact form |
| Redsys and Stripe (card payments), PayPal (PayPal, Bancontact, MyBank) and our bank | Processing payments and transfers |
| WhatsApp (Meta) | Only if you contact us via WhatsApp |
| Accountants, lawyers and auditors | Professional advice, under confidentiality |
| Tax authorities, courts and other public bodies | Only where required by law |
7. International transfers
Some of our teachers and providers are located outside the European Economic Area (for example in the United Kingdom, the United States, Canada or other countries). We only transfer data with appropriate safeguards:
- a European Commission adequacy decision, such as those for the United Kingdom and Canada, or the EU–US Data Privacy Framework for certified US companies; or
- Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed.
You may ask us for a copy of the applicable safeguards.
8. Your rights
You have the right to:
- access your data;
- rectify inaccurate or incomplete data;
- erase your data when it is no longer needed or you withdraw consent;
- object to processing based on legitimate interest, including direct marketing;
- restrict processing in certain cases;
- data portability in a structured, commonly used format;
- withdraw consent at any time;
- not be subject to decisions based solely on automated processing.
To exercise them, email [email protected] with the subject “Data Protection”. If we cannot verify your identity, we may ask for further information. We reply within one month, extendable by two months for complex requests, in which case we will tell you.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es, or with the supervisory authority in your country of residence. We would appreciate the chance to resolve it with you first.
9. Security
We apply technical and organisational measures appropriate to the risk, such as encrypted (HTTPS) connections, access controls limited to staff who need the data, and confidentiality agreements with teachers and providers.
10. Automated decisions
We do not make decisions with legal or similarly significant effects based solely on automated processing. Our online level tests score answers automatically, but the result is only an estimate to help you choose the right level.
11. Language versions and changes
This policy is available in Spanish, English, French and German. In the event of any discrepancy, the Spanish version shall prevail. We may update this policy; we will notify students of significant changes by email. The date of the latest update is shown at the top.