Privacy Policy

INFORMATION FOR USERS

This Privacy Policy explains how we collect personal data provided through our website, the purposes for which such data are used, the applicable legal bases, the recipients of the data, the applicable retention periods or criteria, and the rights available to data subjects.

By submitting any of our forms, the user confirms that they have read this Policy, and we will retain a record of that acknowledgement. Where the legal basis for processing is other than consent, this acknowledgement shall serve solely to provide information and to evidence that the relevant information has been made available, and shall not in itself constitute the legal basis for the processing.

1. DATA CONTROLLER

The controller of the data collected through this website is:

• Company name: THE ENGLISH SCHOOL OF ASTURIAS, S.A.

• Tax ID (NIF): A33513920
• Registered address: Finca La Llosona, s/n, 33192 Pruvia de Abajo, Llanera, Asturias
• Telephone: +34 985 23 71 71
• Contact email: infoasturias@esa.dukeseducation.es
• DPO email: dataprotection@dukeseducation.es

2. PURPOSE, LEGAL BASIS AND RETENTION

We collect and process your personal data through the forms available on our website:

Contact and admissions enquiry form

• Purpose: To respond to and manage your enquiries, requests for information or other requests submitted by the user; to provide information about the School’s services and admissions process; and to contact you in connection with your request.
• Legal basis: Processing is based on the consent given by submitting the form. Where the request relates to the possible provision of educational services, processing may be based on taking steps at the request of the data subject prior to entering into a contract.
• Retention: Data will be retained for as long as necessary to respond to and manage the request and, at most, for six months from the last interaction, unless the request gives rise to a pre-contractual or contractual relationship or it is necessary to retain the data for a longer period in order to address potential liabilities.

Open Day Form

• Purpose: To manage your request to attend the School’s Open Day, organise the visit, contact you in connection with the event, and respond to any questions or comments you may submit.
• Legal basis: Processing is based on the consent given by submitting the form and requesting participation in the Open Day.
• Retention: Data will be retained for as long as necessary to manage attendance at the Open Day and for a maximum of six months from the last interaction, unless an admissions process is subsequently initiated or a pre-contractual or contractual relationship is established with the School.

School Visit Request Form

• Purpose: To manage and organise the requested visit to the School, contact you to confirm the date and time, provide information about the School and its admissions process, and respond to any questions or comments you may have.
• Legal basis: The processing is based on taking steps at the request of the data subject prior to entering into a contract and, where applicable, on consent in respect of any additional information voluntarily provided.
• Retention: The data will be retained for as long as necessary to manage the visit and follow up on the request and, in any event, for no longer than six months from the last interaction, unless an admissions process is commenced or a pre-contractual or contractual relationship with the School is established.

Admissions Process Application Form

• Purpose: To manage your enquiry concerning the potential admission of your child to the School, provide information about the relevant educational programme and admissions process, contact you in connection with your application and, where admission is granted, take the necessary steps to formalise enrolment.
• Legal basis: The processing is based on taking steps at the request of the data subject prior to entering into a contract and, where applicable, on consent in respect of any additional information voluntarily provided and on compliance with the School’s applicable legal obligations. Where special categories of personal data are processed, including certain information relating to the pupil’s health or specific needs, such processing will only take place where a valid condition under Article 9(2) GDPR applies.
• Retention: The data will be retained for the duration of the admissions process. Where enrolment is completed, the necessary data will be retained for as long as required to address any potential liabilities arising from the process and will subsequently be erased or blocked in accordance with applicable law.

Application Form

• Purpose: To process and assess the child’s application for admission to the School, manage the admissions process, contact parents or legal representatives in connection with the application and, if the child is admitted, take the necessary steps to formalise enrolment.
• Legal basis: Processing is based on taking steps at the request of the data subject prior to entering into a contract and, where applicable, compliance with applicable legal obligations. Where data is collected for which processing requires consent, such consent will be requested separately and specifically.
• Retention: Data will be retained for the duration of the admissions process. If enrolment is formalised, the necessary data will be retained for the duration of the relationship with the School and for the periods required by law. Otherwise, the data will be retained for as long as necessary to address any potential liabilities arising from the admissions process.

Summer Camp Form

• Purpose: To manage the application for and participation of the child in the Summer Camp, including the organisation of activities and related services, including school transport where applicable; to manage invoicing and payments; to meet the child’s needs; and, where necessary, to process information relating to allergies, intolerances, medical conditions or specific needs. Where authorised, photographs or videos of the child may also be taken and published on the School’s website and social media channels.
• Legal basis: Registration for and participation in the Summer Camp are based on the performance of the contractual relationship and on taking steps prior to entering into a contract. The processing of health data is based on the explicit consent of the child’s parent or legal guardian and, in emergency situations, where necessary to protect the child’s vital interests. In emergency situations, the protection of the child’s vital interests may therefore also apply. The publication of photographs and videos is based on express consent.
• Retention: The data will be retained for as long as necessary to manage participation in the Summer Camp and, thereafter, for the legally required retention periods. Health data will be retained for as long as necessary to ensure the child’s appropriate care and safety, and photographs and videos will be retained for as long as the relevant consent has not been withdrawn and the purpose for which they were authorised remains applicable.

Join Us

• Purpose: To manage your application and participation in the School’s recruitment processes, assess your professional profile and contact you in connection with your application and, where you have authorised it, in connection with future recruitment processes.
• Legal basis: Processing of data for the purpose of managing an application is based on taking steps at the candidate’s request prior to entering into a contract. Retention of the application for future recruitment processes is based on the data subject’s consent.
• Retention: Data will be retained for the duration of the relevant recruitment process. Where the candidate has authorised its retention for future recruitment processes, it may be retained for a maximum of one year. After this period, if the candidate wishes to continue participating in the School’s recruitment processes, they must submit their CV again.

Sending of Information Communications

• Purpose: To send, where the user has authorised this, information communications relating to the School and Dukes Education, its activities, events, educational programmes, information sessions or other updates that may be of interest.
• Legal basis: Processing is based on the user’s express consent.
• Retention: The data will be retained for as long as the user does not withdraw the consent given for this purpose.

3. TYPES OF DATA COLLECTED

The types of personal data that may be processed include:

• Identification and contact details of the user, parents, guardians or legal representatives;

• Identification and contact details of the pupil;
• Identification documents where required for the relevant process;
• Date and place of birth, nationality and other administrative information relating to the pupil;
• Data relating to the year group applied for, expected start date and admissions process;
• Academic data, educational history, previous schools, curriculum, language of instruction, dates of attendance and other educational information necessary to assess the admissions application;
• Languages, interests, activities, achievements and other relevant information provided during the process;
• Family data and information relating to the legal representatives’ relationship with the child;
• Certain professional or administrative details relating to parents or legal representatives where necessary to manage the relevant process;
• Financial, banking or payer-related information where necessary to manage contracted services or payments;
• Data relating to academic references or contact persons at previous schools;
• Data required to manage participation in Summer Camp, activities, transport or other related services;
• Health data, allergies, intolerances, medical conditions, educational needs or support needs where their processing is necessary and a valid legal basis applies;
• Photographs or videos where their taking or use has been authorised;
• Professional, academic and CV information relating to candidates in recruitment processes;
• Any additional information voluntarily provided by the user in free-text fields.

The website may also collect data arising from browsing activity and the use of similar technologies, as set out in the Cookie Policy. Please refer to that policy for detailed information on the cookies used, their purpose, duration, ownership, legal basis and how they can be configured or rejected.

As a general rule, users are advised not to provide special categories of personal data or information that is not necessary for the purpose of the relevant form through free-text fields. However, certain forms may require the processing of special categories of data, such as health data necessary to ensure the appropriate care and safety of a child during the Summer Camp. Such data will be processed solely for the stated purposes and in accordance with the applicable legal bases under Articles 6 and 9 of the GDPR.

4. RECIPIENTS OF THE DATA

All personal data provided by the user may be disclosed to:

• Public authorities, in the cases provided for by law, on the basis of compliance with a legal obligation.

• Courts and tribunals, in the cases provided for by law, on the basis of compliance with a legal obligation.
• Banks and financial institutions, where applicable, for the collection of payment for the services provided.
• Other entities within the Dukes Education group where necessary.

In addition, THE ENGLISH SCHOOL OF ASTURIAS, S.A. will engage third-party service providers that may have access to personal data and will process such data on behalf of THE ENGLISH SCHOOL OF ASTURIAS, S.A. for the provision of the contracted services.

For this purpose, THE ENGLISH SCHOOL OF ASTURIAS, S.A. follows rigorous procedures for selecting service providers in order to comply with its data protection obligations, including entering into the relevant data processing agreement in accordance with Article 28 of the GDPR.

In particular, THE ENGLISH SCHOOL OF ASTURIAS, S.A. will use third-party service providers operating, by way of example and without limitation, in the fields of legal advice and technological and IT services.

No international transfers of personal data outside the European Economic Area are carried out. If services involving international transfers of personal data are used, such transfers will be carried out subject to the appropriate safeguards provided for in Articles 44 et seq. of the GDPR, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, Binding Corporate Rules or other valid mechanisms under applicable legislation.

5. USER RESPONSIBILITY

The user guarantees that they are over fourteen (14) years of age and that the data provided to THE ENGLISH SCHOOL OF ASTURIAS, S.A. is true, accurate, complete and up to date. For these purposes, the user is responsible for the accuracy of all data provided and shall keep the information supplied duly updated so that it reflects their actual circumstances.

Likewise, the user guarantees that, where they provide personal data relating to third parties, they have informed those third parties of the matters contained in this document. The user also guarantees that they have obtained their authorisation to provide their data to THE ENGLISH SCHOOL OF ASTURIAS, S.A. for the stated purposes.

In all cases, the User shall be responsible for any false or inaccurate information provided through the website and for any direct or indirect loss or damage caused to THE ENGLISH SCHOOL OF ASTURIAS, S.A. or to third parties as a result.

6. EXERCISE OF RIGHTS

As the data subject, the user may write to THE ENGLISH SCHOOL OF ASTURIAS, S.A. at the address indicated at the beginning of this Privacy Policy or send an email to dataprotection@dukeseducation.es at any time and free of charge, in order to exercise the following rights:

a) Right of access:

You have the right to obtain confirmation from THE ENGLISH SCHOOL OF ASTURIAS, S.A. as to whether or not your personal data is being processed and, where that is the case, to access such data and receive information concerning, among other matters, the purposes of the processing, the categories of personal data concerned, the recipients to whom your personal data has been disclosed and the envisaged retention period.

b) Right to Erasure:

You have the right to request the erasure of your personal data where the applicable legal requirements are met.

c) Right to Object:

You have the right to object to the processing of your personal data at any time, on grounds relating to your particular situation, where the processing is based on our legitimate interests.

d) Right to rectification:

You have the right to request the rectification of inaccurate personal data concerning you.

e) Right to restriction of processing:

In certain circumstances (for example, where the applicant contests the accuracy of their data, while its accuracy is being verified), you may request that the processing of your personal data be restricted, in which case such data will only be processed for the establishment, exercise or defence of legal claims.

f) Right to data portability:

You have the right to receive the personal data you have provided to THE ENGLISH SCHOOL OF ASTURIAS, S.A. in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the controller to which the personal data were provided, in the cases provided for by law.

g) Right not to be subject to automated individual decision-making:

No automated individual decisions are made and no profiling with legal effects is carried out.

h) Withdrawal of consent:

Where processing is based on consent, the user may withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Consent may be withdrawn by submitting a request through the channels indicated in this section.

Finally, you are informed that you may lodge a complaint concerning the protection of your personal data with the Spanish Data Protection Agency (www.aepd.es) where you consider that THE ENGLISH SCHOOL OF ASTURIAS, S.A. has infringed the rights granted to you under applicable data protection legislation.

The period for responding to your request as a data subject is one month from receipt of the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests received.

7. SECURITY MEASURES

THE ENGLISH SCHOOL OF ASTURIAS, S.A. will process the User’s data in strict confidence at all times and will comply with the applicable duty of confidentiality, in accordance with applicable legislation. To this end, it will adopt the necessary technical and organisational measures to ensure the security of the data and prevent their alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which they are exposed.

8. ACKNOWLEDGEMENT AND CONSENT

The User confirms that, before submitting each form or before the relevant processing takes place, they have been informed of the key aspects concerning the processing of their personal data. Where processing requires consent, such consent must be given by means of a clear, specific and informed affirmative action, such as ticking a non-pre-ticked box linked to the particular processing activity.

Acceptance of this Privacy Policy does not, in itself, replace any specific consent that may be required for certain processing activities.

9. COOKIES AND SIMILAR TECHNOLOGIES

The website may use first-party and third-party cookies and similar technologies for different purposes. Technical or strictly necessary cookies may be used without the user’s consent where they are essential for the operation of the website or for the provision of a service requested by the user.

Non-essential cookies, including analytics, advertising or third-party cookies, will only be installed where the user has given their consent through the relevant cookie settings panel or banner.

The user must be able to accept, reject or configure cookies easily, free of charge and with the same level of ease.

Detailed and up-to-date information about the cookies used, their ownership, purpose, duration, legal basis and how they can be configured or rejected is available in the Cookie Policy.

10. REQUIREMENT TO PROVIDE DATA

As a general rule, the data requested in the forms is mandatory (unless otherwise indicated in the relevant field) in order to fulfil the purposes for which it is collected.

Therefore, if such data is not provided or is not provided correctly, we will not be able to respond to your requests, without prejudice to your ability to freely view certain content on our website.

11. UPDATES TO THE PRIVACY POLICY

We continuously strive to improve our services, processes and the protection of data subjects’ rights. We therefore reserve the right to review this Privacy Policy whenever we consider it appropriate, in which case the version currently published on the website will apply.

Last updated: 07/09/2026