Informativa sulla privacy

Who we are

Geuropia places international students on Spanish language courses in Spain. We decide what happens to the information described here, which makes us the data controller for it.

Our registered name and address are not on this page yet, which is why it is marked as a draft. They will be here before we take applications from the public.

You can reach us about anything on this page at ${site.email}.

What we collect

When you apply we collect: your name, date of birth, email address, phone number and — if you tell us — which messaging apps that number is on; an emergency contact; your postal address; your nationality, passport number and passport expiry date; your sex, if you give it; the course, city, dates and accommodation you are applying for; your Spanish level; and anything you write in the comments.

Before we accept an application we send a six-digit code to your email address and ask you to type it back, so we know the address works and reaches you.

You also upload documents: the photo page of your passport, a passport-style photograph, your diploma, the receipt for what you paid the school, and the papers your consulate asks for. We process whatever those documents contain.

If you use the assistant, we keep what you typed and what it answered, so a person can pick the conversation up afterwards. If you sign in to the portal, we keep the messages between you and us there.

We do not ask for, and do not want, information about your health, religion, political views or anything else the law treats as a special category. Please do not send it. If it reaches us anyway, we do not use it to decide anything and we delete it where we can.

Why we process it, and what allows us to

To prepare and submit your enrolment to the school you chose, to prepare the documents a Spanish consulate asks for when you have asked us to, and to answer your questions about your own application. We do this to perform the agreement between you and us, and to take the steps you ask for before that agreement exists — Article 6(1)(b) of the GDPR. Checking that your email address works is part of the same purpose.

To read your passport photograph automatically and fill the form in for you, and — separately — to keep that same photograph as your passport document. Each is its own tick box and neither is ticked for you. We do this because you consented: Article 6(1)(a).

To measure how this site is used, and to record how our marketing pages are used with Microsoft Clarity. Again because you consented, and you can withdraw that consent at any time.

To keep your file for up to three years after we finish, so we can answer a question about a past enrolment or visa file and defend ourselves if a claim is made, and to protect the site from abuse. We do this because we have a legitimate interest in it — Article 6(1)(f). Ask us and we will explain how we weighed that against your privacy.

We do not use your information for marketing. If you told us which messaging apps your number is on, that is a note about the number and not permission to message you: we write to you about your own application and nothing else.

What you have to give us

Most of the application is information a school or a consulate will not proceed without: your name, date of birth, contact details, nationality, passport number and expiry, the course you want, and the documents listed above. You are not obliged to give them, but without them we cannot prepare your enrolment or your visa file, and we would have to stop working on your application.

Some things are optional and nothing happens if you leave them out: which messaging apps your number is on, your sex, your comments, and both passport-photograph boxes. Every field the automatic reader would fill in can be typed by hand instead, and your application is handled the same way whichever you choose.

Who sees it

The language school you are applying to. It needs your information to enrol you and to issue your acceptance letter, and it decides for itself how it handles what it holds — so its own privacy policy applies alongside this one.

Telegram FZ-LLC. Every application, including the documents you upload, is delivered into a private workspace we run on Telegram, where each application has its own thread. Our admissions team works there, and access is limited to the people working on applications and to Telegram as the operator of that service.

Anthropic, in three situations and no others: when you ask for your passport photograph to be read; when you write to the assistant, including a summary we make of that conversation afterwards so a person can pick it up; and when you press translate in your portal, which sends the message we wrote to you so it can be shown in your language. What we send is not used to train models.

Microsoft, if you agreed to measurement. Its Clarity service records how our marketing pages are used — clicks, scrolling, how far a page was read — and plays it back to us as a session. We do not load it on the application form, in your portal, on the pages where you talk to us, or on the page a sign-in link opens; the cookies page lists them. We also mark the contents of those pages so they are masked if the script ever reaches them.

The suppliers who host our site, store our database and send our email, acting on our instructions, and the push service your own browser uses if you turn on notifications.

Anyone we are required to share it with by law, or in order to defend a legal claim. We do not sell your data and we do not share it for advertising.

Where it is held, and when it leaves Europe

Our servers are in the European Union.

Some of the companies above are not. Telegram FZ-LLC is in the United Arab Emirates; Anthropic and Microsoft are in the United States. The European Commission has not decided that the United Arab Emirates protects personal data adequately, so a transfer there needs a safeguard of its own under Article 46.

Putting those safeguards in place, and being able to send you a copy of them, is one of the things this page is marked as a draft until we have done. If you want to know where that stands before you apply, ask us.

How long we keep it

Your application file: while we are working on it, and for up to three years afterwards. Some records attached to money — a payment receipt, for instance — may have to be kept longer because Spanish tax and accounting rules say so.

Documents you upload: deleted from our own servers as soon as they reach the admissions workspace. The copy in that workspace is removed when you ask us to remove it.

A passport photograph sent to the automatic reader: held only for as long as the reading takes and not saved to our storage — unless you also ticked the box to keep it as your passport document, in which case it follows the rule for documents.

Assistant conversations and the summaries made from them: kept with the rest of the record of your contact with us.

Measurement: individual events are deleted after twelve months, and the visit and visitor records after twenty-four.

Email codes, sign-in links and portal sessions expire in minutes or hours and are deleted once used or expired.

Decisions about you are made by people

We do not make decisions about you by automated means, and we do not profile you.

The automatic passport reader is not an exception. It reads the printed text on a photograph and puts what it finds into the form for you to check and correct before you submit anything. It decides nothing on its own, and you can type every field by hand instead.

Your rights

You can ask us for a copy of what we hold about you; ask us to correct it; ask us to delete it; ask us to stop using it for a while, while a disagreement is sorted out; and object to our using it where we rely on our legitimate interest.

You can also ask us to send you what you gave us in a form a computer can read, or to send it straight to somebody else where that is technically possible.

Where we rely on your consent — the passport reader, keeping that photograph, and measurement — you can withdraw it at any time. Measurement is on the cookies page; for anything else, write to us. Withdrawing does not make what we did beforehand unlawful.

Write to us at ${site.email}. We reply within one month. If a request is complicated we may take up to two months more, and we will tell you why within the first month.

If you think we have handled your data badly you can complain to a data protection authority — the one where you live, the one where you work, or the one where the problem happened. In Spain that is the Agencia Española de Protección de Datos. Complaining to them does not stop you writing to us as well.

The person you name as your emergency contact

When you give us an emergency contact you are giving us somebody else's name and phone number. Please tell them. We keep those details with your application file, use them only to reach that person if something goes wrong while you are on your course, and delete them when we delete the rest of your file. If they write to us, they have the same rights over their details as you have over yours.

Cookies and measurement

This site sets no advertising cookies and shares nothing with an advertising network. If you agree to measurement, we use our own first-party cookies to see how the site is used, and Microsoft Clarity records how our marketing pages are used.

The lawful basis for all of it is your consent. You are asked before anything is stored, and you can change your answer at any time on the cookies page. Declining does not limit any feature of this site.

Our own measurement is built not to record what you type. It records that a field reported an error, not what was in it.

The cookies page lists every cookie by name, says how long each lasts, names the pages Clarity is not loaded on, and explains what a part-finished application saves in your own browser.

Changes to this page

We update this page when what we do changes, and the date above is the date of the last change. If a change matters to you — a new company receiving your data, or a new reason for using it — we will say so before it starts.