Privacy Policy
Translation for information only. The Spanish version prevails.
Download PDFAt Balletymagia we handle the personal data of families and adult students with care and only as far as necessary. This policy explains what data we process, why, and what your rights are, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
Iuliia Petrova, NIE Z5383342J, a private individual trading as «Balletymagia». Address: Calle Aragón, 78, 3º 4ª, 08015 Barcelona. Email: balletymagia@gmail.com. Phone for data-protection matters: +34 611 879 541. Classes take place at the Attitude Skool studio, c/ Llançà, 31, bajos 1-2, 08015 Barcelona.
2. What data we process
Contact and identification data of parents or guardians and of adult students: name, surname, DNI/NIE, phone, email and address.
Children's data: name, date of birth, group and the people authorised to collect them. Data of children under 14 are always provided by their parents or guardians.
Bookings and attendance: packs purchased; classes booked, cancelled, used or lost.
Payments and invoicing: amounts, dates and proof of payment.
Health data (allergies, injuries or relevant conditions): only with your explicit consent and only to keep the student safe in class.
Images (photos and videos): only with a separate, voluntary image consent.
Communications: messages you send us via WhatsApp, email, Instagram or forms.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering enquiries and requests for information or a trial class | Pre-contractual steps at your request (art. 6.1.b GDPR) and, where applicable, consent (art. 6.1.a GDPR) |
| Managing enrolment, packs, bookings, attendance and class communications | Performance of the contract (art. 6.1.b GDPR) |
| Invoicing, accounting and tax obligations | Legal obligation (art. 6.1.c GDPR) |
| Health data for the student's safety | Explicit consent (art. 9.2.a GDPR) |
| Taking and using images | Consent (art. 6.1.a GDPR and art. 7 LOPDGDD), via a separate consent form |
| Sending school news and promotions | Consent (art. 6.1.a GDPR) |
Data needed for the contract are mandatory: without them we cannot provide the service. Consent to health data, images and news is voluntary, does not affect participation in classes and can be withdrawn at any time. We do not make automated decisions or create profiles.
4. Minors
Children's classes are always contracted by a parent or legal guardian. Data and consents concerning children under 14 are provided and given by their parents or guardians (art. 7 LOPDGDD). Anyone who gives us data about other people (for example, those authorised to collect a child) must inform them of this processing.
5. Retention periods
Contract, booking and attendance data: for the duration of the relationship and then for the statutory limitation periods.
Accounting and tax records: 6 years (art. 30 of the Commercial Code) and, for tax purposes, at least 4 years (General Tax Law).
Enquiries that do not lead to enrolment: deleted within 12 months at the latest.
Health data: while the student attends classes or until consent is withdrawn.
Images: while the image consent is in force and for no more than 5 years from capture.
News: until you withdraw your consent.
6. Recipients and processors
We do not sell or disclose your data to third parties unless required by law (for example, to the Spanish Tax Agency). To operate, we use providers who process data on our behalf with appropriate safeguards:
Google (Gmail, Google Drive, Google Forms and Apps Script for the electronic signature of consent forms);
WhatsApp and Instagram (Meta) to communicate with families and students;
Telegram, for a bot that records bookings and attendance;
Vercel (website hosting and anonymous, cookie-free visit statistics) and Neon (the database that stores requests sent through the website form);
Resend, the email service that notifies us of each form request;
and, where applicable, the banks or payment providers that process payments.
In the class WhatsApp or Telegram groups, your phone number may be visible to the other families or students in the group. If you prefer not to join the group, tell us and we will inform you individually.
7. International transfers
Some of these providers may process data outside the European Economic Area, in particular in the United States. In such cases the transfer relies on the EU-US Data Privacy Framework (European Commission adequacy decision), on standard contractual clauses approved by the Commission or on other safeguards under art. 46 GDPR.
8. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent at any time, by writing to balletymagia@gmail.com or calling +34 611 879 541. Withdrawing consent does not affect the lawfulness of earlier processing. We will reply within one month at the latest. If an image consent is revoked, we will reply within 15 days at the latest and from then on we will not take or publish new images; content already published does not necessarily have to be removed.
If you believe we have not handled your data properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Security
We apply reasonable technical and organisational measures: restricted access to data, protected accounts, and paper documents kept in a safe place.
10. Cookies
The website uses only technically necessary cookies, which do not require consent. If analytics or advertising cookies are ever used, your consent will be requested first through a cookie notice and a cookie policy will be published.
11. Changes
We may update this policy. The version in force is always the one published on the website, with its update date.