Privacy policy

Version: 12 October 2026

This policy explains which personal data we process when you use our website and our services, why we do so, who receives it and what rights you have. We only process personal data in accordance with the EU General Data Protection Regulation (GDPR) and German data protection law (BDSG, TDDDG).

1. Who is responsible

Peter und Michael Hughes Sprachdienste GbR, Lindenthaler Straße 7, 04155 Leipzig, Germany
Email: info@estudia-espana.eu, phone: +49 151 433 230 56
(“we”, “Estudia-España”). See also our legal notice.

We are not required to appoint a data protection officer. For all questions about your data, please write to the email address above.

2. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, on servers in Germany. We have a data processing agreement with the host (Art. 28 GDPR).

When you visit the website, your browser automatically sends information that the server stores in log files: IP address, date and time, the page requested, the referring page, browser and operating system. We need this data to deliver the website and keep it secure (Art. 6 (1) (f) GDPR – our legitimate interest in a secure, working website). Log files are deleted after at most 7 days, unless a security incident has to be investigated.

To protect our forms from abuse we also use hidden spam-trap fields and a counter that limits the number of requests per IP address; the counter keeps the IP address for about 10 minutes (Art. 6 (1) (f) GDPR – our legitimate interest in secure forms, see also section 12).

3. Cookies and similar technologies

This table shows what our website stores in your browser or reads from it, and which third-party services are involved. Without your consent we only use what is technically necessary (§ 25 (2) TDDDG). Everything from Google Analytics needs your consent (§ 25 (1) TDDDG).

Name	Provider	Purpose	Duration
pll_language (cookie)	Estudia-España (our website)	Remembers the language you chose. Set when you visit.	1 year
ee_consent (localStorage)	Estudia-España (our website)	Remembers your choice in the cookie banner.	182 days (about 6 months)
_ga (cookie)	Google Ireland Limited (Google Analytics, only with your consent)	Tells visitors apart for usage statistics.	2 years
_ga_<container ID> (cookie)	Google Ireland Limited (Google Analytics, only with your consent)	Keeps the state of your visit (session) for usage statistics.	2 years
_gid, _gat (cookies)	Google Ireland Limited (only with your consent)	Only if our Google Tag Manager container sets them (depending on the GTM container): statistics, request limiting.	_gid: 1 day, _gat: 1 minute
Cloudflare Turnstile (no cookie)	Cloudflare, Inc., USA	Spam protection on the enquiry and booking forms. It starts when you first click, tap or type in the form (or scroll close to it), without a choice in the cookie banner, because it is a security measure. Your IP address and browser data go to Cloudflare. No cookie is set (see section 12).	No cookie; no data stored in your browser
Google Maps (cookies set by Google)	Google Ireland Limited	Map on school pages, only after you click “Show map” (see section 11).	Set by Google
YouTube (youtube-nocookie.com)	Google Ireland Limited	School videos, only after you click the video (privacy-enhanced mode, see section 11a).	Set by Google

You can change your choice at any time with the “Cookie settings” link at the bottom of every page. If you decline or withdraw your consent, the Google Analytics cookies on this website are deleted.

4. Enquiries and contact

When you send us an enquiry (enquiry form, school group form, email or phone), we process the data you give us – usually your name, contact details, your travel plans and your message – to answer you and to prepare an offer (Art. 6 (1) (b) GDPR – steps prior to a contract; otherwise Art. 6 (1) (f) GDPR – our interest in answering enquiries). If your enquiry does not lead to a booking, we delete it after two years at the latest.

4a. WhatsApp chat

Our website has a WhatsApp button. It is a simple link: no data is sent to WhatsApp when you open our pages or see the button. Only if you click it and write to us do you start a chat with us on WhatsApp Business, a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta group). We then process your phone number, your WhatsApp profile name and the content of your messages to answer your question (Art. 6 (1) (b) GDPR – steps prior to a contract; otherwise Art. 6 (1) (f) GDPR – our interest in answering enquiries quickly).

WhatsApp encrypts messages end to end, but WhatsApp processes further data, such as your phone number and when you write, under its own privacy policy. WhatsApp states that it transfers data to countries outside the EU, including the USA, using safeguards recognised under EU law (e.g. adequacy decisions or standard contractual clauses; see also section 10).

We delete chats and contact details after 12 months at the latest. If a booking results from the chat, the booking data is kept as described in section 5. Please do not send health information via WhatsApp; use the booking form for that. If you prefer not to use WhatsApp, you can reach us by email, phone or through our forms.

5. Bookings

To arrange your language course and accommodation we process the data from the booking form: names, dates of birth, gender (optional), nationality (optional), whether you are a complete beginner, address and contact details, your course, dates and accommodation choices, special requests and your messages, as well as payments (Art. 6 (1) (b) GDPR – performance of the contract).

Without name, date of birth and contact details we cannot arrange a booking. We do not use automated decisions with legal effect for you and we do not create profiles. If you book for another person (for example your child or a travel companion), you confirm that you may give us their data and that you will inform them about this policy. If the student is under 18, a parent or legal guardian makes the booking and consents to the processing of the child’s data, including health information.

• Availability check with the school. When you send a booking request, we ask the school whether your course and accommodation are available. This request contains no names or contact details: only the course, dates, accommodation, the students’ age, gender and beginner status, and your special requests.
• After confirmation. The school you book receives the data it needs to enrol you and arrange your accommodation (e.g. names, date of birth, gender, nationality, contact details, arrival and special requests; Art. 6 (1) (b) GDPR).
• Schools outside the EU. Some of our partner schools are in countries outside the EU (currently Argentina, Costa Rica, Ecuador and Mexico). For Argentina the EU Commission has decided that the data protection level is adequate (Art. 45 GDPR). For Costa Rica, Ecuador and Mexico there is no such decision; we then pass on your data only to the extent necessary to carry out the booking you requested (Art. 49 (1) (b) GDPR). The school is responsible for its own use of your data (see the next point).
• Schools and other recipients. The school is responsible for the data you give it in order to enrol you and organise your stay; it has its own privacy notice, which it provides to you. The school may pass your data to the host family or residence where you stay. Besides the schools we use the service providers named in this policy and our banks, and we pass data to authorities where the law requires.
• Health and dietary information. If you tell us about allergies, health issues, a disability or dietary needs, we only use this information to handle your booking: we pass it on to the school and your accommodation (also outside the EU) and have it translated (section 6). For this we ask for your explicit consent with a tick box in the booking form, which appears when you write in the field for special requests (Art. 9 (2) (a) GDPR). Without the tick we do not accept text in this field. We save your consent with the date and time. You can withdraw it at any time for the future.
• Quote as PDF. If you download a quote, the optional name “Prepared for” is only used to create the file and is not saved.
• Your booking page. Every booking has a private page (link in our emails) showing its status, dates and payments. The link contains a secret code; please do not share it.
• Retention. Booking requests that were not confirmed or paid: we delete the data 12 months after the request. Paid bookings: we keep the accounting records for the statutory period (currently up to 8 years, § 147 AO, § 257 HGB; Art. 6 (1) (c) GDPR); the rest of the booking data, including health information, we delete 12 months after your course ends. If we need data to defend legal claims, we keep it as long as necessary (Art. 6 (1) (f) GDPR).

6. Translation of special requests (OpenAI)

If you write special requests in a language other than English, we have them translated into English for the school with the interface (API) of OpenAI Ireland Limited, Dublin, Ireland, which may process data in the USA. Only the text of your request is sent – not your name or contact details – and we automatically remove email addresses, web links, phone numbers and bank account numbers from it first. Please do not write such data in this field. The school always receives your original text as well.

OpenAI processes the text on our behalf under a data processing agreement (Art. 28 GDPR) and, as OpenAI states, does not use data sent through its API to train its models and deletes it after a short period (currently up to 30 days). Transfers to the USA are based on the EU standard contractual clauses (Art. 46 GDPR). Legal basis: Art. 6 (1) (b) GDPR; for health or dietary information, your explicit consent given with the tick box in the booking form (Art. 9 (2) (a) GDPR, see section 5). If you do not tick the box, we do not accept the text and nothing is sent to OpenAI.

7. Emails

We send booking emails, availability requests to schools and review requests through our own mailbox at our host (see section 2). Emails are transmitted with transport encryption where the receiving server supports it.

For error tracking we log the recipient address and subject of recent emails in our database for 30 days (at most the last 300 emails). Only administrators can read this log.

8. Reviews

A few days after your course we ask you once by email for a review of the school, your course, your accommodation (if booked through us) and the city (Art. 6 (1) (f) GDPR and § 7 (3) UWG, our interest in reliable reviews from people who really booked with us). We save your ratings, your comments, the name and home town you enter, your language and the booking number. After a short check we publish your rating of the school and your comment on it on our website with the name and home town you enter. Your other ratings and comments are used internally and may be published later after approval. We may shorten a comment but do not change its meaning. You can object to the email at any time by replying to it; we then add your address to a block list (we store only a coded form of it) and do not ask again. You can ask us at any time to remove your review. We then delete your comments, your name and home town and the link to your booking; only the star ratings stay, without any link to you, as part of the school’s quality record. We keep reviews until you ask for removal. The review link in the email is valid for 90 days after your course.

9. Newsletter (Brevo)

If you tick the newsletter box, we send you news and offers by email (Art. 6 (1) (a) GDPR – your consent). Our newsletter service is Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), which stores your email address, your name and the list you signed up for on servers in the EU, on our behalf (Art. 28 GDPR). You can unsubscribe at any time with the link in every newsletter or by writing to us; we then delete your address from the list. We have switched off open and click tracking in Brevo: we do not measure whether you open our emails or click links in them. We save your consent together with the enquiry or booking request, including the date. You can tick the box in the enquiry forms and in the booking form; we then send you a confirmation email first (double opt-in) and add you to the newsletter list only after you confirm.

10. Analytics: Google Tag Manager and Google Analytics 4 (only with your consent)

With your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG) we use Google Analytics 4 to understand how our website is used – for example which pages are read and where visitors come from – and to improve it. It is loaded through Google Tag Manager. Both are services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Without your consent neither is loaded. We use Google Consent Mode: our website tells Google’s tools which consent you have given, and advertising features stay switched off in any case. With your consent, Google Analytics sets cookies (_ga and _ga_<container ID>, up to 2 years each; see the table in section 3) and processes usage data such as pages visited, device, browser and approximate location; IP addresses are not stored. Data is kept for 14 months. Google may transfer data to the USA; Google LLC is certified under the EU–US Data Privacy Framework, which the EU Commission recognises as providing an adequate level of protection (Art. 45 GDPR).

You can withdraw your consent at any time with the “Cookie settings” link at the bottom of every page. We then stop the analytics on that page and delete the Google Analytics cookies. We never load Google Tag Manager on the private links to your booking, to the school’s reply or to the review form, so these addresses are not sent to Google.

11. Maps (Google Maps)

School pages can show the school on a map from Google Maps (Google Ireland Limited, see above). The map is only loaded when you click “Show map”; until then no data is sent to Google. When you load it, Google receives your IP address and information about your browser and may set cookies (Art. 6 (1) (a) GDPR – your consent by clicking). Data may be transferred to the USA (EU–US Data Privacy Framework, see section 10).

11a. Videos (YouTube)

School pages can show videos from YouTube (Google Ireland Limited, see above). A video is loaded only after you click it; until then no data goes to YouTube. We use the privacy-enhanced mode (youtube-nocookie.com). When you play a video, Google receives your IP address and browser data and may store or read information on your device (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG – your consent by clicking). Data may be transferred to the USA (EU–US Data Privacy Framework, see section 10).

12. Spam protection (Cloudflare Turnstile)

Our booking and enquiry forms are protected against spam and abuse by Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Turnstile checks in the background whether a form is sent by a person. You normally see nothing; a small box only appears if the check needs your help. For this, data about your browser and your interaction with the page (e.g. IP address, browser characteristics) is processed by Cloudflare.

The check starts when you first click, tap or type in one of these forms, or when you scroll close to it – not when you open the page, and only on the booking and enquiry forms. It runs without a choice in the cookie banner, because it is a security measure that protects the form you want to use. It sets no cookie and stores nothing in your browser. Legal basis: Art. 6 (1) (f) GDPR – our legitimate interest in protecting our forms and your data from abuse.

Cloudflare as recipient. Cloudflare, Inc. receives the data named above on our behalf under a data processing agreement (Art. 28 GDPR). The data may be processed in the USA; Cloudflare is certified under the EU–US Data Privacy Framework, which the EU Commission recognises as providing an adequate level of protection (Art. 45 GDPR). We use no other Cloudflare service on this website. If you block Turnstile in your browser, you can still reach us by email, phone or WhatsApp.

13. Fonts

The fonts on this website are stored on our own server. No connection to font providers such as Google Fonts is made.

14. Payments

Payments are made by bank transfer. Your bank and ours process the payment data (Art. 6 (1) (b) GDPR). If you pay the rest of the price directly to the school, the school and its bank process that payment.

15. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR), unless we have to keep it by law;
• receive your data in a common, machine-readable format (Art. 20 GDPR);
• withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR);
• object at any time to processing based on our legitimate interests (Art. 6 (1) (f) GDPR), on grounds relating to your particular situation, and to direct marketing without giving reasons (Art. 21 GDPR);
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany.

To exercise your rights, write to info@estudia-espana.eu.

16. Changes

We update this policy when our website or services change. The current version is always available on this page.