Data protection
Privacy Policy
How Barcelona Montessori School looks after the personal data of students, families, visitors and job applicants.
The essentials
- Who is responsible
- OBJETIVO EXCELENCIA, S.L. (Barcelona Montessori School), NIF B67519371
- Data Protection Officer
- Núria Quintero · nuria.q@barcelonamontessorischool.com
- Why we use data
- To answer enquiries and manage admissions, educate and care for students, keep them safe, run the school's administration, keep families informed and, with permission, share images of school life.
- Legal bases
- The enrolment contract and steps before it, legal obligations under education, child-protection and tax law, protecting students' vital interests, legitimate interests, and consent where we ask for it.
- Who receives it
- Only staff who need it, service providers working for us under contract, and authorities when the law requires. We never sell data or use it for advertising.
- Outside the EU
- Two providers, Google and Cloudflare, are based in the United States. Both are certified under the EU–US Data Privacy Framework.
- Your rights
- Access, correct, delete, restrict, object, portability and withdraw consent. Email info@barcelonamontessorischool.com. You can also complain to the AEPD.
1Who is responsible for your data
| Data controller | OBJETIVO EXCELENCIA, S.L., trading as Barcelona Montessori School · NIF B67519371 |
| Address | C/ de l'Esperança 13, 08017 Barcelona (also Carrer de Pomaret 25, 08017 Barcelona) |
| Contact | info@barcelonamontessorischool.com · +34 931 420 972 · +34 930 27 26 55 |
| Data Protection Officer | Núria Quintero · nuria.q@barcelonamontessorischool.com |
2Who this policy covers
This policy applies to the personal data of current and former students and their families or guardians, families who enquire, visit or apply, visitors to this website and to our campuses, and job applicants. Staff receive a separate notice.
Most of our students are children. We collect only what we need, limit who can see it and take extra care with health and safeguarding information.
3The data we collect
Families and guardians
Names, contact details, preferred language, relationship to the student, the identity documents needed for enrolment, bank details for fees, and our correspondence with you.
Students
Name, date of birth, nationality, languages and previous schooling; observations, work, progress records and reports; health, allergy, dietary and emergency information; learning-support and safeguarding records; photos and videos, where authorised.
Families who enquire or visit
What you give us in the interest form or when booking an information session: names, contact details, your children's ages, the start date you're considering and your questions.
Job applicants
Your CV, cover letter and references. Before hiring, we also need the certificate from the Central Sex Offenders Register that the law requires for anyone working with children.
Website and campus visitors
The technical data needed to run the site securely (such as IP address and browser type), your cookie choice and anything you send through a form. Our visitor statistics don't use cookies and don't identify you. At our campus entrances, security cameras record images.
Most of this data comes from you. Some comes from others, for example a student's previous school, health professionals you authorise, or the education authorities.
4Why we use it, on what legal basis, and for how long
| Purpose | Legal basis (GDPR) | How long we keep it |
|---|---|---|
| Answering enquiries, visits, information sessions and admissions | Steps you ask for before enrolment (art. 6.1.b); your consent for follow-up messages (art. 6.1.a) | 2 years after the last contact, unless you enrol or ask us to delete it sooner |
| Enrolment, teaching, records and reports, including our school-management platform | The enrolment contract (art. 6.1.b); legal obligations under education law, including additional provision 23 of the LOE (art. 6.1.c) | While the student is with us. Official academic records are kept as education law requires. Other files are kept 5 years after the student leaves. |
| Health, allergies, school meals and emergencies | Legal duties to protect students (art. 6.1.c), vital interests (art. 6.1.d); for health data, your explicit consent and the protection of vital interests (art. 9.2.a and 9.2.c) | While the student is with us. Deleted at the end of the school year in which they leave, unless needed for an incident or claim. |
| Child protection and wellbeing | Legal obligation under Organic Law 8/2021 (LOPIVI) and substantial public interest (art. 6.1.c and 9.2.g) | As long as needed to protect the child and meet our legal duties |
| Fees, invoices and accounting | The enrolment contract (art. 6.1.b); tax and accounting law (art. 6.1.c) | 6 years, as required by the Commercial Code and tax law |
| Messages to families and the monthly newsletter | The enrolment contract and our legitimate interest in keeping the school community informed (art. 6.1.b and 6.1.f) | While you're part of the school. You can unsubscribe from the newsletter at any time. |
| Photos and video on our website, social media and newsletter | Consent from parents, and from the student if aged 14 or over (art. 6.1.a; Organic Law 1/1982) | Until consent is withdrawn |
| Job applications | Steps before a contract (art. 6.1.b); legal obligation for the certificate (art. 6.1.c) | 1 year after the selection process ends, or longer with your consent |
| Security cameras at campus entrances | Public interest in the safety of people and premises (art. 6.1.e; art. 22 LOPDGDD) | Up to 30 days, unless needed for an incident |
| Running and securing the website | Our legitimate interest in a working, secure site (art. 6.1.f) | Technical logs for a short period only |
| Inspections, insurance and legal claims | Legal obligation (art. 6.1.c); legitimate interest in defending our rights (art. 6.1.f) | Until the legal time limits for claims have passed |
If you don't provide the information marked as required in a form or enrolment document, we can't process the enquiry, application or enrolment. We don't make automated decisions about anyone and we don't create profiles.
5Children and consent
- For students under 14, consent is given by a parent or legal guardian, as Spanish law requires (art. 7 LOPDGDD).
- Students aged 14 and over can give consent themselves. For their images, we ask both the student and their parents.
- We don't collect data directly from children through this website. Our forms are for parents, guardians and other adults.
- Image permissions are given on a separate authorisation form. You can change them at any time by emailing info@barcelonamontessorischool.com. We then remove the images from our website and social media. Printed materials that have already been distributed can't be recalled.
- When you take photos at school events, please don't post images of other children online.
6Who we share data with
Inside the school, only staff who need the data for their role can see it. Outside the school, we share data only with:
| Recipient | Why | Where |
|---|---|---|
| Google (Google Workspace) | Email, documents and calendars | EU; possible transfers to the US under the Data Privacy Framework |
| Odoo S.A. | Website, admissions enquiries and email newsletters | EU |
| Esencia Educativa, S.L. (My Montessori Journal) | School-management platform: records, observations, reports and messages to families | EU |
| Cloudflare, Inc. | Domain service and spam protection on our forms | US, under the Data Privacy Framework |
| Ametller Origen | School meals: allergies and dietary needs | Spain |
| Banks and payment providers | Collecting fees | Spain |
| Accountants, legal advisers and insurers | Administration, compliance and claims | Spain |
| Authorities | Departament d'Educació, health and social services, police or courts, when the law requires | Spain |
| Other schools | Transferring academic records when a student moves school | Wherever the new school is |
Every provider works under a data-processing contract and may only use the data for the service it provides to us.
7Your rights
You can ask to access your data, correct it, delete it, restrict or object to its use, or receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent doesn't affect anything we did before.
How to make a request
- Email info@barcelonamontessorischool.com with the subject “Data protection request”.
- Tell us which right you want to use and which data it concerns.
- Include proof of identity. If you're asking on behalf of a child, also include proof of parental authority.
We'll reply within one month. For complex requests this can be extended by up to two more months, and we'll tell you if it is.
If you're not satisfied with our answer, you can complain to the Agencia Española de Protección de Datos (www.aepd.es).
8Security
We protect data with role-based access, confidentiality commitments from staff, secure storage, careful choice of providers and an incident procedure. If a breach puts your rights at risk, we'll notify the AEPD within 72 hours and tell you directly when the law requires it.
Please don't send medical reports or other sensitive documents by WhatsApp or ordinary email. Ask us and we'll give you a secure channel.
9Cookies
This website only uses the cookies it needs to work, and its visitor statistics don't use cookies. The full list is in our Cookie Policy.
10Changes to this policy
We update this policy when our services, providers or the law change. The date at the top shows the current version. If we make important changes, we'll tell current families directly.