Data Protection

Privacy Policy

How Barcelona Montessori School processes personal data, including children's data, admissions enquiries, website forms, images, cookies and school communications.

Last updated: 3 July 2026

1. Basic data-protection information

Controller	OBJETIVO EXCELENCIA S.L., NIF B67519371, trading as Barcelona Montessori School.
Address	C/ de l'Esperança 13, 08017 Barcelona, Spain. The school also operates at Carrer de Pomaret 25, 08017 Barcelona.
Contact	info@barcelonamontessorischool.com · +34 931 420 972
Data Protection Officer / DPD	Please write to info@barcelonamontessorischool.com with the subject "Data Protection / DPD". Before publication, the school should insert the appointed DPD's direct contact if different.
Main purposes	Responding to enquiries, admissions, tours, enrolment, education, safeguarding, health and safety, payments, school communications, image/video permissions, website analytics and legal compliance.
Main legal bases	Consent, pre-contractual steps, contract performance, legal obligations, legitimate interests, vital interests and, where applicable, explicit consent or substantial public interest for special-category data.
Rights	Access, rectification, erasure, objection, restriction, portability and withdrawal of consent, as applicable.
Supervisory authority	Users may contact the Agencia Española de Protección de Datos (AEPD) if they consider their rights have not been respected.

2. Scope of this policy

This Privacy Policy applies to personal data collected through the Barcelona Montessori School website, online forms, email, telephone, WhatsApp, school visits, admissions processes, registration forms, image-rights forms, parent communications and other school-related interactions.

Because Barcelona Montessori School works with children, the school treats children's personal data with particular care, minimisation and confidentiality. Data relating to pupils is processed only when there is a clear educational, contractual, safeguarding, health, administrative or legal purpose.

3. Categories of personal data we may process

Families and website users

Names, contact details, preferred language and relationship to the child.
Admissions enquiries, tour requests and communications with the school.
Billing, payment, registration and re-enrolment information.
Cookie preferences and technical website information.

Children and pupils

Name, date of birth, nationality, languages and family contacts.
Educational records, observations, progress information and reports.
Health, allergy, medical, emergency and safeguarding information where necessary.
Photographs, video and audio only where authorised or legally justified.

The school may process special-category data, such as health, allergy, disability, SEN, safeguarding or wellbeing information, only when necessary and with an appropriate legal basis and safeguards.

4. Purposes and legal bases

Admissions and enquiries	Responding to requests, arranging visits, providing information, managing applications. Legal basis: consent and pre-contractual steps requested by the family.
Enrolment and education	Pupil records, classroom planning, family communications, reports and school organisation. Legal basis: contract performance, legal obligations and legitimate interests of the school community.
Safeguarding, health and emergencies	Allergies, medication, emergency contacts, incidents, child protection concerns. Legal basis: legal obligations, vital interests, substantial public interest and, where required, explicit consent.
Payments and administration	Fees, invoices, deposits, re-enrolment, accounting and debt management. Legal basis: contract performance and legal obligations.
Images and marketing	Photos/videos for newsletters, website, social media or school materials. Legal basis: consent/authorisation, unless another legal basis clearly applies for internal non-public documentation.
Website cookies and analytics	Necessary cookies, analytics cookies and optional marketing cookies. Legal basis: legitimate interest/technical necessity for essential cookies; consent for optional cookies.
Legal and regulatory compliance	Responding to authorities, inspections, insurance, legal claims and mandatory record-keeping. Legal basis: legal obligation and legitimate interests.

5. Children's data and consent

When processing is based on consent and relates to a child under 14 years old in Spain, consent must be provided by the holder of parental authority or legal guardianship. The school may also process children's data when necessary for education, safeguarding, health, legal obligations, contract performance or vital interests.

The school does not knowingly collect personal data directly from children through the public website for marketing or profiling purposes. Forms intended for admissions or school administration should be completed by parents, guardians or authorised adults.

Photographs, videos and other image rights are managed separately through image-rights authorisation forms. The school should avoid unnecessary publication of identifiable children's data and should respect any refusal or withdrawal of non-essential consent.

6. Recipients and service providers

Personal data may be shared only where necessary with:

School staff and authorised collaborators who need access for their role.
Technology, hosting, website, email, form, school-management, payment, accounting and communication providers acting as processors.
Health, emergency, insurance, legal, safeguarding or regulatory bodies when required.
Public administrations, inspectors, accreditation bodies or competent authorities where the school has a legal or operational obligation.

Processors must be bound by appropriate data-processing terms. Where a provider involves international transfers outside the European Economic Area, the school should rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses or other GDPR-compliant mechanisms.

7. Retention periods

Personal data is kept only for as long as necessary for the purpose for which it was collected and to comply with legal, educational, accounting, safeguarding or claims-related obligations.

Enquiries that do not lead to enrolment: normally retained for a limited admissions follow-up period, unless the family requests earlier deletion or asks to stay in contact.
Enrolled pupils and families: retained during the school relationship and afterwards for the periods required by education, tax, accounting, safeguarding and legal obligations.
Images and marketing permissions: retained while the authorisation remains valid and until withdrawal, subject to reasonable technical and archival limits for materials already lawfully published.
Cookies: retained according to the cookie type and the visitor's preferences.

8. Rights of users and families

Users may request access, rectification, erasure, restriction, objection, portability and withdrawal of consent where applicable. Requests should be sent to info@barcelonamontessorischool.com with sufficient information to identify the requester and the data concerned.

Parents or legal guardians may exercise rights on behalf of their child where legally appropriate. The school may need to verify identity and parental authority before acting on a request.

If a user considers that their data-protection rights have not been properly addressed, they may contact the Agencia Española de Protección de Datos.

9. Security and confidentiality

The school applies organisational and technical measures appropriate to the risk of processing children's and family data. These measures include access controls, confidentiality duties, staff guidance, secure storage, limited access by role, provider controls and incident-management procedures.

No website or electronic system can be guaranteed to be completely secure. Families should avoid sending highly sensitive information through open channels unless requested by the school through an appropriate method.

10. Cookies and similar technologies

The website uses necessary cookies for basic functionality and may use analytics or marketing cookies only where the visitor has accepted them. Visitors can accept, reject or manage optional cookies through the cookie banner.

Cookie preferences can be changed by clearing browser storage or by using any cookie-preference tool made available on the website.

11. Updates to this policy

This policy may be updated when the website, school systems, legal requirements or service providers change. The latest version will be published on this page with its update date.