Privacy

Data controllers

European School of Sports operates through two companies that process your data jointly, as joint controllers: European School of Sports S.L., owner of this website and responsible for the sporting and academic services, and 360 Sports and Education S.L., responsible for the non-sporting services.

These are their details:

For any question about your data, you can write to the email address given under "Your rights and how to exercise them".

Essentials of the joint controllership arrangement

The two companies share responsibility for your data as follows:

• European School of Sports S.L., owner of this website, is the one that informs you about how your data is processed, on the website and during enrolment.
• European School of Sports S.L. and 360 Sports and Education S.L. are joint controllers: both use the same contact details to deal with your request and, if you enrol, to provide the service that each of them is responsible for.
• All requests to exercise your rights come in through a single email address, the one in "Your rights and how to exercise them", whichever company they concern, and they are handled in the same way.
• Each company is responsible for the data it processes to provide and invoice its own services.

If you would like more information about this arrangement, you can ask for it at that same email address.

What data we process

We process the data you give us directly and a small amount of technical data:

• When you request information on the website: who is filling in the form (the athlete or their parent or guardian), the athlete's first name and surname, the guardian's name where applicable, email address, phone number, sport, year of birth, nationality, what you are looking for, the expected start date and anything you want to tell us about your situation.
• When you write to us by email or WhatsApp, or fill in a form in one of our social media ads: the data included in the message or form.
• Technical and browsing data: the page from which you submit the form and, only if you accept it in the cookie notice, data about how you use the website: which pages you visit, where you come from — for example, from an ad or a search engine —, the type of device and browser, your language, your approximate location based on your IP address and some identifiers stored in cookies in your browser. What is collected, and by which tool, depends on the categories you accept, and is explained in the cookie policy.
• If you enrol: your identification details and identity document; your contact details; your academic and sports information; bank details, if you take out the visa or legal guardianship service; health data, only when a service needs it, as explained under "Health data"; and, if you apply for your visa through us and you are an adult, your criminal record certificate, as explained under "Criminal record certificate".
• If you represent a club, school or other organisation: your professional contact details.

We never ask for health data or criminal records in the website form, and we ask you not to include them there. We only process them at enrolment and during the visa application, under the rules set out in their sections.

Purposes and legal bases

We use your data for the following purposes, each with its legal basis:

• To deal with your information request and manage the admissions process. Basis: steps taken at your request before entering into a contract.
• To send you commercial information about our programmes and news, by email and WhatsApp. Basis: your consent, given by ticking the relevant box. It is optional: your request is handled in the same way if you do not tick it, and you can withdraw it at any time.
• If you enrol, to provide the services you have signed up for and meet our tax and administrative obligations. Basis: performance of the contract and compliance with legal obligations.
• To provide the services that need health data: nutrition, physiotherapy and medical tests; to take out the insurance, when its form includes a health questionnaire; and to process the visa, when a medical certificate is required. Basis: your explicit consent for that data.
• To process your visa, when the criminal record certificate is required: we receive it from you or your family and pass it on to the firm handling the visa, as explained under "Criminal record certificate". Basis: performance of the contract.
• To keep your contact details after dealing with your request, so that we can help you if you get in touch again. Basis: our legitimate interest, as many athletes get back in touch years later, for example when moving on to university. You can object at any time.
• To manage our relationship with clubs, schools and other organisations. Basis: our legitimate interest in maintaining the professional relationship.
• To understand how the website is used, so that we can improve it (the "Analytics" category, with Google Analytics). Basis: your consent.
• To measure how well our ads on Facebook and Instagram work (the "Advertising" category, with the Meta pixel). Basis: your consent.
• Later on, to show ESS ads on Facebook and Instagram to people who have already visited the website (the "Advertising" category). This is known as remarketing: with what the pixel collects — which pages were viewed, which sport was of interest, whether a request was sent or the WhatsApp button was tapped — groups of people are created in Meta, which Meta calls audiences, to show them ESS ads. We do not do this yet: no audience has been created today. When we switch it on, we will say so here beforehand, and it will only be able to include people who have accepted the "Advertising" category. Basis: your consent.
• To link your visits to the website with your information request, so that we can help you better, and, if you arrived through a campaign link, which campaign you came from (the "Request follow-up" category, with HubSpot, the tool we use to manage requests). Basis: your consent.

You give or refuse these consents in the cookie notice, each category separately, and you can withdraw them at any time through the Cookie settings link in the footer: the page reloads and the tools in that category stop working at that moment. Withdrawing them does not affect processing carried out before, and rejecting them does not stop you from using the website or requesting information.

We do not take decisions based solely on automated processing that produce legal effects concerning you.

Health data

Some services need the student's health data. This is a special category of data, which the law protects more strictly, and we handle it under its own rules:

• What for: the high-performance services taken out separately — nutrition, physiotherapy and medical tests —; the insurance, when its enrolment form includes a health questionnaire; and the visa, when a medical certificate is required.
• Never in the website form. We ask for it separately, at enrolment or during the visa application, and only if you take out what needs it.
• The legal basis is your explicit consent, collected separately from the rest of the enrolment, for that data and that purpose.
• Only those who need it receive it, and only what they need: the professional providing the service — the nutritionist, the physiotherapist or the medical testing centre —, the insurer with its questionnaire and the firm handling the visa with the medical certificate.
• You can withdraw your consent at any time. Processing carried out before remains valid, but whatever needs that data can no longer be done.

Criminal record certificate

If you apply through us for a study visa of more than six months and you are an adult, the consulate asks for a criminal record certificate. This is how we handle it:

• We never ask for it in the website form. Only during the visa application.
• You or your family hand it to us, and we pass it on to the firm handling your visa. We do not use it for anything else.
• We do not keep it for longer than that process requires.

Data about minors

Our programmes are aimed at athletes aged 14 to 24, so the form may be filled in by a minor.

The age from which a person can consent to the processing of their own data is not the same in every country. As an organisation established in Spain, we apply Spanish law, which sets it at 14, to information requests. In any case, a minor's enrolment is always completed by their parent or legal guardian, which is why the form also asks for the guardian's name.

We do not knowingly process data of children under 14 without the consent of their parents or guardians. If we detect such a request, we will seek that consent or delete the data.

The health data of a student aged 14 to 17 follows the same rule as the rest of their data: Spanish law allows them to consent for themselves from the age of 14, and enrolment is always completed by their parent or legal guardian.

Recipients and processors

We do not sell your data. We only share it in the following cases:

• Between the two European School of Sports companies, as joint controllers.
• With the providers that deliver services to us and process data on our behalf, under contract and without being able to use it for their own purposes: contact management (HubSpot), email and work tools (Google Workspace), hosting of this website (Vercel), email sending (Resend), ESS Athletics forms (Netlify) and hosting of the previous website and the domain records (SiteGround).
• With Meta Platforms Ireland Limited, when you write to us on WhatsApp or fill in a form in one of our ads, under its own terms; and, if you accept the "Advertising" category, through the Meta pixel. For the collection and transmission of that browsing data, Meta and we are joint controllers, on the terms summarised in the next section; what Meta does with it afterwards is Meta's responsibility and is explained in its privacy policy.
• With Google Ireland Limited, if you accept the "Analytics" category: Google Analytics processes the browsing data on our behalf, as a processor. We have switched off its Google Signals feature. Google Tag Manager, also from Google, is the tool that loads the others; it is only loaded if you accept a category and, when it loads, Google receives your browser's request with its technical data, such as the IP address.
• With HubSpot, if you accept the "Request follow-up" category: as well as managing our contacts, it records your visits to the website so that they can be linked to your request, always on our behalf.
• With public authorities, courts and tribunals where the law requires it.

If you enrol, with the organisations involved in the services you sign up for, only as far as needed to provide each one. All of them are in Spain:

• Residences: your personal details, identity document and contact details, when the residence contract is signed. Basis: the contract.
• Schools and universities: the same data, during the admissions process at the school or university. Basis: pre-contractual steps and the contract.
• Sports federations: only the data required for the federation licence, when the licence is processed. Basis: the contract.
• Clubs: your general details, to register you. Basis: the contract.
• Insurers: the data requested in the insurance enrolment form, when the insurance is taken out. If the form includes a health questionnaire, that transfer follows the rules under "Health data".
• Visa and legal guardianship firms: the documents your family gives us, including identity documents, bank details and, for the visa, the medical certificate and, if you are an adult, the criminal record certificate. We act as intermediaries: we receive them and pass them on to the firm. Basis: the contract; for the medical certificate, your explicit consent.
• Nutrition, physiotherapy and medical testing professionals, the high-performance services: your general details, contact details and sports information, when the service is taken out. Basis: the contract. And health data, under the rules in its section.

We do not share your data with the agencies or partners that help us promote ESS or introduce students to us.

Before enrolment, we do not share your data with schools, residences or other organisations without your consent.

The Meta pixel: joint controllership with Meta

For the data that the Meta pixel collects on this website and sends to Meta, only if you accept the "Advertising" category, European School of Sports and Meta Platforms Ireland Limited are joint controllers. This is governed by the agreement Meta sets with businesses that use its tools, the Meta controller addendum. The essentials:

• We inform you about this processing — this policy does so — and ask for your consent in the cookie notice before switching on the pixel. That is the legal basis.
• Meta takes care of the security of the data in its systems and of handling your rights over the data it keeps after receiving it.
• What Meta does with that data afterwards for its own purposes, including the advertising it shows you, is Meta's responsibility and is explained in its privacy policy.
• Meta's lead supervisory authority in the European Union is the Irish Data Protection Commission. You can also complain to the Spanish Data Protection Agency.

How to exercise your rights over this data. You can contact us, at the email address in "Your rights and how to exercise them", or Meta directly, as its privacy policy explains. If you write to us about data that Meta keeps, we will tell you how to do so or pass your request on to Meta. And you can always withdraw your consent through Cookie settings: the pixel stops working at that moment.

International transfers

Wherever possible, your data is stored in the European Union: our contact management tool hosts it in European data centres, and emails are sent from Ireland.

Even so, some of our providers, such as Google, Meta, Vercel, HubSpot or Resend, are companies based in the United States and may access some data or process it outside the European Union, such as technical logs. In those cases, the transfer relies on the EU-US Data Privacy Framework, where the provider has signed up to it, or on the standard contractual clauses approved by the European Commission.

This also applies to the measurement tools. Google, Meta and HubSpot provide the service from their European headquarters in Ireland — Google Ireland Limited, Meta Platforms Ireland Limited and HubSpot Ireland Limited —, but their parent companies are in the United States and browsing data may be processed there. The three parent companies — Google LLC, Meta Platforms, Inc. and HubSpot, Inc. — have signed up to the EU-US Data Privacy Framework, which is the safeguard for the transfer. You can check this on the Framework's public list at www.dataprivacyframework.gov, or ask us for information about these safeguards at the email address in "Your rights and how to exercise them".

If you enrol and the service involves an organisation outside the European Union, such as a university in another country, your data will be shared with it because this is necessary to provide that service.

Retention period

We keep your data only for as long as each purpose requires:

• If you request information and do not enrol: 5 years from the last contact. Many athletes get back in touch later, for example when moving on to university, and this lets us help you with your history. You can ask us to delete it sooner. We will do so within one month, and we will tell you if there is anything the law requires us to keep: that is not deleted at that point, but blocked until its legal period ends.
• If you enrol: 10 years from the end of the relationship, to meet our legal obligations and deal with any claims.
• Health data: for as long as the service that needs it lasts. When it ends, it is deleted, except anything the law requires us to keep, which is blocked until its period ends. What each healthcare professional keeps is their own responsibility and is governed by their own rules.
• Criminal record certificate: only for as long as it takes to pass it on to the firm handling the visa.
• Commercial communications: until you withdraw your consent.
• Browsing data: each cookie lasts for the period stated in the cookie policy. What Google Analytics collects is kept for 14 months, and the period starts again each time you visit the website again; what HubSpot records about your visits, for as long as your contact details; and what Meta receives, for as long as its own policy states.

When each period ends, the data is blocked for as long as the law may require it and then deleted.

Your rights and how to exercise them

At any time you can ask us to:

• access your data;
• correct it if it is inaccurate;
• delete it;
• object to its processing or have it restricted;
• receive it in a format that lets you take it to another controller;
• and withdraw your consent, without affecting processing carried out before.

To do so, write to this email address stating which right you wish to exercise:

Email to exercise your rights

info@ess.school

If we need to confirm your identity, we will only ask for what is strictly necessary. We will reply within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.