Summary
- We don’t sell your data or use it for anything other than what we describe here.
- The website and database are hosted in a data centre in Frankfurt (Germany).
- Google Analytics and Google AdSense are only loaded if you accept them in the cookie notice. They are never loaded in the app, for users under 16, for school accounts or for teachers with a school licence and their students.
- You can delete your account and all your learning data at any time from your profile (“Delete my account”).
1. Controller
Controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR):
Javier Hoballah Lorenzo
H Spanish Academy
Kolonnenstraße 8
10827 Berlin
Deutschland
E-Mail: info@hspanishacademy.com
Further details in the Impressum. We are not required to appoint a data protection officer; for any question, write to info@hspanishacademy.com.
2. Hosting and server logs
The website is hosted by Hostinger International Ltd. (61 Lordou Vironos str., 6023 Larnaca, Cyprus) in a data centre in Frankfurt am Main (Germany). Hostinger processes data on our behalf under a data processing agreement (Art. 28 GDPR).
Every time you open a page, the server logs technical data: IP address, date and time, requested page, referring page, browser and operating system. We need this to deliver the website and protect it against attacks (Art. 6(1)(f) GDPR: legitimate interest in secure operation). The provider deletes these logs automatically once they are no longer needed for security.
To prevent abuse (for example, mass login attempts or form submissions) we store a hashed value of your IP address for a maximum of 24 hours.
Some of Hostinger’s sub-processors (for example, for network protection and email) are located in the USA; these transfers are covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
All website resources (fonts, icons and scripts) are served from our own server; nothing is loaded from third-party content delivery networks.
3. User account and progress
To create an account we need a username, email address, password and date of birth. The date of birth is only used to check the minimum age and apply protections for minors (section 12). Passwords are stored encrypted.
While you use the platform we store your learning progress (completed activities and results, XP, streak, medals, stories and readings, flashcards and their review schedule), any profile data you choose to add (display name, avatar, level, language) and your notifications.
Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for, even if it is free). We keep the data as long as you have an account. “Delete my account” in your profile immediately deletes your account and learning data; backups are overwritten in their normal cycle.
Account security. While a session is open (up to 2 days, or 14 with “Remember me”), WordPress stores its IP address, browser and sign-in date. We use them to show you your active sessions in your profile so you can sign out any you don’t recognise and, for Premium accounts, to apply the limit of 3 devices at the same time and alert you to new sign-ins. For Premium accounts we also store a random identifier for each browser you sign in from (cookie hsc_device); if you sign in from an unknown one, we send you an email alert. Legal basis: Art. 6(1)(b) GDPR (providing the service and applying the Premium terms) and Art. 6(1)(f) GDPR (legitimate interest in protecting your account against unauthorised access). Session data is deleted when the session expires or you sign it out; browser identifiers after 180 days without use.
We only send emails needed for the service (for example, to reset your password or alert you to a new sign-in). We don’t send marketing newsletters.
5. Classes and schools
Teachers can create classes that students join with a code. The teacher sees their students’ username or alias, XP and progress, which assignments they have done, their difficulty ratings and class forum messages. Students see their classmates’ aliases, their own position in the class ranking and the forum.
School accounts are created with a class code and only have an alias and a password — no email address and no date of birth. The teacher can generate a new password, remove the student from the class or delete the account with all its data.
Licensed schools: if your school has a licence, the school is the controller for its students’ data and we process it on the school’s behalf under a data processing agreement (Art. 28 GDPR). Please contact your school to exercise your rights; if you write to us, we will pass your request on. More in the guide for schools.
For school accounts, teachers with a school licence and their students, neither Google Analytics nor Google AdSense is loaded and no cookie notice is shown: only technically necessary cookies are used.
7. Contact forms and email
When you write to us via the contact form, the teacher application, the error report in an activity or by email, we receive the data you give us (for example, name, email and message) and use it only to reply (Art. 6(1)(b) GDPR if it concerns a contract or your account; otherwise Art. 6(1)(f) GDPR: legitimate interest in answering your enquiry). Messages are delivered to our mailbox and deleted once your enquiry is resolved, unless the law requires us to keep them.
Cancelling, withdrawing and reporting content: if you use Cancel contract, Withdraw from contract or the form to report content, we store the form data (name, email, contract, reason, date and time and, for reports, the address of the content and your explanation) and send you a confirmation by email. Legal basis: Art. 6(1)(c) GDPR (legal obligation to confirm cancellations and withdrawals, § 312k BGB and Art. 11a of Directive 2011/83/EU, and to handle content notices, Art. 16 Digital Services Act) and Art. 6(1)(f) GDPR (being able to prove the request). We keep them for 3 years (limitation period, § 195 BGB).
8. Cookies and local storage
Necessary (no consent required, § 25(2) TDDDG):
- WordPress session cookies (
wordpress_logged_in_*,wordpress_sec_*,wordpress_test_cookie) to keep you logged in. hsc_language: interface language (30 days).hsc_device: Premium accounts only; recognises the browser so we can alert you to sign-ins from a new one (1 year).- In your browser’s local storage: your cookie choice (6 months) and interface preferences.
Optional (only with your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR): statistics (Google Analytics, section 9) and advertising (Google AdSense, section 10). No optional category is pre-selected. You can change or withdraw your consent at any time via “Cookies” in the footer; withdrawing it does not affect the lawfulness of earlier processing. The full list of cookies is in the cookie policy.
9. Google Analytics
If you accept statistics cookies, we use Google Analytics 4 by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to understand which pages and activities are used and improve the website. Data such as pages visited, time spent, device and browser type and approximate location is collected; Google Analytics 4 does not store full IP addresses. Cookies: _ga and _ga_* (up to 2 years).
Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (European Commission adequacy decision). Legal basis: your consent (Art. 6(1)(a) GDPR). More: Google privacy policy.
10. Google AdSense
If you accept advertising cookies, we show Google AdSense ads (Google Ireland Limited) to keep the content free. Google may use cookies (for example __gads or __gpi, up to 13 months) and identifiers to show ads, limit how often you see the same one and measure their performance. In the European Economic Area no ads personalised to your interests are shown; outside it, Google may personalise them. Google also processes this data as a controller in its own right; transfers to the USA may take place under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR).
Premium users don’t see ads. More: how Google uses cookies in advertising.
11. Mobile app
The H Spanish Academy app shows this same website inside the application, so everything above applies. The app has no advertising and no Google Analytics, and no cookie notice is shown because only necessary cookies are used.
12. Minors
You must be at least 13 years old to create your own account. Children under 13 can only use the platform with a school account created from a teacher’s class.
Premium can only be bought by adults (18+): we check the date of birth on the account or, if we don’t have it, ask you to confirm it before paying.
For users under 16 (based on the date of birth provided), Google Analytics and Google AdSense are not loaded and no consent is requested for them, because in Germany minors under 16 can only give it with parental authorisation (Art. 8 GDPR). Parents or guardians can exercise the rights in section 14 on their children’s behalf by writing to us.
13. Recipients and international transfers
We only share data with:
- Hostinger (hosting and email), as processor.
- Google (Analytics and AdSense), only with your consent.
- Stripe or PayPal, if you subscribe to Premium (depending on the payment method you choose).
- Authorities, where required by law.
Transfers outside the European Economic Area are based on an adequacy decision (EU-US Data Privacy Framework) or on the European Commission’s standard contractual clauses.
14. Your rights
You have the right to access your data (Art. 15 GDPR), rectify it (Art. 16), have it erased (Art. 17), restrict its processing (Art. 18), receive it in a portable format (Art. 20) and withdraw your consent at any time (Art. 7(3)). Write to info@hspanishacademy.com.
Right to object (Art. 21 GDPR): where we process your data based on legitimate interest (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation.
You can also lodge a complaint with a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin (Germany).
15. Other information
- Obligation to provide data: registration data is required to create an account; everything else is voluntary.
- Automated decisions: we don’t make automated decisions with legal effects (Art. 22 GDPR). Automatic marking of exercises only supports your learning.
- Security: encrypted connection (HTTPS), encrypted passwords, restricted access to data, backups and protection against mass access attempts.
- Changes: we will update this policy when the service or the law changes. The date at the top shows the current version; we will announce important changes on the website.
4. Social features
If you use them, other users can find you by your username or display name, send you friend requests, see your avatar and learning statistics if you are friends, and see your likes on activities. The weekly ranking shows Premium users the name, avatar and XP of the users with the most points; school accounts never appear in it and can only interact with their classmates.
Legal basis: Art. 6(1)(b) GDPR (they are part of the service). You can object to appearing in the ranking by writing to us (section 14).