Cómo recopilamos, usamos y protegemos tu información.

Morna Valley School SL — CIF B07324262.

Carretera San Miguel KM 3.5, CP 07814, Santa Gertrudis, Ibiza (Illes Balears).

Contact: info@micibiza.com · +34 971 19 76 72 · www.micibiza.com

Main activity: educational centre serving children aged 3 to 18.

Your personal data is used so we can communicate with you and provide our educational services. It may also be used to send you information about our school activities, but only with your prior consent given through the appropriate checkbox.

We will only process your data with your prior consent, which you provide through the corresponding boxes established for this purpose.

In general, only personnel of our entity who are duly authorised may access the information we ask you for.

Entities that need access to provide our services to you may also process your data — for example, our bank if payment for our services is made by card or bank transfer. Public or private entities to which we are legally obliged to provide your data (for example, the Tax Agency for economic transactions over a certain amount) will also be aware of relevant information.

We also rely on service providers who process data only on our instructions and under a data processing agreement (article 28 GDPR): website hosting, electronic signature of application documents, email, secure document storage, and our school management system.

If we need to disclose your personal information to other entities beyond the cases above, we will ask you in advance for your permission through clear options.

We protect your data with effective security measures based on the risks associated with its use. Our entity has approved a Data Protection Policy and annual checks and audits are carried out to verify that your personal data is secure at all times.

Our policy is not to send your personal information to any country that is not secure from a data protection point of view. Your data stays in the European Union, or in the United Kingdom, which the European Commission recognises as offering an adequate level of protection (adequacy decision), so no additional safeguards are needed for these transfers.

If providing a service makes a transfer to a less-secure country essential, we will always ask your permission in advance and apply effective security measures to reduce the risks.

We retain your data during our relationship with you and for as long as legally required after it ends. Once the applicable legal deadlines have passed, we eliminate it in a safe and environmentally responsible manner.

At any time you can contact us to find out what information we hold about you, rectify it if it is incorrect, and delete it once our relationship has ended (where legally possible).

You also have the right to request the transfer of your information to another entity. This right is called portability.

To exercise any of these rights, please make a written request to our address, along with a copy of your ID. Our offices have specific forms to request these rights and we'll help you complete them.

For more information on your data protection rights, you can consult theSpanish Data Protection Agency.

You may withdraw your consent if you change your mind about the use of your data at any time. For example, if you previously agreed to receive information about our activities but no longer wish to, you can let us know through the opposition form available at our offices.

If you believe your rights have not been respected, you can make a complaint to the Spanish Data Protection Agency through:

• Electronic headquarters: www.aepd.es
• Postal: Spanish Data Protection Agency, C/ Jorge Juan, 6, 28001 Madrid
• Phone: 901 100 099 or 912 663 517

There is no cost to file a complaint and no need for a lawyer.

Our policy is not to profile the users of our services. If a specific service requires it, we will ask your permission and apply effective security measures to protect the information.