Privacy Policy

Last updated: 27 July 2026

01 ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how CodingSTEAM collects, uses, stores and shares personal data when you:

• Visit codingsteam.com.
• Contact us or request information.
• Book or attend a trial session.
• Register for CodingSTEAM services.
• Participate in an online or in-person session.
• Communicate with our mentors or staff.
• Make a payment.
• Apply to work with us.
• Represent a school, university, company or other organisation that works with us.

It also explains how we process information relating to children and young people.

This Privacy Policy should be read together with our Cookie Policy, Legal Notice and applicable service terms.

02 DATA CONTROLLER

The controller responsible for the processing described in this policy is:

CodingSTEAM, S.L. NIF: B10737708 Registered office: Calle Hermosilla 48, 1º derecha, 28001 Madrid, Spain Email: contact@codingsteam.com Website: codingsteam.com

For privacy enquiries, please write to contact@codingsteam.com and include “Data protection” in the subject line.

03 PRIVACY SUMMARY

Controller:

CodingSTEAM, S.L.

Main purposes:

Responding to enquiries, arranging trials, delivering educational services, managing attendance and progress, communicating with families and schools, processing payments, protecting the website and improving our services.

Main legal bases:

Performance of a contract, steps taken before entering a contract, legal obligations, legitimate interests and consent where required.

Children:

Parents or legal guardians normally manage registration and contracting for minors. Separate consent is requested where needed.

Sharing:

Authorised CodingSTEAM personnel, schools where applicable, technology and payment providers, professional advisers and public authorities where legally required.

International transfers:

Some service providers may process data outside the European Economic Area using legally recognised safeguards.

Rights:

Access, rectification, erasure, restriction, objection, portability and withdrawal of consent.

Complaints:

You may complain to the Spanish Data Protection Agency.

Contact:

contact@codingsteam.com

04 WHO THIS POLICY APPLIES TO

This policy applies to personal data concerning:

• Prospective and current students.
• Parents, guardians and family members.
• Adult learners.
• School staff and representatives.
• Teachers, mentors, contractors and applicants.
• Website visitors.
• Suppliers, partners and other professional contacts.

Where a parent or guardian provides information about a child, the parent or guardian must ensure that the information is accurate and that they are authorised to provide it.

05 PERSONAL DATA WE COLLECT

Depending on your relationship with CodingSTEAM, we may process the following categories of information.

5.1 Identity and contact information

This may include:

• Name and surname.
• Email address.
• Telephone number.
• Postal or billing address.
• Name of a parent or legal guardian.
• Relationship between the learner and the adult registering them.
• School, organisation or employer.
• Preferred language and communication preferences.

5.2 Registration and scheduling information

This may include:

• Requested programme, pathway or subject.
• Availability and preferred timetable.
• Online or in-person session preferences.
• Trial-session information.
• Attendance, cancellations and rescheduling information.
• The learner’s school, year group or approximate educational level.

5.3 Educational and progress information

This may include:

• Current knowledge and experience.
• Learning goals and interests.
• Projects and work created during sessions.
• Mentor notes and feedback.
• Attendance and participation.
• Skill assessments and progress scores.
• Strengths, areas for development and recommended next steps.
• Reports shared with students, parents, guardians or schools.
• Information provided by a school or teacher where relevant.

5.4 Communications

This may include:

• Emails and messages.
• Contact-form submissions.
• Questions and support requests.
• Feedback, complaints and survey responses.
• Records of relevant communications with families or schools.

5.5 Payment and administrative information

This may include:

• Name and billing details.
• Invoice and transaction information.
• Payment status.
• Bank-transfer references.
• Tax and accounting records.

Card payments are generally processed directly by the payment provider. CodingSTEAM does not normally receive or store complete payment-card details.

5.6 Website and technical information

This may include:

• Internet Protocol address.
• Browser and device information.
• Approximate location derived from an IP address.
• Pages visited and website interactions.
• Referral and campaign information.
• Security logs.
• Cookie and consent preferences.

Optional analytics and advertising information is only processed where the relevant consent has been provided.

5.7 Images, recordings, student work and testimonials

Where separate permission has been obtained, we may process:

• Photographs.
• Video or audio recordings.
• Student projects.
• First name, age range or general location.
• Testimonials from learners or parents.

Participation in CodingSTEAM services is not conditional on agreeing to the public use of images, recordings, testimonials or student work.

5.8 Recruitment information

Where someone applies to work with us, we may process:

• Curriculum vitae.
• Contact information.
• Employment and education history.
• Qualifications.
• References.
• Interview notes.
• Availability and right-to-work information.

5.9 Sensitive information

CodingSTEAM does not normally require medical information or other special-category personal data through its general website forms.

Please do not include health, disability or other sensitive information in an ordinary contact-form message unless it is genuinely necessary.

Where information about an accessibility requirement, health condition or safeguarding issue is needed to protect a learner or adapt the service, we will limit collection to what is necessary and identify an appropriate legal basis.

06 HOW WE OBTAIN PERSONAL DATA

We may obtain personal data:

• Directly from you.
• From a parent or legal guardian.
• From the learner, where appropriate for their age.
• From a school or educational institution.
• From a teacher or other authorised representative.
• From payment and booking providers.
• Automatically when someone uses our website.
• From correspondence and service records.
• From publicly available professional sources in connection with school, institutional or business enquiries.

Where we receive personal data from a school, the school is responsible for ensuring that it has authority to provide that information and that the individuals concerned have received the required information.

07 WHY WE USE PERSONAL DATA

7.1 Enquiries, trial requests and proposals

Purpose:

To respond to questions, provide requested information, assess availability, arrange trial sessions and prepare service proposals.

Legal basis:

Steps taken at your request before entering into a contract. For general institutional or professional enquiries, we may also rely on our legitimate interest in responding to and developing legitimate business relationships.

Retention:

If the enquiry does not lead to a service relationship, we normally retain it for no longer than 12 months after the last meaningful communication.

7.2 Registration and service delivery

Purpose:

To register learners, schedule sessions, deliver educational and mentoring services, allocate mentors and equipment, manage attendance and provide support.

Legal basis:

Performance of a contract or steps taken before entering into one.

Retention:

For the duration of the service relationship and normally for up to five years afterwards where needed to manage claims, resolve disputes or demonstrate that services were provided.

7.3 Progress monitoring and reporting

Purpose:

To personalise teaching, assess development, record attendance and participation, produce progress reports and communicate relevant information to learners, families and schools.

Legal basis:

Performance of the service contract and our legitimate interest in maintaining educational quality, continuity and appropriate communication.

Where CodingSTEAM provides a service under a school’s instructions, this processing may instead be carried out by CodingSTEAM as a processor on behalf of the school.

Retention:

Normally for the duration of the learner’s participation and up to five years afterwards, unless a different period applies under an agreement with a school.

7.4 Learner welfare, accessibility and safeguarding

Purpose:

To make reasonable adjustments, protect learners, respond to welfare or safeguarding concerns and maintain a safe learning environment.

Legal basis:

Legal obligations, legitimate interests in learner safety and service security, and explicit consent where it is required for special-category data.

Retention:

Only for as long as necessary for the relevant welfare or safeguarding purpose. Certain incident records may be retained longer where necessary to protect a child, comply with law or establish, exercise or defend legal claims.

7.5 Payments, invoicing and accounting

Purpose:

To process payments, issue invoices, manage overdue amounts, maintain accounting records and comply with tax and commercial obligations.

Legal basis:

Performance of a contract and compliance with legal obligations.

Retention:

Accounting, invoice and related commercial records may be retained for six years, or longer where another legal requirement or ongoing proceeding applies.

7.6 Operational communications

Purpose:

To send scheduling information, session updates, service notices, progress information, safety notices and other communications necessary to manage the relationship.

Legal basis:

Performance of a contract and our legitimate interest in operating and supporting our services.

Retention:

For the duration of the relationship and afterwards where needed for the applicable statutory limitation periods.

7.7 Marketing communications

Purpose:

To send information about programmes, open days, trials, events and related CodingSTEAM services.

Legal basis:

Consent, or another basis permitted by applicable electronic-marketing law in relation to existing customers.

Every marketing message will provide a simple way to unsubscribe.

Retention:

Until consent is withdrawn, an objection is made or the contact has been inactive for 24 months, unless we are legally permitted to retain limited suppression information to ensure that no further marketing is sent.

7.8 Images, recordings, testimonials and publication of work

Purpose:

To publish approved testimonials, photographs, recordings or examples of learner work on our website, newsletters, presentations or social-media channels.

Legal basis:

Separate, specific consent.

Consent may be refused or withdrawn without affecting access to the educational service.

Retention:

Until consent is withdrawn or the material is no longer required for the stated purpose. Withdrawal does not make earlier lawful publication unlawful, although we will stop new use and take reasonable steps to remove material under our control.

7.9 Website operation and security

Purpose:

To operate and protect the website, prevent spam and abuse, investigate errors, maintain logs and defend our systems.

Legal basis:

Our legitimate interest in maintaining a secure and functional website and, where applicable, compliance with legal obligations.

Retention:

Security and technical logs are normally retained for no longer than 12 months unless an incident requires longer investigation or retention.

7.10 Analytics, website improvement and advertising measurement

Purpose:

To understand website usage, improve content, test website changes and measure advertising performance.

Legal basis:

Consent.

Retention:

According to the duration of the relevant technology and the choices described in our Cookie Policy.

7.11 Recruitment

Purpose:

To assess applications, communicate with candidates and manage recruitment.

Legal basis:

Steps taken before potentially entering into a contract.

Retention:

Unsuccessful application information is normally retained for no longer than 12 months after the process ends. We will request separate consent before retaining it for future opportunities beyond that period.

7.12 Legal compliance and claims

Purpose:

To comply with legal requests and obligations, respond to authorities, prevent misuse, resolve disputes and establish, exercise or defend legal claims.

Legal basis:

Legal obligation and our legitimate interest in protecting CodingSTEAM and the people who use our services.

Retention:

For the duration of the relevant obligation, investigation, dispute or statutory limitation period.

08 WHEN INFORMATION IS REQUIRED

Some information is necessary for us to:

• Respond to a request.
• Identify the appropriate service.
• Register a learner.
• Arrange a session.
• Communicate with a parent or guardian.
• Issue an invoice.
• Comply with legal or safety requirements.

Mandatory fields will be identified where appropriate.

You are not required to provide optional information. However, if required information is not provided, we may be unable to respond, arrange a trial or deliver the requested service.

09 CHILDREN AND YOUNG PEOPLE

CodingSTEAM provides services to children and young people and takes their privacy particularly seriously.

9.1 Registration and contracting

Parents or legal guardians should normally make enquiries, complete registration and manage payment for learners under 18.

CodingSTEAM does not knowingly enter into a paid service contract directly with a young child.

9.2 Consent

Under Spanish data-protection law, where processing is based on consent:

• For a child under 14, consent must be provided or authorised by a parent or legal guardian.
• From age 14, a young person may generally provide their own data-protection consent, except where another law requires parental or guardian involvement.

Even where a young person can consent for data-protection purposes, parental involvement may still be required for enrolment, payment, contractual or safeguarding reasons.

9.3 Images, recordings and public work

Permission to publish a child’s image, voice, testimonial or identifiable work will be requested separately from service registration.

The consent request will explain:

• What material may be used.
• Where it may appear.
• The purpose of publication.
• Whether the learner will be identified.
• How consent may be withdrawn.

9.4 Age-appropriate information

Where we communicate privacy information directly to children, we aim to use clear, accessible and age-appropriate language.

9.5 Rights of children

Children have their own data-protection rights.

Parents or guardians may exercise rights on behalf of a child where legally authorised. CodingSTEAM may request proportionate evidence of parental responsibility, guardianship or authorisation before disclosing a child’s information.

10 SERVICES DELIVERED THROUGH SCHOOLS

CodingSTEAM may provide services directly to families or under an arrangement with a school or educational institution.

The parties’ data-protection roles depend on who determines why and how the information is processed.

10.1 Where CodingSTEAM is the controller

CodingSTEAM will generally act as controller when it independently decides how personal data is used for matters such as:

• Direct family registrations.
• Direct payment and invoicing.
• CodingSTEAM’s own legal compliance.
• Service security.
• Direct marketing.
• CodingSTEAM recruitment.

10.2 Where a school is the controller

A school may be the controller where it selects learners, determines the educational purpose and instructs CodingSTEAM to process information for delivery of the school programme.

In those circumstances:

• The school’s privacy information will apply to the school’s processing.
• CodingSTEAM will process the relevant data under the school’s documented instructions.
• The school will normally be the first point of contact for rights concerning that processing.
• CodingSTEAM and the school will enter into the data-processing arrangements required by law.

CodingSTEAM may still act as a separate controller for its own legal, accounting, security or administrative obligations.

11 WHO RECEIVES PERSONAL DATA

Personal data may be made available, where necessary, to:

• Authorised CodingSTEAM employees, mentors and contractors.
• Parents and legal guardians.
• Schools and authorised school personnel.
• Website hosting, cloud-storage and database providers.
• Email, communications and collaboration providers.
• Form, booking and customer-management providers.
• Educational and development platforms.
• Payment, banking, accounting and invoicing providers.
• Analytics and advertising providers, where consent has been given.
• IT security and technical-support providers.
• Insurers, auditors, accountants, lawyers and other professional advisers.
• Public authorities, courts and law-enforcement bodies where required by law.
• A purchaser or successor in connection with a lawful restructuring, merger or transfer of the business, subject to appropriate confidentiality and data-protection safeguards.

Service providers may only use personal data to provide the contracted service and must be subject to appropriate confidentiality and data-protection obligations.

CodingSTEAM does not sell personal data.

12 TECHNOLOGY PROVIDERS

Depending on the service being used, our providers may include companies offering:

• Google and Firebase hosting, database, security, analytics and collaboration services.
• Zoho forms, customer-management and website-improvement services.
• Payment-processing services such as Stripe.
• Coding and educational collaboration services such as Google Classroom, Replit or GitHub.
• Email, document, cloud-storage and videoconferencing services.

The precise providers may change as our services and security requirements develop. We review providers and enter into appropriate contractual arrangements where they process personal data on our behalf.

Third-party platforms may also process information as independent controllers for their own clearly stated purposes. Their own privacy policies apply to that independent processing.

13 INTERNATIONAL TRANSFERS

Some technology providers may process personal data outside Spain or the European Economic Area.

Where an international transfer takes place, CodingSTEAM will use an appropriate transfer mechanism, which may include:

• A European Commission adequacy decision.
• European Commission Standard Contractual Clauses.
• Additional contractual, organisational or technical measures.
• Another transfer mechanism permitted under applicable law.

You may contact us for further information about the safeguards relevant to a particular service.

14 COOKIES AND SIMILAR TECHNOLOGIES

The website uses cookies and similar technologies for:

• Necessary website operation.
• Security and fraud prevention.
• Remembering privacy choices.
• Analytics.
• Website testing and improvement.
• Advertising measurement.

Optional analytics, testing and advertising technologies must not be activated unless the visitor has provided the relevant consent.

Further information is provided in our Cookie Policy. Consent may be changed or withdrawn through the website’s Cookie settings control.

15 IMAGES, RECORDINGS AND STUDENT WORK

Student work, images, recordings or testimonials will not be made public merely because a learner participates in a CodingSTEAM service.

Where we wish to use identifiable material publicly, we will request separate consent and explain the intended channels and purpose.

Where practical, we will reduce identification by using measures such as:

• A first name only.
• A general age or age range.
• Removal of school-identifying details.
• Cropping or obscuring unnecessary personal details.
• Publishing the work without an identifiable photograph.

People attending school events should also follow the school’s rules concerning photography and recordings.

16 AUTOMATED PROCESSING

CodingSTEAM may use software to help organise information, calculate results or prepare draft progress-report text.

These tools support our mentors and administrative processes.

CodingSTEAM does not currently make decisions about learners that produce legal or similarly significant effects based solely on automated processing.

Educational observations, recommendations and reports remain subject to human involvement and review.

17 SECURITY

CodingSTEAM applies technical and organisational measures intended to protect personal data against:

• Unauthorised access.
• Accidental loss.
• Improper alteration.
• Unlawful disclosure.
• Destruction.
• Misuse.

Measures may include access controls, authentication, restricted permissions, secure providers, backups, staff confidentiality requirements and security monitoring.

No online system can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will assess it and notify the relevant authority and affected individuals where required by law.

18 YOUR RIGHTS

Subject to the conditions established by law, you may request:

• Access: Confirmation of whether we process your personal data and a copy of it.
• Rectification: Correction of inaccurate or incomplete information.
• Erasure: Deletion of information where there is no lawful reason to retain it.
• Restriction: Temporary limitation of processing in certain circumstances.
• Objection: An objection to processing based on legitimate interests or to direct marketing.
• Portability: Receipt of certain information in a structured, commonly used and machine-readable format.
• Withdrawal of consent: Withdrawal of consent at any time for future processing.
• Human intervention: Protection against certain decisions based solely on automated processing.

To exercise a right, email contact@codingsteam.com with:

• Your name.
• The right you wish to exercise.
• Enough information to identify the relevant relationship or records.
• Where applicable, evidence that you are authorised to act for another person.

We will only request identity documentation where reasonably necessary and will avoid retaining unnecessary copies.

Rights requests are normally answered within one month. This period may be extended by up to two additional months where a request is complex or numerous, in which case we will explain the extension.

Exercising a right is normally free of charge. Applicable law allows a reasonable fee or refusal where a request is manifestly unfounded or excessive.

19 COMPLAINTS

Please contact us first so that we have the opportunity to address your concern.

You also have the right to lodge a complaint with the:

Agencia Española de Protección de Datos — AEPD

A complaint may be submitted through the AEPD’s official complaints service.

This right is not affected by any other administrative or judicial remedy available to you.

20 THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to external websites, social networks, coding environments or educational platforms.

CodingSTEAM is not responsible for the independent privacy practices of external services. You should review the privacy information provided by those services before creating an account or submitting personal information.

Where CodingSTEAM requires a third-party platform as part of a service, we will aim to explain its role and provide suitable instructions to learners and families.

21 CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in:

• Our services.
• Our technology providers.
• Our data-processing activities.
• Applicable law or regulatory guidance.

The latest version will be published on this page with its revision date.

Where a change materially affects processing based on consent, we will request new consent where required.

22 CONTACT

For questions, concerns or requests concerning personal data, contact:

CodingSTEAM, S.L. Calle Hermosilla 48, 1º derecha 28001 Madrid, Spain Email: contact@codingsteam.com

Please use “Data protection” as the email subject where possible.