Privacy Policy and Data Protection

PRIVACY POLICY

Following the principles of lawfulness, fairness and transparency, we make this Privacy Policy available to you.

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, information is provided on the privacy policy that EDUCADVISOR will apply in the processing of personal data that users (hereinafter, the "User/s") voluntarily provide or generate when accessing the Website and the different online and offline channels owned by EDUCADVISOR, as well as when contracting EDUCADVISOR's services and products.

The User undertakes to enter real and truthful data, for which they are duly authorized. Likewise, they will be solely responsible for any damages that EDUCADVISOR may suffer as a consequence of the lack of truthfulness, inaccuracy, lack of validity and authenticity of the data provided.

1. Data Collected

• Mere navigation: by the mere fact of visiting and browsing the Website, data that allows Users to be nominally identified is not automatically recorded. However, there is certain information that is collected and recorded in EDUCADVISOR's systems, such as, for example, type of Internet browser, operating system or IP address from which the Website pages are accessed, in order to improve User navigation and management of the Website itself.
• Access to content or services for which data is requested: notwithstanding the above, to access certain information or to use certain content or services on the Website, EDUCADVISOR may require certain personal data from the User — which may fundamentally include name, surname, email, telephone, address, number of children, age of children and any other data that allows for an optimal recommendation based on the User's characteristics. In these cases, EDUCADVISOR will provide the User with the necessary information before processing their data.
• Contracting of services and products: notwithstanding the above, for the contracting of certain services and products, EDUCADVISOR may require certain personal data from the User — which may fundamentally include name, surname, email, telephone, address, billing data and any other data that is necessary for contracting and subsequent management. In these cases, EDUCADVISOR will provide the User with the necessary information before processing their data.
• Payment process for services and products: in order to process payment for services and products, it is necessary for the User to provide certain economic and transactional information. EDUCADVISOR uses the Stripe payment gateway as a payment service provider. The User must provide all necessary data indicated by Stripe in order to complete their purchase. To learn more about Stripe click here.
• Comments and reviews published on other websites: EDUCADVISOR imports comments and reviews published by users about Educational Centers on Google. The User must provide all necessary data indicated by Google in order to publish their comments and reviews. To learn more about Google click here.
• Own comments and reviews (Edupulse): EDUCADVISOR directly collects reviews and ratings from families through its Edupulse tool, for the purpose of publishing verified reviews on Educational Center profiles on the Website.
• Manage personnel selection processes: EDUCADVISOR posts job offers through the Website or other websites. The User as a potential candidate must provide the necessary data for EDUCADVISOR to evaluate and manage their application.

2. Data Controller

EDUCADVISOR is responsible for the processing of data collected or generated as a result of Users' access and navigation on the Website and control of the Website; of data requested to access certain content, services and products; of data requested for contracting certain services and products; as well as data necessary for personnel selection processes.

For payment processing, EDUCADVISOR uses the services of Stripe, Inc. (hereinafter, "Stripe") as a data processor. Stripe will process the necessary economic and transactional data on behalf of and following EDUCADVISOR's documented instructions, in accordance with the data processing agreement signed between both parties. You can review Stripe's privacy policy at https://stripe.com/en/privacy.

Regarding comments and reviews published on the Website:

• Reviews imported from Google: Google Ireland Limited is responsible for the processing of data collected or generated for the publication of comments and reviews on Google. EDUCADVISOR imports and displays said reviews on Educational Center profiles, indicating their source.
• Own reviews through Edupulse: EDUCADVISOR, as data controller, directly collects reviews and ratings from families through its Edupulse tool. The data collected (name or pseudonym, rating and comments) is processed by EDUCADVISOR for the purpose of publishing verified reviews on Educational Center profiles on the Website.

3. Purpose of Processing

EDUCADVISOR processes Users' personal data for the purposes indicated below, differentiated by type of data subject:

a) Website Users (without account or contracting):

• Improve the Website, its management and security. Legal basis: EDUCADVISOR's legitimate interest (Art. 6.1.f GDPR).
• Carry out studies to analyze the relevance and use of the Website, including through anonymized information. Legal basis: EDUCADVISOR's legitimate interest (Art. 6.1.f GDPR).
• Install non-technical cookies (analytics, advertising). Legal basis: User consent (Art. 6.1.a GDPR).

b) Registered Users (families):

• Manage the User's account on EDUCADVISOR, including registration through a social network or third-party platform. Legal basis: performance of the contractual relationship (Art. 6.1.b GDPR).
• Provide free Orientation Services: access to information and recommendations of Educational Centers, Affinity Test and mediation service with Educational Centers. Legal basis: performance of the contractual relationship (Art. 6.1.b GDPR).
• Share data with Educational Centers with which the User has interacted or obtained greater affinity in the Affinity Test, so that they can contact the User. Legal basis: User consent (Art. 6.1.a GDPR).
• Send communications about news in the education sector, publications, training and other initiatives. Legal basis: EDUCADVISOR's legitimate interest (Art. 6.1.f GDPR) or User consent (Art. 6.1.a GDPR), as applicable.

c) Clients (users who contract paid services):

• Formalize and manage the contracting of paid Orientation Services (personalized advisory, School Search Tool). Legal basis: performance of contract (Art. 6.1.b GDPR).
• Process payment for contracted services and products through Stripe, data processor. Legal basis: performance of contract (Art. 6.1.b GDPR).
• Issue invoices and comply with tax and accounting obligations. Legal basis: compliance with legal obligations (Art. 6.1.c GDPR).

d) Educational Centers (professional clients):

• Manage the contractual relationship derived from contracting the iSchoolAdvisor Platform, including granting the License of Use, billing and support. Legal basis: performance of contract (Art. 6.1.b GDPR).
• Share with Educational Centers the data of Users who have interacted with their profile or requested information. Legal basis: performance of contract with the User (Art. 6.1.b GDPR) and User consent (Art. 6.1.a GDPR).

e) Potential clients (information requests):

• Manage information requests received through contact forms. Legal basis: data subject's consent (Art. 6.1.a GDPR) and, where applicable, pre-contractual measures (Art. 6.1.b GDPR).

f) Candidates (selection processes):

• Manage personnel selection processes. Legal basis: candidate's consent (Art. 6.1.a GDPR) and pre-contractual measures (Art. 6.1.b GDPR).

Purposes common to all data subjects:

• Carry out research and analysis studies on how to develop and improve the services and products it offers to Users. Legal basis: EDUCADVISOR's legitimate interest (Art. 6.1.f GDPR).
• Compliance with applicable legal obligations. Legal basis: compliance with legal obligations (Art. 6.1.c GDPR).

4. Communications

The User authorizes EDUCADVISOR to transfer their data to the following recipients:

• Educational Centers and other third-party providers with which EDUCADVISOR has established a commercial relationship.
• EDUCADVISOR service providers. These include technology service providers, logistics, transport and delivery service providers, as well as providers of services related to administration, marketing and advertising. Likewise, as an exception, the Website may use third-party cookies in accordance with the cookie policy and User consent.
• Public administrations and competent authorities in the exercise of their functions.

In the event that any of EDUCADVISOR's service providers is located outside the European Economic Area (the countries of the European Union plus Liechtenstein, Iceland and Norway), EDUCADVISOR will adopt all applicable guarantees in accordance with applicable legislation to ensure adequate data management.

In particular, based on User consent when accepting cookies, EDUCADVISOR informs that it may make international data transfers to Google LLC and Meta Platforms Inc, companies established in the United States and adhering to the Data Privacy Framework. In this way, a level of protection comparable to the European one is offered.

5. Legal Basis and Retention

The legal bases legitimizing the processing of personal data by EDUCADVISOR are detailed alongside each purpose in the previous section. By way of summary, EDUCADVISOR processes data based on:

• Data subject's consent (Art. 6.1.a GDPR): for the installation of non-technical cookies, the transfer of data to Educational Centers for commercial purposes, participation in selection processes and the handling of information requests.
• Contractual performance or pre-contractual measures (Art. 6.1.b GDPR): for user account management, the provision of Orientation Services, the contracting of paid services, the management of the iSchoolAdvisor Platform for Educational Centers and payment processing.
• Legitimate interest (Art. 6.1.f GDPR): for improving the Website and its security, conducting research and analysis studies, and sending commercial communications when permitted by applicable regulations.
• Compliance with legal obligations (Art. 6.1.c GDPR): for issuing invoices, tax and accounting obligations, and any other applicable legal obligations.

Data will be retained while there are contractual obligations arising from services or content requested and/or contracted by Users and, subsequently, until the extinction of legal or contractual responsibilities that require their retention (e.g., until the extinction of liability arising from data protection or cybersecurity regulations). In the event that data is processed for sending information, it may be retained as long as the User does not object to receiving information by any of the various free and simple means made available to them.

6. User Rights

The User may exercise the rights established in Articles 15 to 22 of the GDPR (access, rectification, cancellation, deletion and opposition) by contacting the email address info@ischooladvisor.com.

If you consider that the processing of your personal data violates applicable legislation or your rights, you may file a complaint with EDUCADVISOR, S.L. or with the Spanish Data Protection Agency (www.aepd.es).

Last revision: February 2026.