Skip to main content

Privacy Policy

Last Updated: March 12, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how V&A STYLO S.C. ("we", "us", or "our") collects, uses, and protects personal data when you visit this website (the "Site") and when you contact us about our educational programs and professional development services available across Canada.

For the purposes of the EU General Data Protection Regulation ("GDPR") and applicable Spanish data protection law, the data controller is:

We do not currently appoint a Data Protection Officer (DPO) because our processing does not involve large-scale processing of special-category data. If this changes, we will update this Privacy Policy with DPO contact details.

Effective Date: March 12, 2026.

2. Personal Data We Collect

The Site is designed to provide information about our educational offerings and to allow prospective participants and organizations to submit inquiries. Depending on how you interact with the Site, we may collect the following categories of personal data:

  • Identity and contact details: name, email address, phone number, and any organizational affiliation you provide.
  • Form content: messages, learning goals, preferred program, timeframe, delivery format preferences, and any other information you include in your inquiry.
  • Technical data: IP address, browser type and version, device type, operating system, language settings, and approximate location derived from IP (city/region level).
  • Usage data: pages visited, time spent, referrer URL, click paths, and interactions with page elements.
  • Cookies and identifiers: cookie identifiers and consent flags as described in Section 4 and in our Cookie Policy.
  • Conversion events: events that indicate a submitted inquiry or similar on-site actions, used to measure whether the Site is functioning and, where consent is provided, to measure advertising effectiveness.

We do not intentionally collect special-category data (such as health data, biometric identifiers, political opinions, religious beliefs, or sexual orientation). Please do not include such information in free-text fields. We also do not request government identification numbers or payment card details through the Site.

3. Why We Process Personal Data & Legal Basis (GDPR Art. 6)

We only process personal data where we have a lawful basis. The main purposes and legal bases are:

  • Responding to inquiries and coordinating enrollment steps: Art. 6(1)(b) (steps prior to entering into a contract) and, where applicable, Art. 6(1)(a) (consent when you voluntarily provide information and request contact).
  • Operating and securing the Site: Art. 6(1)(f) (legitimate interests) to prevent abuse, maintain availability, and protect the Site from malicious activity.
  • Analytics (optional): Art. 6(1)(a) (consent). Analytics cookies and associated measurement activate only after you opt in.
  • Marketing and advertising measurement (optional): Art. 6(1)(a) (consent). Marketing cookies and related tags activate only after you opt in.
  • Legal compliance: Art. 6(1)(c) where processing is required to comply with applicable laws (for example, handling legally required records where relevant).

Automated decision-making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any advertising audiences created through consent-based marketing tools are used for measurement and relevance, not for decisions that have legal effects.

4. Cookies & Tracking

Cookies are small text files stored on your device. The Site uses cookies and similar technologies (including pixel tags) to provide core functionality and, if you consent, to measure usage and advertising performance. Cookie choices can be managed at any time using the "Manage cookie preferences" link in the footer.

Essential cookies (always active)

Essential cookies are required for the Site to function and for your consent choices to be stored. These cookies do not require opt-in consent. Examples include:

  • _site_session (first-party) for session continuity.
  • cookie_consent (first-party) to store your cookie preference selection.

Retention: session to 12 months, depending on the cookie.

Analytics cookies (opt-in)

If you consent to analytics cookies, we may use Google Analytics 4 ("GA4") to understand how visitors use the Site (for example, which pages are most visited and how users navigate). Where enabled, IP anonymization is used. Typical cookies include _ga and _ga_XXXXXXXXXX. Analytics data retention is typically 14 months in GA4 settings.

Marketing cookies (opt-in)

If you consent to marketing cookies, we may use tools such as Google Ads and Meta advertising measurement to understand ad performance, attribute conversions, and improve relevance. Typical cookies include _gcl_au, _fbp, and _fbc (when click identifiers are present).

Beyond cookies, some advertising and analytics tools can use pixel tags and server-side event forwarding configured by us. When used, these operate only after consent and may rely on device identifiers derived from browser signals (for example, IP address and User-Agent) or hashed contact details where provided. Hashing is a privacy measure and does not mean data is anonymous.

For full details, please read our Cookie Policy.

5. Consent (EEA/UK)

Users in the European Economic Area (EEA) and the United Kingdom receive a consent notice under GDPR and UK GDPR. Analytics and marketing cookies activate only after explicit, informed, and freely given consent (GDPR Art. 6(1)(a)).

Your consent choice is recorded in the cookie_consent browser cookie and is retained for up to 12 months, unless you change or delete it earlier. You can withdraw consent at any time via the "Manage cookie preferences" link in the footer or by clearing cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Sharing With Advertising & Service Partners

We use carefully selected service providers to operate and improve the Site. Depending on your cookie preferences and the services enabled, we may share limited data with:

We do not sell personal data. Where we use these providers, they act as processors or service providers for the purposes described above. We do not permit them to use Site data for their own independent commercial purposes.

7. International Transfers

V&A STYLO S.C. is established in Spain, and personal data is processed in the European Union and, in some cases, by service providers that may be located outside the EEA/UK, including in the United States.

Where international transfers occur, we rely on appropriate safeguards such as the EU-US Data Privacy Framework (effective July 2023) and the UK Extension to the EU-US Data Privacy Framework where applicable, and we may use Standard Contractual Clauses (EU 2021/914) as a fallback mechanism. For UK transfers, the UK International Data Transfer Agreement (IDTA) may also be used as a fallback.

You may request more information about applicable safeguards by emailing [email protected].

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, and then delete or anonymize it, unless a longer retention period is required by law. Typical retention periods include:

  • Contact and enrollment inquiries: up to 2 years from the last interaction to support follow-up and continuity.
  • Email correspondence: for the duration of the relationship plus 1 year, unless longer retention is needed for dispute handling or legal obligations.
  • Server security logs: typically up to 90 days.
  • Analytics data: typically 14 months in GA4, where enabled by consent.
  • Marketing cookies: retained according to cookie lifetimes (for example, 90 days) and only where consent is provided.
  • Cookie consent record: up to 3 years for audit and compliance evidence.
  • Legal and tax records: retained as required by applicable law, which may be 6 to 10 years depending on the record type.

9. Your Rights (GDPR & UK GDPR)

If GDPR or UK GDPR applies to your personal data, you may have the following rights:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)
  • Right to withdraw consent at any time (Art. 7(3))
  • Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise your rights, email [email protected]. We will respond within 30 days. This period may be extended by up to 60 days for complex requests, in which case we will explain the reason for the extension.

Supervisory authority (Spain): Agencia Española de Protección de Datos (AEPD) — https://www.aepd.es/.

If you are in another EU/EEA country, you may also contact your local authority; a directory is available via the European Data Protection Board — https://edpb.europa.eu/.

10. Children

This Site is not directed at individuals under 16. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it promptly.

11. Do Not Track

Some browsers offer a "Do Not Track" ("DNT") signal. This Site does not respond to DNT signals. Third-party providers may have their own approaches to DNT; please review their policies for details.

12. Data Deletion Requests

You may request deletion of your personal data by emailing [email protected] with the subject line "Data Deletion Request". We may ask for additional information to verify identity and locate the relevant records. We aim to complete verified deletion requests within 30 days, unless legal obligations require us to retain certain information.

13. Business Transfers

If we are involved in a merger, acquisition, reorganization, asset sale, financing, or insolvency event, personal data may be transferred to a successor entity as part of that transaction. If such a transfer materially changes how personal data is used, we will provide notice on the Site.

14. California (CCPA / CPRA)

This section applies only if you are a California resident and the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA") applies to our processing.

In the past 12 months, we may have collected the following categories of personal information:

  • Identifiers: name, email, IP address, online identifiers (shared with service providers and, where consented, advertising partners).
  • Internet or network activity: browsing interactions with the Site (shared with analytics and advertising providers where consented).
  • Inferences: interests or preferences derived from site interactions (used for advertising relevance where consented).

We do not sell personal information as defined by the CCPA. We may share information for cross-context behavioral advertising when marketing cookies are enabled; California residents may opt out by using our cookie preferences panel.

Depending on applicable law, you may have rights to know, delete, and correct personal information, and to opt out of sale or sharing. To submit a request, email [email protected] with the subject line "California Privacy Request". We will verify your identity before responding. Authorized agents may submit requests with proof of authorization.

15. Virginia (VCDPA)

This section applies only if you are a Virginia resident and the Virginia Consumer Data Protection Act ("VCDPA") applies.

Virginia residents may have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising. We do not sell personal data and we do not engage in profiling that produces legal or similarly significant effects.

Requests can be submitted by emailing [email protected] with the subject line "Virginia Privacy Request". If we decline to take action, you may appeal by emailing with the subject line "Appeal of Refusal — Privacy Request". We will respond to appeals within 60 days. If an appeal is denied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified request to opt out of the sale of covered information by emailing [email protected] with the subject line "Nevada Do Not Sell Request". We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be announced via a notice on the Site at least 14 days before taking effect where feasible. The "Last Updated" date at the top of this page is revised whenever the policy is updated.

18. Contact

If you have questions about this Privacy Policy or how we handle personal data, contact:

For cookie-related questions, please also review our Cookie Policy.

Quick reminder

This Site supports inquiries for educational programs. Please avoid sending sensitive personal information through the contact form. If you need help choosing a program, share learning objectives and context instead of private details.