Privacy Policy

Last updated 18 Sep 2026

This privacy policy explains how Hola Spanish Academy (“we”, “us” or “our”) collects, uses and shares your information when you visit our website at https://holasa.co.uk/, enquire about lessons, register your interest or enrol on a course. We have written it in plain words. If anything is unclear, email us and we will explain it.

What information we collect about you

We only collect what we need to reply to you, arrange your lessons and take your payments. What we collect depends on which form you use.

• Contact form: your name, email address, phone number (optional), what you are interested in and your message.
• Register Your Interest: your name, email address, phone number, how you would like to learn, the course you are interested in and any message.
• Secure Your Slot: your name, email address, phone number, how you would like to learn, the course and plan you have chosen, a reference we give you, what is owed for your enrolment, and the date and time you confirmed that the registration fee is non-refundable.
• Payments: when you set up a Direct Debit, you type your bank details into GoCardless’s own form. We never see or store bank details. What we hold are the identifiers GoCardless gives us for your Direct Debit, your payments and your monthly plan, and their status (for example, set up, paid or failed).
• Bookings: when you pick a time for your level test or tester lesson, we hold the date and time you chose and the identifiers Calendly gives us for that booking. We send Calendly your name, email address, time zone, the course you chose and your reference, so that it can email you the invitation.
• Technical information: our web host records the address of your connection and details of your browser in its logs, as every web host does, and Google’s reCAPTCHA service scores each form submission to tell people from automated abuse. Cookies are explained in our Cookie Policy.

How we collect it

1. From you, when you fill in one of the three forms on the website, email us, call us or message us on WhatsApp.
2. Automatically, through cookies, our web host’s logs and reCAPTCHA, as described above.
3. From the services that work for us: GoCardless tells us whether a Direct Debit has been set up and whether a payment has been collected, and Calendly tells us when a booking has been made, changed or cancelled.

We do not buy or collect information about you from data brokers, directories or any other third party.

Cookies and similar technologies

Cookies are small text files placed on your device so that a website can remember your choices. For the cookies this website uses and how to control them, please read our Cookie Policy.

Do not track requests

Our website does not respond to “Do Not Track” browser signals, because no common standard for them has been agreed. You can manage tracking through your cookie preferences on this site or through your browser settings.

Why we collect your information

• To reply to your enquiry.
• To arrange and run your lessons, which is the contract between us.
• To take the registration fee and your monthly payments by Direct Debit, and to keep the records the law asks us to keep.
• To book your level test or tester lesson and email you the invitation.
• To keep the website and its forms free of spam and abuse.
• To understand how the website is used, only if you have agreed to analytics cookies.

We do not use your details for marketing or promotional messages.

Our legal bases

UK GDPR asks us to say which legal basis we rely on for each use of your information.

• Performance of a contract: arranging and running your lessons, taking your payments and booking your sessions.
• Legal obligation: keeping accounting and tax records of the payments you make, which we must keep for six years.
• Legitimate interests: replying to enquiries, keeping the website secure and keeping its forms free of spam.
• Consent: analytics cookies, which are only set if you agree to them. You can withdraw that consent at any time through Consent Preferences on the Cookie Policy page.

How long we keep your information

• Enquiries (the Contact form and Register Your Interest): twelve months from our last contact with you.
• Enrolment and booking records: for as long as you study with us, and twelve months after your last lesson.
• Payment records: six years after the end of the tax year in which the payment was made, as the law requires.
• Your cookie consent record: twelve months, held by CookieYes.
• How the website is used (Google Analytics, and only if you agree to analytics cookies): two months for the figures themselves, and fourteen months for the record of a visitor’s return visits. These are Google’s own periods.
• Copies of the emails the website sends you: one week. Each copy includes what the email said, so a booking link or a receipt can be checked, and it is then deleted automatically.
• Web server logs: on our web host’s own schedule.

When we no longer need your information we delete it, or where deleting it is not possible straight away (for example, in a backup) we keep it separate from everything else until it can be deleted.

Who we share your information with

We share your information only with the services that help us run the school and the website. Each one is bound by contract to use it only for the work it does for us.

• GoCardless Ltd (United Kingdom): collects your Direct Debit payments. Your bank details are given to GoCardless directly and are covered by the Direct Debit Guarantee.
• Calendly LLC (United States): books your level test or tester lesson and emails you the invitation, which may carry a Google Meet link. Our agreement with Calendly includes the safeguards UK law asks for when information leaves the UK.
• Google: Google Analytics, through Google Tag Manager, measures how the website is used, but only if you agree to analytics cookies; reCAPTCHA protects the forms from automated abuse.
• CookieYes Ltd: shows the cookie banner and holds a record of the choice you make in it.
• Hostinger: hosts the website and holds its server logs.
• Mailgun Technologies, Inc. (part of Sinch): sends the emails the website writes to you, such as your booking link and your receipt. Our account uses Mailgun’s European region, so those emails are handled on servers in the EU, and our agreement includes the safeguards UK law asks for where information reaches the United States.
• WhatsApp: if you choose to message us on WhatsApp, Meta’s own privacy policy applies to that conversation.

We may also disclose information where the law requires it, for example in response to a court order, and in the course of a sale or transfer of the business, in which case we would tell you.

Sale of information

We do not sell the information we collect from you, and we do not share it with anyone for their own marketing.

Automated decisions

We make no decision about you by automated means. reCAPTCHA scores each form submission to tell people from automated abuse, and that score is used for nothing else.

Your rights

Under UK GDPR you have the following rights over your information.

1. The right to ask for a copy of the information we hold about you.
2. The right to have inaccurate or incomplete information corrected.
3. The right to have your information deleted, where we no longer need it.
4. The right to restrict how we use your information in certain circumstances.
5. The right to object to our use of your information where we rely on legitimate interests.
6. The right to receive the information you gave us in a portable format.

To exercise any of these rights, email us at the address below. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, although we would welcome the chance to put things right first.

If you do not want to share information

Refusing analytics cookies changes nothing about your lessons or the service you receive. The forms need the details they ask for so that we can reply, book your session and take your payment; without them we cannot do those things.

Children

The website takes an adult’s details only. A student under 18 is enrolled by a parent or guardian, whose details we hold and who we deal with about lessons and payments. We do not knowingly collect a child’s details through the website. If you believe we hold a child’s details, email us and we will remove them.

Security

We take reasonable steps to keep your information secure. The website is served over an encrypted connection, bank details are handled by GoCardless and never by us, and access to enquiries and enrolments is limited to the people who run the school. No method of sending or storing information over the internet is completely secure, so we cannot promise absolute security.

Links to other websites

The website links to services we do not run, such as Google Maps, Calendly and WhatsApp. Their privacy policies apply once you use them, and we encourage you to read them.

Changes to this policy

We may update this policy when the law or our practices change. The date at the top of the page shows when it was last updated. This policy takes effect from 18 September 2026.

Contact us

For any question about your privacy, or to exercise any of your rights, contact us using the details below.

Registered address: Hola Spanish Academy, Forma House, 40 Bowling Green Lane, London EC1R 0NE

Where lessons take place: 2nd floor, 3 Duckett’s Wharf, South Street, Bishop’s Stortford, Hertfordshire CM23 3AR

Email: hola@holasa.co.uk