Privacy policy

1. Who is responsible

Santiago Garnica Montañez, natural person trading as “Spanish Tinto”, Calle 1a #7a-69, Chía, Cundinamarca, Colombia. Email santiago@spanishtinto.com. I handle requests myself.

2. What data and which services

• Hosting (Cloudflare Pages): the site is served by Cloudflare, Inc. When you open a page, Cloudflare processes your IP address and technical request data (time, page, browser, device) to deliver and protect the site.
• Fonts and flag images: the fonts (Plus Jakarta Sans, EB Garamond) and the flag images are hosted on this website itself. No external font or image service (such as Google Fonts or flagcdn.com) is contacted.
• Video (YouTube, privacy-enhanced mode): the intro video on the home page is embedded from youtube-nocookie.com and starts muted when the page loads; the preview image comes from i.ytimg.com and the player script from youtube.com. Google/YouTube receives your IP address and device data and may store information in your browser once the player loads.
• Booking (Cal.com): the booking buttons link to Cal.com. Only if you open that link and book, Cal.com processes your name, email, time zone, the date and time of the lesson and anything you write in the booking form.
• Email: if you write to me (for example via a mailto link such as the course waitlist), I process your email address, name and message.
• Pre-lesson form (Formspree): after booking, you can fill in a short form (/before-class) so I can prepare your class. It is sent through Formspree, Inc. (USA), which receives your name, your email address and your answers (plus technical data such as your IP address) and forwards them to me by email. Purpose: preparing your lessons. For people in the EU/EEA, the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract, or performance of the lesson contract). This means your data is transferred to the USA. Formspree is not certified under the EU-U.S. Data Privacy Framework (its earlier participation was withdrawn in 2022); according to Formspree, it relies on the EU Standard Contractual Clauses. Please don’t include sensitive data in your answers.
• Bogotá intensive interest list (Formspree): if you join the interest list on /intensive (or its German, French or Spanish version), Formspree (see above) sends me your first name and email address and, if you give them, your country, possible travel dates and Spanish level. I use them only to email you about the in-person intensive program in Bogotá. For people in the EU/EEA, the legal basis is your consent (Art. 6(1)(a) GDPR). I keep the data until you ask me to delete it or the program is discontinued. You can withdraw your consent at any time by writing to santiago@spanishtinto.com.
• Level test: the test runs in your browser; your answers are not sent to me or to any server.

This site uses no analytics tools and no advertising trackers, and sets no cookies of its own. The only forms are the optional pre-lesson form and the Bogotá intensive interest list described above. The half lesson and single lessons are paid with PayPal inside Cal.com when you book; lesson packs are paid via PayPal payment links on this site. If you pay, PayPal processes your payment data under its own privacy policy. I don’t ask for sensitive data; please don’t include it in messages.

3. Why

To deliver the site, show the intro video, schedule, prepare and teach lessons (including the half lesson), manage packs, reply to messages and keep required records. I don’t sell your data and don’t send advertising without separate consent.

4. Your authorization

By booking or contacting me after being shown this policy, you authorize the processing described here, including the international transfer to the providers listed. Authorization is not required in the cases of Art. 10, Law 1581.

5. Minors

Lessons are for adults (18+). A minor’s data must be provided and authorized by a parent or legal representative; otherwise it will be deleted.

6. Your rights

Under Art. 8, Law 1581 you can know, update and correct your data; request proof of your authorization; ask how it was used; revoke authorization or request deletion (unless a legal or contractual duty requires keeping it); access it free of charge; and complain to the Superintendencia de Industria y Comercio (SIC, www.sic.gov.co) after using the procedure below.

7. How to make a request

Email santiago@spanishtinto.com. Inquiries are answered within 10 business days (extendable by 5). Claims (correction, deletion, revocation) should include your identity, the facts and a reply address; they are answered within 15 business days (extendable by 8). Incomplete claims: I’ll ask for details within 5 days; after 2 months without reply the claim is considered withdrawn.

8. International transfers

The providers above may store or process data outside Colombia, mainly in the United States. Each processes data under its own terms and privacy policy.

9. Security and retention

HTTPS, strong passwords and two-factor authentication, access limited to me. Data is kept as long as needed for the purposes and for legally required accounting or tax periods, then deleted or anonymized.

10. Cookies

Spanish Tinto sets no cookies of its own. The embedded YouTube player and Cal.com (after you click through) may use cookies or similar browser storage under their own policies. You can block or delete them in your browser settings.

11. Changes

Substantial changes will be announced on this page before they apply.