Privacy Policy

The controller of your personal data is [Company / Legal Entity Name] ([Tax ID / NIF/CIF]), with registered address at [Registered Address] (the "Company", "we", "us"). For any privacy matter you can reach us at theapextradingacademy@gmail.com.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR") and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights ("LOPDGDD"), together with any implementing or related Spanish and EU legislation.

This policy describes what data we collect, why we collect it, the legal basis for each processing activity, how long we keep it, and the rights available to you.

Depending on how you use the site and the course platform, we may collect:

• Account and enrollment data — name, email address, username, password (stored only as an encrypted hash), course progress, and student enrollment records.
• Transaction history — records of purchases, invoices, and billing details associated with your enrollment.
• Technical data — IP address, browser type and version, device information, operating system, referring pages, and server log data collected when you visit the site.
• Correspondence — messages you send us by email or through the platform, including support requests.
• Marketing preferences — your newsletter subscription status and communication preferences.

We do not collect special categories of personal data, and we do not knowingly collect data from minors.

Payments for course enrollment are processed by certified PCI-DSS compliant third-party payment gateways. Your full payment card credentials are entered directly into the payment provider's secure environment and are never stored on our servers.

We only receive and retain the information necessary to identify the transaction — such as the payment reference, the amount, the date, and a truncated card or payment identifier — for billing, accounting, and customer-support purposes.

• Performance of a contract — to provide access to the course platform, deliver the educational content you enrolled in, manage your student account, and provide customer support (GDPR Art. 6(1)(b)).
• Compliance with legal obligations — to issue invoices, keep accounting records, and comply with Spanish tax, commercial, and consumer-protection obligations (GDPR Art. 6(1)(c)).
• Legitimate interest — to prevent fraud, secure the platform, protect our systems and users, and improve our services based on aggregated usage patterns (GDPR Art. 6(1)(f)).
• Consent — to send marketing and educational newsletters, and to use non-essential cookies, where you have opted in (GDPR Art. 6(1)(a)). You may withdraw consent at any time.

We send administrative emails about your enrollment and account (these are part of the service and are not marketing). We send our newsletter and educational updates only where you have given your consent, for example by subscribing through the opt-in form.

Every marketing email includes a clear unsubscribe link, and you can also withdraw your consent at any time by writing to theapextradingacademy@gmail.com. Unsubscribing does not affect service-related communications about your enrollment.

We use the following categories of cookies and similar technologies:

• Technical cookies — strictly necessary for the site to function, such as keeping you signed in to the course platform. These cannot be disabled.
• Analytical cookies — help us understand how visitors use the site (pages visited, time on page) so we can improve it.
• Preference cookies — remember choices you make, such as language or display preferences.

You can accept, reject, or delete cookies through your browser settings. Restricting cookies may affect parts of the site — for example, you may not be able to remain signed in to the course platform. Most browsers allow you to block all cookies, block only third-party cookies, or delete existing cookies; see your browser's help documentation for details.

We share personal data only with service providers acting as data processors under our instructions, including:

• Cloud hosting providers — hosting the website and course platform.
• Payment processors — handling enrollment payments in a PCI-DSS compliant environment.
• Transactional email service providers — delivering account, enrollment, and newsletter emails.
• Analytics tools — providing aggregated statistics about site usage.

Each processor is bound by a data processing agreement and may process your data only to provide its service to us. We do not sell your personal data.

Some of our service providers may process data outside the European Economic Area (EEA). Where that happens, we ensure an adequate level of protection through adequacy decisions adopted by the European Commission or, where none exists, through Standard Contractual Clauses (SCCs) approved by the European Commission, together with additional technical and organisational safeguards where required. You can request details of the safeguards applied by writing to theapextradingacademy@gmail.com.

We keep your personal data only as long as necessary for the purposes described in this policy:

• Account and enrollment data — retained while your enrollment is active and for as long as you keep your account.
• Billing and transaction records — retained for the statutory tax and commercial retention periods under Spanish law (currently six years for commercial and accounting documentation under the Código de Comercio, and four years for tax purposes under the Ley General Tributaria).
• Newsletter data — retained until you unsubscribe, plus a minimal suppression record to honour your opt-out.
• Technical log data — retained for a short period consistent with security and fraud-prevention needs.

After the applicable retention period, data is deleted or irreversibly anonymised.

Under the GDPR and the LOPDGDD you have the following rights (sometimes referred to as ARCO-POL rights):

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data when it is no longer necessary or lawfully processed.
• Restriction of processing — request that we suspend processing in certain circumstances.
• Data portability — receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller.
• Objection — object to processing based on legitimate interest, including profiling.
• Withdrawal of consent — withdraw consent at any time for processing based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, write to theapextradingacademy@gmail.com identifying yourself sufficiently. We will respond within one month, extendable by two further months for complex requests. You may also use the forms and guidance published by the Spanish supervisory authority.

If you believe your data protection rights have been infringed, you may file a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es. You may also lodge a complaint with the supervisory authority of your country of residence or place of work within the EU.

We apply technical and organisational measures appropriate to the risk, including encrypted connections (TLS/HTTPS), access controls on a need-to-know basis, hashed passwords, and regular review of our systems. While no system can be guaranteed fully secure, we are committed to protecting your data and to notifying you and the competent supervisory authority of any personal data breach where legally required.

We may update this Privacy Policy to reflect changes in our services or in applicable law. The revision date at the top of this page always shows the current version. Material changes will be communicated through the site or by email where appropriate.

For any question about this Privacy Policy or the way we handle your personal data, contact [Company / Legal Entity Name] at theapextradingacademy@gmail.com or by post at [Registered Address].