Ucademy
Log in

Privacy Policy

Last updated: 18 May 2026

1. Data controller

The controller of your personal data is UCADEMY, S.L. (“UCADEMY”), with Spanish tax ID number B-02846970 and registered address at Paseo de la Castellana, 178-bis, 2nd floor, 28046 Madrid, Spain.

Contact email: info@ucademy.com.

This Privacy Policy governs how UCADEMY processes personal data through its Website, https://www.ucademy.com/, its contact forms, the academic services purchased from the academy, and any other channel through which UCADEMY collects users' personal data.

2. Data we process

UCADEMY may process the following categories of data:

  • Identification and contact details: first and last name, Spanish national ID or foreign national ID number (DNI/NIE, when needed for enrolment or the issuance of official qualifications), postal address, email address, and phone number.
  • Academic data: previous studies, chosen area of study (University, Civil Service Exams, or Vocational Education), course progress, mock test and exam results, and interactions with tutors and the platform.
  • Financial and billing data: information needed for billing and, where applicable, bank details or payment references processed by the payment gateway provider.
  • Browsing and device data: IP address, device identifiers, browser type and version, operating system, pages visited, date and time of access, and data collected through cookies (see our Cookie Policy).
  • Communications data: the content and metadata of communications between the user and UCADEMY through forms, email, or messaging and support systems.

3. Purposes and legal bases for processing

UCADEMY processes users' personal data for the following purposes, on the legal bases set out in Article 6 of the GDPR:

  • Responding to requests for information and contact made through web forms, phone calls, or email. Legal basis: the user's consent [Article 6(1)(a) GDPR] and/or steps taken at the data subject's request before entering into a contract [Article 6(1)(b) GDPR].
  • Managing enrolment, delivery, and monitoring of academic services purchased from UCADEMY, including access to the virtual campus, materials, mock tests, tutoring, and the issuance of certificates where applicable. Legal basis: performance of a contract to which the data subject is a party [Article 6(1)(b) GDPR].
  • Complying with legal obligations relating to tax, accounting, commercial matters, and, where applicable, education (as a centre authorised by the Ministry of Education, Vocational Training and Sports). Legal basis: compliance with a legal obligation [Article 6(1)(c) GDPR].
  • Sending marketing communications about UCADEMY's products, services, news, and promotions, as well as those of its brands (Atlas, Polaris, and Explora). Legal basis: the user's consent [Article 6(1)(a) GDPR] and, for customers of similar products or services, UCADEMY's legitimate interests under Article 21(2) of Law 34/2002 (LSSI-CE). Users may object to these communications at any time.
  • Analysing usage and improving the Website and services using browsing data and cookies. Legal basis: the user's consent [Article 6(1)(a) GDPR] where applicable and, for strictly aggregated analytics, UCADEMY's legitimate interests [Article 6(1)(f) GDPR].
  • Keeping the Website secure and preventing fraud. Legal basis: UCADEMY's legitimate interests [Article 6(1)(f) GDPR].

UCADEMY does not make automated decisions, including profiling, that produce legal effects for users or similarly significantly affect them.

4. Retention periods

UCADEMY will retain users' personal data for the following periods:

  • Contact details collected before a contract is signed: for as long as the business relationship continues and, after it ends, until the limitation period for any resulting claims expires.
  • Students' academic data: while the service is provided and, after it ends, for the periods required by applicable education regulations (for example, the retention periods for academic records in official education programmes).
  • Financial and billing data: for at least six (6) years under Article 30 of the Spanish Commercial Code and applicable tax legislation (the General Tax Law).
  • Data used to send marketing communications: until the user withdraws consent or objects to the processing.
  • Cookies and browsing data: for the periods stated in the Cookie Policy.

After these periods, the data will remain duly blocked until any potential liabilities arising from the processing become time-barred. The data will then be deleted.

5. Recipients and disclosure of data

UCADEMY does not share users' personal data with third parties for commercial purposes. To provide its services and operate the Website, however, UCADEMY uses providers that act as data processors under Article 28 of the GDPR. UCADEMY has entered into the corresponding data processing agreements with them. These providers include:

  • HubSpot, Inc.: contact form management, CRM, and marketing communications.
  • Google Ireland Limited / Google LLC: web measurement and analytics (Google Analytics 4 and Google Tag Manager).
  • Stripe Payments Europe, Ltd. / Stripe, Inc.: payment gateway for purchasing services.
  • Trustpilot A/S: management and publication of customer reviews and opinions.
  • Other technology providers (web hosting, email, communications, support, and customer service) strictly necessary to provide the services.

UCADEMY may also disclose data to public bodies and competent authorities when required by a binding legal provision (the Spanish Tax Agency, the Ministry of Education, Vocational Training and Sports, courts and tribunals, etc.).

6. International data transfers

Some of the data processors mentioned above, particularly HubSpot, Google, and Stripe, are based outside the European Economic Area (EEA) or may process personal data there, especially in the United States. These transfers are made with appropriate safeguards, specifically:

  • The provider's participation in the EU–U.S. Data Privacy Framework, approved by the European Commission in Implementing Decision (EU) 2023/1795 of 10 July 2023.
  • The signing of Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

Users can request a copy of the safeguards applicable to these transfers by emailing info@ucademy.com.

7. Users' rights

Under Articles 15 to 22 of the GDPR and Organic Law 3/2018 (LOPDGDD), users may exercise the following rights:

  • Access their personal data.
  • Rectify inaccurate or incomplete data.
  • Have their data erased (the right to be forgotten) when it is no longer needed for the purposes of processing.
  • Restrict processing in the circumstances provided for by law.
  • Object to processing, including for advertising purposes.
  • Receive their data in a structured, commonly used, machine-readable format (data portability).
  • Not be subject to automated individual decisions that produce legal effects or significantly affect them.
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Users can exercise these rights free of charge by emailing info@ucademy.com with the subject line “Data Protection”, stating which right they wish to exercise and attaching a copy of their DNI/NIE or an equivalent identity document.

Alternatively, they can send their request by post to: Paseo de la Castellana, 178-bis, 2nd floor, 28046 Madrid, Spain.

If users believe that the processing of their personal data does not comply with the law, or that their request to exercise their rights has not been satisfactorily resolved, they can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid) through its online portal: https://www.aepd.es/.

8. Minors

Under Article 7 of Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), processing the personal data of children under fourteen (14) on the basis of consent is lawful only if the person who holds parental responsibility or guardianship has given consent.

If you are under 14, you must not provide your personal data to UCADEMY without prior permission from your parents or legal guardians. If UCADEMY becomes aware that personal data appears to belong to a child under 14, it will delete that data.

9. Accuracy and updating of data

Users guarantee that the personal data they provide is accurate and agree to inform UCADEMY of any changes. Users are solely responsible for the accuracy of the data they provide.

10. Data security

UCADEMY has adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risks of processing, in accordance with Article 32 of the GDPR. These measures are intended to prevent the loss, misuse, alteration, unauthorised access, or theft of personal data. Access to users' data is limited to authorised staff who are bound by confidentiality obligations.

Even so, users should be aware that no security measures on the Internet are completely secure.

11. Changes

UCADEMY may amend this Privacy Policy to reflect changes in legislation, case law, or the providers it uses. The current version is the one published on the Website. Users are encouraged to review it periodically.

12. Acceptance

Users confirm that they have been informed of the terms governing the protection of their personal data and accept and consent to its processing by UCADEMY in the manner and for the purposes described in this Privacy Policy.