Data processing agreement (your students’ data)
The data of your students and the other people in your space belong to you: you are the controller. ADLANTE processes them only on your behalf, to provide the service. This agreement says how. It is part of the terms and you accept it with them.
Version borrador-2026-10-14 · 14 October 2026
DRAFT. This text has not yet been reviewed by a lawyer: it may change before it is final.
1. Who is who
The controller is the space (you): you decide what your students’ data are used for, which ones you ask for and how long you keep them.
The processor is ADLANTE ([Missing: the name or company of ADLANTE]): it processes them on your behalf, only to provide the service and as this agreement says.
This agreement is electronic and applies from when you accept the terms on opening your space (GDPR art. 28(9)). It lasts as long as they do, and what it says about deleting the data still applies afterwards.
2. What data, about whom and what for
About whom: your students and, if they are minors, their parents or guardians; whoever buys from your shop or courses; whoever signs up for your workshops; whoever writes to you from your website; and the people on your team.
What data, depending on the tools you use:
- To identify them and talk to them: name, email, phone and, if you ask for it, address or date of birth.
- Their account on your website: the email they sign in with and what they accepted, with its date.
- What they buy from you and pay you: orders, tickets, fees, class passes and their status. Not card numbers: Stripe processes those.
- Their classes: what they sign up for, attendance, absences and make-ups, and their progress in your courses.
- The permissions they give you (data, photos and videos), with who gave them and when; and, if they are minors, who their guardian is.
- The photos and videos you upload, and the notes you write.
ADLANTE does not ask you for health data or other specially protected data. If you write it yourself (for example, an injury in a note), it is your responsibility and only with that person’s express permission.
What for: only to provide what you use of ADLANTE: your website and your students’ area, your shop, your courses, your workshops, your student and payment management, and the emails ADLANTE sends on your behalf. Never to advertise anything to your students, sell them or train artificial intelligence.
3. Your instructions
ADLANTE processes the data only on your instructions: those in the terms and this agreement, and what you do in your panel (for example, signing up a student, sending them a charge or deleting them). If an authority required us to do otherwise, we would tell you beforehand, unless the law forbids it.
If an instruction of yours seems to us to break data protection law, we will tell you.
4. Confidentiality and security
Only the people at ADLANTE who need it to provide the service can see the data, and they are bound to keep it confidential.
ADLANTE protects the data with measures suited to their risk (GDPR art. 32), including: everything travels encrypted; ADLANTE does not store passwords (the accounts service stores them encrypted); each space only sees its own data and each person on its team only what you allow; card details do not pass through ADLANTE; the database is backed up; and what matters (payments, permissions and what each person accepts) is recorded with its date.
5. Sub-processors
To provide the service, ADLANTE relies on other companies (sub-processors). You give us general permission to use the ones on this list, which is today’s:
| Company | What for | Where | If it leaves the EU |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payments: the ADLANTE fee and each space’s sales (these, in the space’s own Stripe account). | Ireland (EU), with parts of the service in the USA. | European Commission standard contractual clauses |
| Google Ireland Limited (Firebase Authentication) | Accounts and sign-in (the email, the password stored encrypted, and the account identifier). | EU and USA. | European Commission standard contractual clauses |
| Cloudflare, Inc. | Serving the ADLANTE website and each space’s website, and storing their photos and files (R2) and videos (Stream). | Worldwide network; US company. | EU-US Data Privacy Framework and standard contractual clauses |
| Render Services, Inc. | The ADLANTE server and its database (where everything in the panel is stored). | US company; server region: to be confirmed. | European Commission standard contractual clauses |
| Resend, Inc. | Sending the emails ADLANTE sends on behalf of each space (orders, payments, notices). | US company; sending region: to be confirmed. | European Commission standard contractual clauses |
List up to date on 14 October 2026.
ADLANTE requires them by contract to meet the same obligations as this agreement and is liable to you for what they do.
If we add or change one, we will tell you at least 30 days in advance, by email and on this list. You can object, with a data protection reason, by writing to soporte@adlante.com before it starts. If we cannot find a solution, you can stop using, without paying anything for it, the tool that depends on it, or leave.
6. If the data leave the EU
Some sub-processors are outside the European Union or have parts of their service outside it. In that case, the data leave only with the safeguards the law requires: the European Commission’s standard contractual clauses and, where the company has signed up to it, the EU-US Data Privacy Framework (each one’s, in the list).
7. Helping you with your students’ rights
Your students may ask you to see, correct, take away or delete their data, or object to something. Answering them is your responsibility; ADLANTE helps you with the panel: seeing and correcting each one’s record, downloading your lists and archiving or deleting what is needed. If there is something you cannot do yourself, ask us.
If a student writes to ADLANTE to exercise their rights over your space’s data, we will not answer for you: we will pass their request on to you straight away and tell them to contact you.
8. If something goes wrong (a data breach)
If your space’s data are lost, stolen or seen by someone who should not see them, we will tell you without undue delay and within 48 hours at most of finding out, with what we know at that moment: what happened, what data and how many people, what we have done and what we recommend. Notifying the authority (within 72 hours) and, if needed, the people affected is your responsibility; we will give you what you need to do it.
We will also help you, with what we have, if you need to carry out an impact assessment or consult the authority.
9. When it ends
While you have your space, you can download your data from your panel. When it closes, we keep them for 90 days in case you come back or are missing something (as the terms say); after that, we delete them, including from backups as soon as they are renewed, except what the law requires us to keep (for example, proof of what each person accepted). If you ask us before then, we will give them back to you in a format any program can read.
10. Showing compliance
ADLANTE keeps its record of what it processes on behalf of spaces (GDPR art. 30(2)) and will give you the information you need to check that it complies with this agreement. If that is not enough, you can request an audit, giving at least 30 days’ notice, at most once a year, at your expense, by someone bound to confidentiality and without access to other spaces’ data.
11. What ADLANTE does as controller (not on your behalf)
There are data ADLANTE processes on its own account, as controller, and explains in its privacy policy: yours and your team’s (your accounts and what you pay ADLANTE), what is needed for the security of the service and against fraud, and usage figures without names (for example, how many spaces use a tool) to improve ADLANTE.
12. Liability
Each party is liable for its own part under data protection law. Everything else about liability is in the terms, except what the law does not allow to be limited.