This is a translation for convenience. The Spanish version is the legally binding one.
Last updated: 12 October 2026
Here we tell you what data of yours we process at academy.danielalfocea.com, why, who we share it with, how long we keep it and what you can do about it. It is written to be understood; if something is not clear, write to us.
1. Who processes your data
Alice & Bob, S.L., CIF B67932186, with registered office at Calle Marie Curie, 7, Edificio Beta, Planta 7 Ático — Parque Empresarial Rivas Futura, 28521 Rivas-Vaciamadrid (Madrid), telephone +34 647 879 318, is the data controller.
Daniel Alfocea creates and signs the content; the company is the one that processes the data, sells and invoices.
- Email for privacy matters: [email protected]
- Data protection officer: none has been appointed. The processing we do does not consist of the regular and systematic monitoring of data subjects on a large scale, nor does the volume of students and data we process reach a scale that requires it: for that reason we understand that we are not within the cases of article 37 GDPR or article 34 LOPDGDD. If the volume or type of processing changed in a relevant way —for example, if we began to process special categories of data on a large scale—, we would review this conclusion.
2. What data we process, what for and on what legal basis
This is the full table. If a processing activity is not here, we do not do it.
2.1. Your account and your access
| What we process | What for | Legal basis |
|---|---|---|
| Email address (it is your login identifier), name, preferred language, time zone and notification preferences | Creating and maintaining your account, and letting you in | Performance of the contract (art. 6.1.b GDPR) |
| The access links and one-time codes we send you | Letting you in without a password | Performance of the contract |
| Device identifier, browser (user agent) and the IP address with which each session was created | Showing you your devices, closing sessions, applying the session limit and detecting shared accounts | Performance of the contract and legitimate interest (art. 6.1.f): protecting the content we sell |
| Record of which version of the terms and of the privacy policy you accepted, when, from which IP and at what moment (sign-up, new version or purchase) | Being able to prove that we informed you | Legal obligation (art. 7.1 GDPR) and legitimate interest |
We do not do fingerprinting and we do not geolocate you precisely. For the device limit, the session identifier, the IP and the browser are enough, and we read nothing else from your device.
The processing based on legitimate interest in this policy —device limit, detection of shared accounts, watermark, anti-fraud and abandonment notices— rests on this balancing test: the purpose is legitimate (protecting paid content and preventing fraud), the measure is necessary (there is no other way to apply the device limit, the stamping or the abandonment notice without processing that data) and it is proportionate (we use the minimum data possible —session identifier, IP and browser—, we do not do fingerprinting or geolocation, and you can always object, although for the watermark that means we cannot give you the protected content). If you want more detail on this assessment, write to us.
2.2. Your study
| What we process | What for | Legal basis |
|---|---|---|
| Your progress: what you have watched or read in each lesson, how far, and when | So you can pick up where you left off, calculate your progress, apply prerequisites and decide whether you are entitled to the certificate. It also decides whether our refund guarantee applies (see terms and conditions of sale) | Performance of the contract |
| Usage signals from the player and the reader (progress, replays, where people get stuck) | Improving the content, in aggregate; and detecting that you have stalled | Legitimate interest (art. 6.1.f) |
| What you submit in assignments | Keeping a record of your submission | Performance of the contract |
| Your exam attempts and your grades | Marking, deciding whether you pass and issuing the certificate | Performance of the contract |
| The «this is wrong» notices you send us about a lesson | Correcting errors in the content | Legitimate interest |
2.3. Your certificates and your public face
| What we process | What for | Legal basis |
|---|---|---|
| Your name, the course, the date, the certificate identifier and its status | Issuing the certificate and making it verifiable | Performance of the contract |
| Publishing your name on the certificate verification page | So that whoever receives your certificate can check that it is real | Legitimate interest, with right to object: you can ask for your name not to appear and the page will still say the certificate is valid, without identifying you |
| Your public profile (URL alias, biography, links, certificates shown) | Showing your profile if you want | Consent. It is off by default, you turn it on and you turn it off whenever you want |
| Your ratings of products you have bought | Showing verified ratings on the product page | Performance of the contract and legitimate interest |
Certificate verification pages are not indexable by search engines and there is no list or search by name: they can only be reached with the exact certificate identifier.
2.4. Your purchases
| What we process | What for | Legal basis |
|---|---|---|
| What you bought, how much you paid, in which currency, when and with which payment reference | Giving you access, assisting you and keeping the accounts | Performance of the contract |
| Your tax data: country, name or company name, tax ID or VAT number, address; and the result of the VIES register check when you buy as a company | Issuing the correct invoice and applying the right VAT | Legal obligation (art. 6.1.c) |
| Evidence of where you are for VAT purposes: declared country, card country and IP address of the purchase | Determining the country of taxation, as VAT rules require | Legal obligation |
| Your express waiver of the right of withdrawal: that you ticked it, when and from which IP | Being able to prove that you gave it, if needed | Legal obligation and legitimate interest (defence of claims) |
| Your invoices | Complying with tax and commercial rules | Legal obligation |
Your card details do not pass through us. Payment is processed by Stripe inside our page; we never see or store the card number.
2.5. Emails and notices
| What we process | What for | Legal basis |
|---|---|---|
| Your email, to send you what is essential: access, purchase confirmation, invoice, certificate, security notices, access expiry, support replies | Performing the contract | Performance of the contract |
| Your email, to remind you that you left a course half done | So you don’t forget what you bought | Legitimate interest, and you can turn it off in your preferences |
| Your email, to send you news, launches and offers | Marketing | Consent, in a separate box, not pre-ticked and separate from the rest. We may also write to you about similar products if you have already bought from us, with one-click unsubscribe in every mailing (art. 21.2 LSSI) |
| Whether you opened the email or clicked, and whether it bounced | Knowing whether our emails arrive and stopping writing to those who do not receive them | Legitimate interest |
You can sign up for a product’s waiting list without having an account. In that case we only store your email, the language if you state it and your consent; the unsubscribe link in every email is your way out, and it always works, with no expiry and without logging in.
No automated email is a no-reply: all carry a reply address that opens a
support ticket.
2.6. Content protection
A dynamic watermark with your email or your identifier is painted over the video, in motion; and the PDFs, EPUBs and audios you download are stamped with data that identify you. It is what lets us know where a copy that turns up somewhere came from.
- What is processed: your email or your account identifier, over the content you yourself are viewing.
- Legal basis: legitimate interest (art. 6.1.f GDPR). Protecting the content is what makes it viable to sell, and the alternative —a DRM that controls your equipment— would be far more invasive.
- Your right: you can object; bear in mind that without this measure we cannot give you access to the protected content.
This is, together with the processing of employee data in section 2.8, the one with the most risk of a complaint in this whole policy: it identifies the student inside a copy of the content. We stand by it because the alternative —a DRM that controls your device, or not protecting the content at all— is more invasive or commercially unviable, and because the data we use is the minimum necessary (your email or your identifier, never data about your device) and is only applied to what you yourself are consuming, not to third parties. The legitimate interest assessment for this particular processing is the first one to be drafted within the general LIA of section 2.1.
2.7. Analytics and advertising
| What | How | Legal basis |
|---|---|---|
| Our own measurement of visits and conversions | Calculated on our server, without cookies and without storing identifiers in your browser | Legitimate interest. It does not identify you |
| Meta pixel (Facebook/Instagram) in your browser | It loads from the first visit, with no prior banner, on the public site and in the application. Meta receives the pages you view, your IP, your browser and the _fbp cookie | Legitimate interest (art. 6.1.f GDPR): measuring the results of our ads. You can object by writing to us |
| Meta Conversions API (from our server) | We send usage events (page view, product you look at, sign-up, free download) with your IP, your browser, the Meta cookies _fbp and _fbc if you have them and, if you have a session, your email and an identifier of your account hashed with SHA-256, whether or not you have accepted cookies | Legitimate interest (art. 6.1.f GDPR). You can object by writing to us |
| Meta Conversions API: payment page and purchase | When you open the payment page and when you pay an order, the event (amount, currency, product, your email and an identifier of your account hashed with SHA-256, your IP, your browser and your Meta cookies _fbp and _fbc if you have them) is sent by the payment platform (billing.danielalfocea.com), with its own policy | Legitimate interest |
| Google Analytics 4 (from our server) | Only if you accept Google Analytics in the application’s notice. We do not load its script in your browser | Consent |
| Affiliate attribution | A first-party 30-day cookie (academy_ref), only if you accept in the application’s notice | Consent |
The public site has no cookie banner. The application has a notice only for Google Analytics and the attribution cookie; rejecting it does not turn off Meta. To avoid Meta you can use a blocker or your browser’s settings (the sending from the server is only stopped by objecting in writing).
The detail of cookies —what each cookie is, who sets it, how long it lasts and how to turn off the pixel— lives in the cookie policy, a separate document. This policy limits itself to declaring the processing.
2.8. If you study with a seat paid for by your company
When a company buys seats for its employees, we give it a report per seat with: whether you have completed the course, your exam grade, your progress percentage and your last activity by week, never by hour. Never schedules, minutes watched or detailed activity.
Your account is yours, not the company’s: if you leave, the seat is freed and the company learns that, not your personal data.
Regarding your employees’ data, we act as processors for your company: we process it only to provide the training service you have contracted, not for our own purposes, and within the instructions set out in the B2B contract with its data protection annex (section 11 of the terms and conditions of sale). Informing your staff about the processing of their data is your responsibility as the client company, as that same contract states, which is signed in writing with each company before any seat is registered.
2.9. Record of who looks at your data
We keep a record each time someone on our team —or a tool with credentials— opens the personal data of a specific student: their progress, their submissions, their exams, their orders and invoices, or their account record. That record is included in the data download you can ask us for, in the part that concerns you.
Legal basis: legal obligation (arts. 5.1.f and 32 GDPR) and legitimate interest.
3. Who we share your data with
We do not sell your data or hand it to anyone so they can advertise to you.
We do work with providers that process data on our behalf. Article 28 GDPR requires a processing agreement with each one, and we have it signed or accepted with all those in this table.
| Provider | What for | Where it processes the data | Transfer outside the European Economic Area |
|---|---|---|---|
| Stripe | Collecting and managing payments, refunds and disputes | Ireland (European entity), with parent company in the United States | Yes. Covered by the EU-US Data Privacy Framework and standard contractual clauses |
| Bunny (BunnyWay d.o.o.) | Serving the video, and storing and serving PDF, EPUB and audio | Slovenia (headquarters); storage has a configurable region — it is fixed to Germany (Falkenstein/Frankfurt); the delivery network has points of presence worldwide | In storage, no, as long as the region stays fixed to Germany. In delivery through the distribution network, yes, with no specific transfer mechanism verified |
| Emailit | Sending service and transactional emails, including the link you log in with | Czech Republic (entity FunFirst s.r.o., Prague) | No, according to the provider’s policy — without independent verification |
| Acumbamail | Sending campaigns and bulk emails | Spain (Stackscale, Madrid). Owned by Growens (Italy) since 2018, within the European Union | No |
| Cloudflare | Serving the pages, protecting them and filtering traffic | United States, with a global network; no selectable data residency outside enterprise plans | Yes. Data Privacy Framework and standard contractual clauses |
| Hetzner | Servers where the platform lives and backups | Germany (European Union) | No |
| Sentry | Collecting the platform’s technical errors, already filtered of personal data before sending | Frankfurt, Germany (Sentry’s European Union region) | No |
In addition, we may disclose your data to the tax authorities, to judges and courts, and to law enforcement when the law obliges us.
The article 28 processing agreements are signed or accepted with all the providers in the table:
- Stripe includes it in its general contract, accepted when the account was opened.
- Bunny, Hetzner, Cloudflare and Sentry have it accepted in each provider’s dashboard.
- Acumbamail and Emailit, which do not offer self-service, have it signed in writing.
- Stripe does not act only as a processor: for the part of payment processing it handles under its own legal obligations (anti-fraud, regulatory compliance), it acts as an independent controller, not on our behalf.
- Bunny’s storage region is fixed to Germany (Falkenstein/Frankfurt). Sentry processes errors in its European Union region, in Frankfurt.
- Groq, which comes in when automatic transcriptions arrive, will be added to this table with its processing agreement before receiving any data.
If you want a copy of a specific provider’s processing agreement, write to us.
4. How long we keep your data
| Data | How long |
|---|---|
| Your account and what hangs from it | While you keep it open |
| After you delete your account | What section 6 says is deleted. What the law obliges us to keep is blocked: it is not used for anything, only kept in case an authority or a judge requests it (art. 32 LOPDGDD) |
| Invoices and billing records | 6 years, as the Commercial Code requires |
| Evidence of where you were for VAT purposes | 10 years, as VAT rules require for the one-stop-shop scheme |
| Your waiver of withdrawal and your acceptances of the terms | 5 years, the general limitation period for personal actions |
| Marketing consent record | While you maintain it, and afterwards as proof that you gave it |
| Your email address after you unsubscribe from marketing | Kept suppressed, only so that we never write to you again |
| Session and device records | 12 months |
| Unused devices and sessions | Expire on their own after 90 days |
| Player usage signals | Aggregated or pseudonymised after 12-24 months |
| Record of who accessed your data | While you have an account, and afterwards for the time needed to answer for it |
The periods that are not imposed by a rule —the 12 months of session records, the 12-24 months of aggregated or pseudonymised usage signals, and the 5 years of the consent and withdrawal-waiver records— are our own criterion: we set them this way because they more than cover the time in which we might need them to answer for a security incident, a fraud or a claim, without keeping the data longer than makes sense. Those for invoices (6 years) and location evidence for VAT purposes (10 years) are imposed by rule and are not negotiable.
5. Your rights
You have the right to access your data, rectify it, erase it, object to some processing, request restriction of processing and request the portability of your data in a structured format.
You can do almost everything yourself, without writing to anyone, from your private area:
- Download your data. We prepare it in the background and send you a link that is valid for 24 hours and a single use. It counts as access and as portability.
- Correct your data. Name, language, time zone and preferences, from your profile. The email is changed with double confirmation, in the old inbox and the new one.
- Object. Half-finished-course reminders and abandonment notices are turned off with a switch in your preferences. Marketing is stopped with the unsubscribe link in any email.
- Delete your account. From your private area. We ask you for confirmation by email, and when it is done we let you know.
How long we take: one month from your request, as article 12.3 GDPR sets. Account deletion runs step by step through all the systems involved and is not considered finished until every step is done; the confirmation email reaches you at the end, not the beginning.
What is NOT deleted when you delete your account, and why:
| What is kept | Why |
|---|---|
| Your invoices and their tax data | Legal obligation. They are kept 6 years and blocked: only used if the tax authority or a judge requests them from us |
| The certificates we have already issued | They keep being verifiable. You can ask for your name not to appear on the verification page |
| Your address on the mailing list | It goes to suppressed status. It is not fully deleted because it is the only way to guarantee that no future import writes to you again (art. 17.3 GDPR) |
| The error notices you sent us | They are anonymised: we remove the link to you and keep the notice, which no longer identifies anyone and still serves to fix the content |
| Aggregated and anonymous metrics | They no longer identify you, there is nothing to delete |
If you think we have done something wrong, write to us first. And in any case you can complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
6. Minors
To create an account or buy on the platform you must be 18 years of age or older (decided by Dani on 2026-09-01). At sign-up we ask you to declare it expressly. We do not knowingly create accounts for people under that age; if we detect one, we close it and delete its data.
The LOPDGDD (art. 7) admits valid consent from age 14; 18 is a business decision, not a legal obligation, to avoid the mess of a minor paying with a parent’s card. The same number is in the terms and conditions of sale, section 1.
7. Security
We apply reasonable technical and organisational measures: encryption in transit, role-based access control, a record of who accesses personal data, backups and separation of environments. If a breach occurs that poses a risk to you, we will tell you, and we will notify the Spanish Data Protection Agency within the 72 hours set by article 33 GDPR.
Our procedure for a security breach is: detect it and contain the problem as soon as it is known; assess in the first hours which data and how many people it affects, and what risk it poses to you; if there is a risk to your rights and freedoms, notify the Spanish Data Protection Agency within 72 hours of becoming aware of it (article 33 GDPR), even if we do not yet have all the information —the notification can be completed later—; if the risk is high, also notify you without undue delay, telling you what has happened and what measures to take; and document any breach internally, whether or not we have to notify it (article 33.5 GDPR).
8. If you come from alicebob.io
If you were already a student at alicebob.io, your data has not been transferred to anyone: the controller has always been the same and the only thing that has changed is the platform that hosts it. We told you in the moving email, with the list of new providers and the link to this policy.
9. Changes to this policy
This policy has versions. When we publish a new one that affects you, we show it to you and ask you to accept it the next time you log in; until you do, you can read the text, download your data and delete your account.