1. Data Controller Information
Welcome to CEPE Languages (CEPE Idiomas). This Privacy Policy applies to our international website located at www.cepeidiomas.com/en/ and all associated language courses, online placement tests, immersion programs, and student support services.
For the purposes of the European Union General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the United Kingdom General Data Protection Regulation (“UK GDPR”), and related global privacy laws, the primary Data Controller is CEPE IDIOMAS LTDA, registered under CNPJ 30.557.726/0001-90, with registered offices at Rua Jaú, 955, Boqueirão, Praia Grande/SP, Suite 26 1F, Postal Code 11701-190, Brazil, and academic headquarters located at Av. Vélez Sarsfield 56, 1st floor, Córdoba, Argentina.
If you have any inquiries regarding this policy or how your personal information is managed, please contact our dedicated privacy team at contact@cepeidiomas.com.
2. Scope & Applicable Privacy Frameworks
As an international language school serving students across Europe, North America, Latin America, and worldwide, we adhere to the highest international data protection standards, including:
- European Union & United Kingdom: Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 2018 (UK GDPR).
- United States & California: California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA/CPRA”), and applicable federal guidelines.
- Cross-Border Transfer Guidelines: standard contractual protections, data minimization, and fair information processing principles established by international privacy supervisory authorities.
3. Personal Information We Collect
We collect information that identifies, relates to, describes, or is reasonably capable of being associated with an individual (“Personal Information”). Depending on your interactions with us, we may collect:
A. Identifiers & Contact Details
Full name, email address, telephone/WhatsApp number, residential city and country, passport/ID number (only when necessary for enrollment in study abroad programs in Argentina).
B. Educational & Language Proficiencies
Placement test responses, targeted languages (Spanish, English, Portuguese), course preferences (online private, online group, general exchange, 50+ immersion), attendance logs, and pedagogical evaluations.
C. Billing & Transaction Information
Transaction history, invoice details, and proof of payment. Payment processing is conducted via encrypted PCI-DSS compliant payment gateways; we do not store full credit card numbers or security codes on our servers.
D. Technical & Internet Activity Information
IP address, browser type, operating system, approximate geographic location, referring URLs, access timestamps, and interactions collected through functional cookies and aggregated analytics.
4. Lawful Bases for Processing Under the GDPR
Under GDPR Article 6, we only process your personal data where we have a recognized lawful basis:
- Performance of a Contract (Art. 6(1)(b)): processing required to deliver language instruction, process placement evaluations, manage class schedules, issue certificates, and administer in-person immersion stays in Córdoba.
- Compliance with Legal Obligations (Art. 6(1)(c)): retaining financial and tax documentation in compliance with administrative and commercial accounting laws.
- Legitimate Interests (Art. 6(1)(f)): securing our digital infrastructure, preventing fraud and automated spam, analyzing website performance, and enhancing our communicative teaching methods, provided your fundamental rights do not override these interests.
- Consent (Art. 6(1)(a)): sending non-essential marketing newsletters, promotional discounts, or when you explicitly opt-in to optional communications. You may withdraw consent at any time.
5. Information Sharing & Service Providers
We do not sell, rent, or trade your personal information. We only share information with third parties in the following strictly delimited circumstances:
- Academic Partners & Accreditation Bodies: we share pertinent student records with the National Technological University (Universidad Tecnológica Nacional - UTN) and official SIELE exam administrators exclusively to validate and issue accredited language certifications.
- Authorized Service Providers (Data Processors): trusted cloud hosting vendors, video communication tools (used for live digital lessons), transactional email gateways, and payment service providers bound by strict contractual confidentiality and data processing agreements.
- Legal & Regulatory Authorities: when required by applicable international or domestic law, court order, or official governmental directive.
6. International Cross-Border Data Transfers
Because our academic campus is located in Córdoba, Argentina, and our administrative office is based in Brazil, personal information collected from users located in the European Union, the United Kingdom, or the United States will be transferred across national borders.
We ensure all cross-border data transfers comply with Chapter V of the GDPR by implementing:
- Adequacy Decisions: Argentina has been formally recognized by the European Commission as offering an adequate level of data protection (Commission Decision 2003/490/EC).
- Standard Contractual Clauses (SCCs): where required, we execute the European Commission’s approved Standard Contractual Clauses with international service providers to guarantee equivalent levels of security.
7. Data Subject Rights Under GDPR & UK GDPR
If you are a resident of the European Economic Area (EEA) or the United Kingdom, you are entitled to exercise the following statutory rights:
Right of Access (Art. 15)
Request confirmation as to whether your personal data is being processed and obtain a free copy.
Right to Rectification (Art. 16)
Require the correction of inaccurate or incomplete personal records without undue delay.
Right to Erasure (Art. 17)
Request the deletion of your personal data (“Right to be Forgotten”) where retention is no longer legally justified.
Right to Restriction (Art. 18)
Obtain the restriction of data processing under circumstances specified in the regulation.
Right to Data Portability (Art. 20)
Receive your personal information in a structured, commonly used, machine-readable format.
Right to Object (Art. 21)
Object at any time to the processing of your data based on legitimate interests or direct marketing.
To exercise your GDPR rights, please submit a verified request to contact@cepeidiomas.com. We will respond within thirty (30) days as stipulated by European law.
8. Notice to California Residents (CCPA & CPRA)
This section provides specific information for California residents pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.):
- No Sale or Sharing of Personal Information: in the preceding twelve (12) months, CEPE Languages has not sold personal information to third parties, and has not shared personal information for cross-context behavioral advertising.
- Right to Know & Access: you have the right to request disclosure of the categories and specific pieces of personal information collected about you, the sources, and the business purposes.
- Right to Delete: you have the right to request deletion of personal information collected from you, subject to statutory exceptions (such as completing education transactions or fulfilling legal obligations).
- Right to Correct: you have the right to request the correction of inaccurate personal information maintained by us.
- Right to Non-Discrimination: we will never discriminate against you, deny services, charge different tuition rates, or alter course quality because you exercised your statutory privacy rights under California law.
California consumers or their authorized agents may submit a verifiable consumer request via email at contact@cepeidiomas.com with the subject line “California Privacy Rights Request”.
9. Data Retention & Technical Safeguards
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including during the student’s educational enrollment, and subsequently to comply with statutory accounting, tax, and academic credential verification obligations. Once the applicable retention window expires, personal records are securely deleted or irreversibly anonymized.
We implement industry-standard physical, organizational, and technical safeguards designed to protect personal data against accidental loss, unauthorized access, alteration, and disclosure. All transmissions over public networks are encrypted using modern Transport Layer Security (TLS/HTTPS).
11. Children's Privacy (COPPA & GDPR Art. 8)
Our online services and website are not directed to children under the age of 13 (or under 16 in certain European jurisdictions). We do not knowingly collect personal information directly from minors without verifiable parental or legal guardian consent. If we become aware that personal information of a child has been gathered without required guardian authorization, we will take immediate steps to delete such data from our servers.
13. Modifications to This Privacy Policy
We may periodically update this Privacy Policy to reflect modifications in our educational programs, technologies, or evolving legal frameworks. When updates occur, we will revise the “Last Updated” date displayed at the top of this document. Continued use of our website or services following such revisions constitutes acknowledgment of the updated terms.