Privacy Policy

1. Data controller

byneriaoi offers its services under the professional and creative identity Nerine Aoi.

The person responsible for processing personal data is the owner of this website, identified in the Legal Notice.

For privacy enquiries or to exercise your data protection rights, please contact nerineaoi@gmail.com.

This policy applies to byneriaoi.com, in English and Spanish.

2. Personal data collected

This website has no user accounts and does not store your information itself. Personal data is only received when you choose to get in touch:

• Through the contact form: your name, email address, the topic you choose and your message. The form also sends the language of the page and a technical check used to filter spam, and records that you confirmed reading this policy. The message is sent to my Gmail inbox and is not kept on the website.
• By email: your email address, the name you use, and your message and any information you voluntarily include.
• By WhatsApp: your phone number, the profile name and picture your WhatsApp settings make visible, and your messages and any information you voluntarily include. The WhatsApp link on this website opens a chat with a suggested first message, which you can change or delete before sending.

If you book lessons or a commission, additional information may be needed, such as your level and goals, your availability, the location of in-person lessons, and the details required to take payment or issue invoices.

When you visit the website, the hosting provider (Cloudflare) processes technical information about each visit, such as the IP address, the browser, the page requested and the time, as needed to deliver the website and keep it secure. This website does not use analytics and does not build visitor profiles.

Please do not include sensitive information, such as health details, in your enquiry. This website does not request banking details or payment card information.

3. Student records

If you take lessons, I keep private teaching records in Google Sheets so that lessons can be planned and followed up. These records are kept by me, not by the website, and may include:

• the student's name and contact details;
• lesson dates and attendance;
• subjects and exercises covered, and progress;
• learning difficulties and teaching observations that help adapt the lessons;
• suggested next steps.

Only the information needed to teach is recorded. Medical diagnoses or other health details are not requested. If you choose to share something of that kind so that lessons can be adapted, it is noted only with your explicit agreement and only as far as it is needed for teaching.

For students under 18, the contact details recorded are those of the parent or legal guardian, and information about the student is kept to a minimum.

Online lessons are not recorded.

4. Purposes and legal bases

Personal data may be processed to:

• Reply to enquiries and requests for information, and take the steps you ask for before booking lessons or a commission, under Article 6(1)(b) GDPR.
• Organise and give the lessons booked, keep the student records described above, carry out commissions and handle related communications, under Article 6(1)(b) GDPR.
• Note information about learning needs that you choose to share, only with your explicit consent, under Article 9(2)(a) GDPR where it concerns health.
• Comply with the legal, tax and invoicing obligations that apply, including keeping the booking confirmations and requests that consumer law requires (see the Lesson Terms), under Article 6(1)(c) GDPR.
• Keep the website and the contact form secure, prevent spam and abuse, and keep the website working, based on legitimate interests under Article 6(1)(f) GDPR.

The information you send is needed to deal with your enquiry. If it is not provided, it may not be possible to reply.

Your contact details will not be used to send advertising without a legal basis that allows it.

5. Service providers and international transfers

External providers are used to run the website and handle communications and lessons. Each receives only the data its service needs:

• Cloudflare hosts the website (Cloudflare Pages) and runs the contact form. It processes the technical information about each visit described in section 2, and passes contact form messages on to Google without keeping them. Cloudflare acts under the data processing terms included in its customer agreement. Cloudflare's analytics and log storage are not turned on for this website; Cloudflare keeps the technical data its network needs for security under its own privacy policy.
• Google provides Gmail (email, including the messages sent through the contact form), Google Apps Script (which delivers contact form messages to Gmail), Google Sheets (the student records described in section 3) and Google Meet (online lessons, including the sound, video and chat of the call while it takes place). These services are used from a personal Google account, under Google's Terms of Service and Privacy Policy for those accounts.
• WhatsApp (Meta) carries the messages you send by WhatsApp, under its own terms and privacy policy.

These providers may process data outside the European Economic Area, particularly in the United States. Such transfers rely on the safeguards set out in Chapter V of the GDPR, such as the European Commission's adequacy decision for the EU–US Data Privacy Framework or standard contractual clauses, depending on the provider.

Personal data may also be disclosed to public authorities, such as the Spanish Tax Agency, where required by law. Personal data is not sold to third parties or used for advertising.

6. Data retention

Information received through enquiries is kept for as long as needed to reply, follow up reasonably on the request and deal with any related responsibilities.

Student records are kept while lessons continue and for as long as reasonably needed afterwards, for example if lessons are resumed, and are then deleted. You can ask for them to be deleted earlier, unless the law requires otherwise.

Invoicing records, receipts and related documentation are kept for the periods required by tax, accounting and other applicable laws.

Once personal data is no longer needed and there is no other legal reason to keep it, it is deleted or, where applicable, blocked as required by law.

7. Information security

Reasonable technical and organisational measures are used to protect personal information against unauthorised access, loss, alteration or inappropriate disclosure.

External providers are used to host the website and transmit communications. Although security measures are applied, no system can guarantee absolute protection against every risk.

8. Students under 18

Lessons for students under 18 are booked and arranged with their parent or legal guardian, who is the contact for enquiries, scheduling and payment. Only the information about the student that is needed for teaching is recorded, as described in section 3.

People under 14 cannot give their own consent to the processing of their data under Spanish law. If you are under 18, please ask your parent or legal guardian to get in touch.

9. Your rights

Where applicable, you may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability.

Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing.

To exercise your rights, contact nerineaoi@gmail.com. Additional information may be requested where necessary to verify your identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es (opens in a new tab).

No solely automated decisions producing legal or similarly significant effects are made using the information you send.

10. Payments and invoicing

This website does not have an online shop or an integrated payment system.

Lessons are paid individually, by Bizum or cash, as explained in the Lesson Terms. Quotes and payment methods for commissions are agreed directly with each client.

When an invoice must be issued or a payment handled, only the personal data needed for that purpose and to comply with the relevant legal obligations will be processed.

When paying by Bizum, the information you provide to your bank or to Bizum is subject to their own terms and privacy policies.

11. Cookies and external content

This website sets no cookies of its own. In your browser it keeps only the light or dark theme you choose, if you choose one, and, for a moment, your place on the page when you switch language; both stay on your device. Cloudflare may use technical security cookies (see the cookie policy). It does not load fonts, videos or other content from third parties. The contact form sends your message only to this website's own address. Opening the WhatsApp link takes you to WhatsApp, where its own terms and policies apply.

For more information, see the Cookie Policy.

12. Updates

This Privacy Policy may be updated to reflect changes to the services, the providers used or legal requirements. Changes will be published on this page.