Privacy Policy — AIM School App

1. Who is responsible for your data

Data controller: AIM House Malaga S.L., CIF B22998934, Diseminado Rincón del Hinojal, 20, 29650 Mijas, Málaga, Spain. Contact: info@aimschool.es

AIM House Malaga S.L. ("the School") decides what personal data is collected through the App and why, and is responsible for it under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD).

Data processor: Locitium Labs Ltd, company number HE 495136, 10 Kyriacou Matsi Avenue, Liliana Court, 4th Floor, 1082 Nicosia, Cyprus.

Locitium Labs Ltd develops and operates the App on the School's behalf under a written data processing agreement, processes personal data only on the School's documented instructions, and does not use it for its own purposes. Both companies are established in the European Union, so no third-country transfer arises between them.

2. What data we process

Parents and guardians: name, email, postal address, telephone number, WhatsApp number, preferred language; emergency contact name and phone; NIF/NIE or equivalent, ID type, country code, fiscal address, billing email addresses; card brand and last four digits, payment method reference, Stripe customer reference, subscription and invoice records, payment failures and ledger entries; authorised pickup persons you nominate; records of consent, permission acceptances and digital signatures.

Children: first and last name, date of birth, class and programme; photographs and avatar images including images captured at check-in; check-in and check-out times, absences and stated reasons; skill levels in English, mathematics and Spanish, placement assessments and recommended level; medical conditions, medication, allergies, additional support needs and doctor's details where provided at enrolment; safeguarding and incident records; meal plans, dietary orders and activity enrolments; a numeric check-in code.

Prospective families: enquiry and enrolment data including parent and child names, contact details, the child's date of birth, previous school, nationality, languages spoken, home address, viewing bookings and related notes.

Staff: name, role, contact details, date of birth, NIE, IBAN, address, salary and employment terms, contracts and signatures, attendance and check-in records, vacation accrual and expense claims.

Technical and device data: push notification identifiers and notification preferences; session and authentication data held on your device; audit logs recording actions taken in the App, including IP address, device or browser user agent, and a record of the change made.

3. Special category data

Children's health information — medical conditions, medication, allergies and support needs — is special category personal data under Article 9 of the GDPR. It is processed only on the basis of your explicit consent, given at enrolment, and where necessary to protect the vital interests of a child in a medical emergency. You may withdraw consent at any time, though the School may need to retain certain records to meet its duty of care.

Safeguarding and incident records are processed on the basis of the School's legal obligations and its legitimate interest in child welfare.

4. Why we process data and on what legal basis

Providing the App and portal accounts — contract. Enrolment and admissions — contract and pre-contractual steps. Attendance, check-in and child collection — legitimate interests, child safety. Medical, allergy and medication records — explicit consent and vital interests. Safeguarding and incident records — legal obligation and legitimate interests. Tuition invoicing, payments and accounting — contract and legal obligation under Spanish tax and invoicing law. Photographs used in the App or in communications — consent. Push notifications and WhatsApp messages — consent, and legitimate interests for service messages. Payroll and HR records for staff — contract and legal obligation. Security, audit logging and fraud prevention — legitimate interests.

5. Who we share data with

We do not sell personal data and we do not use it for advertising. We share data with: Locitium Labs Ltd (Cyprus), which develops and operates the App as the School's processor; Supabase, for database, authentication and file storage hosting; Stripe, for payment processing and card handling, acting as an independent controller for its own regulatory purposes; Quipu, for invoicing and accounting; WhatsApp/Meta, only where you have opted in to WhatsApp notifications; OneSignal, for delivery of push notifications; professional advisers, accountants and auditors where required; and public authorities where disclosure is legally required.

Some providers process data outside the European Economic Area. Where that happens, transfers are made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

6. How long we keep data

Pupil records: for the duration of enrolment and thereafter as required by Spanish education and civil law. Financial and invoicing records: six years, in line with Spanish tax and commercial record-keeping requirements. Safeguarding and incident records: in line with the School's safeguarding policy. Push notification identifiers: until you disable notifications or delete your account.

7. Your rights

Under the GDPR and LOPDGDD you have the right to access your data and your children's, to have inaccurate data corrected, to have data erased where no legal duty requires us to keep it, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time without affecting processing already carried out.

To exercise these rights, contact the School at info@aimschool.es. We will respond within one month.

You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or your local supervisory authority.

8. Deleting your account and data

You can request deletion of your account and associated personal data at any time: in the App under Settings, by email to info@aimschool.es, or online at https://aimschool.es/delete-account

We will delete your account and personal data within 30 days, except where law requires retention — principally financial and invoicing records, kept for six years, and safeguarding records. We will tell you what has been retained and why.

9. Children's privacy

The App is intended for adults — parents, guardians and School staff. Children do not hold accounts and are not the intended users. We process data about children on behalf of the School, as described above.

10. Security

Data is encrypted in transit. Access is restricted by role, administrative actions are recorded in an audit log, and access to children's health and safeguarding data is limited to staff who need it. Files containing children's photographs, signed contracts and invoices are held in private storage that is not publicly accessible.

11. Changes to this policy

Any changes will be posted on this page with an updated date. Where changes are significant we will notify you in the App.

12. Contact

Data controller: AIM House Malaga S.L., Diseminado Rincón del Hinojal, 20, 29650 Mijas, Spain — info@aimschool.es

Data processor: Locitium Labs Ltd, 10 Kyriacou Matsi Avenue, Liliana Court, 4th Floor, 1082 Nicosia, Cyprus