Privacy Policy

Last updated: 30 September 2026

Centro de Línguas de Lagos (“we”, “us”) operates the website www.centrodelinguas.com. This Privacy Policy explains which personal data we process when you visit our website or contact us, why we do so, how long we keep it and which rights you have. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the Portuguese Law No. 58/2019 and, for cookies, the Portuguese Law No. 41/2004.

1. Who is responsible for your data

Centro de Línguas de Lagos
Rua Dr Joaquim Tello, 32, 1º esq
8600-583 Lagos, Portugal
NIF: [tax number]
Phone: +351 282 761 070
Email: info@centrodelinguas.com

We have not appointed a Data Protection Officer, as we are not legally required to. For all data protection questions, please contact us at the address above.

2. Overview: what we process

• Every visit: technical connection data (e.g. IP address, date and time, page requested, browser) in the server log files.
• Contact form: name, email address, subject, message and, if you tick the box, your consent to receive our newsletter.
• Review form: name, email address, your review and your choice whether your name is shown.
• Cookies: only technically necessary cookies – no tracking or advertising cookies.

We do not use analytics or tracking tools, we do not create user profiles and we do not use automated decision-making within the meaning of Art. 22 GDPR.

3. Hosting and server log files

Our website is hosted by Köhler IT-Services, Dahlen, Germany, on servers located in the European Union. We have concluded a data processing agreement with this provider in accordance with Art. 28 GDPR.

Each time you visit our website, your browser automatically transmits information that is stored in server log files: IP address, date and time of the request, the page or file requested, the amount of data transferred, the referring page, and the browser type and version. This data is required to deliver the website and to ensure its security (e.g. to detect attacks).

Legal basis: our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).
Storage period: log files are deleted automatically after [14] days, unless a security incident requires longer retention to investigate it.

4. Cookies and similar technologies

We only use cookies that are strictly necessary for the website to work. According to Art. 5(1) of Law No. 41/2004, these cookies do not require your consent. We do not use any analytics, marketing or social media cookies.

In addition, our spam protection (see section 7) temporarily stores a verification token in your browser’s local storage when you submit a form. You can delete cookies and stored data at any time in your browser settings.

5. Contact form and contacting us by email or phone

When you contact us via the contact form, by email or by phone, we process the data you provide (name, email address, subject, message and, where applicable, phone number) in order to answer your enquiry. The contact form sends your message by email to our staff; the language of the website you used is added so we can reply in your language.

Legal basis: steps prior to entering into a contract, e.g. questions about courses and fees (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Storage period: we delete enquiries when they have been fully dealt with and no statutory retention obligations apply, at the latest after [2 years]. If you become a student, the data becomes part of your student records.

Newsletter / marketing emails

If you tick the box “Marketing preferences” in the contact form, we will use your email address to inform you about new courses, offers and discounts. This is entirely voluntary.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time, e.g. by replying to one of our emails or writing to info@centrodelinguas.com. The withdrawal does not affect the lawfulness of processing before it.

6. Customer reviews

You can write a review of our school on our website. For this we process your name, your email address, your review text, your choice whether your name or “Anonymous” is shown, the language of the website and the date.

• Email confirmation: after submitting, you receive an email with a confirmation link. This ensures that the review really comes from you. Reviews that are not confirmed are automatically deleted after 7 days.
• Checking and publication: we check every review before publishing it. After publication, we inform you once by email. Your review, the name you chose (or “Anonymous”) and the month of submission are published on our website. Your email address is never published.
• Abuse protection: to limit the number of submissions per day, we store a one-way encrypted (hashed) value derived from your IP address. Your IP address itself is not stored with the review.
• Translation: to show reviews in the other languages of our website, we may translate the review text with the translation service described in section 10. Your name and email address are not sent to it.

Legal basis: your consent, which you give by ticking the consent box (Art. 6(1)(a) GDPR). You can withdraw it at any time; we will then remove your review from the website and delete your data.
Storage period: as long as the review is published or until you withdraw your consent.

7. Spam protection (Cap)

To protect our contact and review forms against automated spam, we use “Cap”, a privacy-friendly verification that works without image puzzles. Your browser solves a small computing task; the result is checked on a server operated by our hosting provider Köhler IT-Services in the EU. No cookies are set for this, no personal profile is created and no data is passed on to third parties. The program code of the widget is loaded from the jsDelivr network (see section 9).

Legal basis: our legitimate interest in protecting our website against abuse (Art. 6(1)(f) GDPR).

8. Maps (OpenStreetMap)

On our contact page, on the “Find Us” page and on the home page we show a map from OpenStreetMap, provided by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. To display the map, your browser loads map images directly from the OpenStreetMap servers; in doing so, your IP address and technical browser data are transmitted to the OpenStreetMap Foundation. Only the address of our website (not the individual page) is transmitted as the referring page. The United Kingdom has an adequacy decision of the European Commission.

Legal basis: our legitimate interest in showing you how to find us (Art. 6(1)(f) GDPR). More information: OpenStreetMap Foundation Privacy Policy.

9. Fonts and program libraries from external servers

To display our website correctly, some resources are loaded from external servers. In doing so, your IP address and technical browser data are transmitted to the respective provider:

• Google Fonts (fonts “Spectral” and “Nunito Sans”) – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Google Privacy Policy.
• cdnjs (program library for the map) – Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare is certified under the EU-US Data Privacy Framework. Cloudflare Privacy Policy.
• jsDelivr (program code of the spam protection) – Prospect One, Poland (EU). jsDelivr Privacy Policy.

Legal basis: our legitimate interest in a correct, fast and secure presentation of our website (Art. 6(1)(f) GDPR).

10. Translation of our website content (Mistral AI)

We offer our website in several languages. Our texts are translated with the help of the AI service of Mistral AI SAS, 15 rue des Halles, 75001 Paris, France. Only website content is sent for translation – for example our page texts and, where applicable, the text of published reviews (see section 6). Visitor data such as IP addresses, names or email addresses is not transmitted. Processing takes place in the EU.

Legal basis: our legitimate interest in offering our website in several languages (Art. 6(1)(f) GDPR).

11. News from other websites (RSS feeds)

On our “Local News” page we show current headlines from other websites (e.g. local authorities or newspapers). These headlines are retrieved by our server; your browser does not connect to the other websites when you view the page. Only when you click on a headline are you taken to the other website, whose own privacy policy then applies.

12. Links to other websites and social media

Our website contains links to other websites, e.g. to our Facebook page. These are simple links: no data is transferred to Facebook or other providers until you click on them. After clicking, the privacy policy of the respective provider applies. We have no influence on its content or its data practices.

13. Recipients of your data

Your data is only accessible to the members of our team who need it to deal with your request, and to the service providers named in this policy. We do not sell your data and do not pass it on for advertising purposes. We only disclose data to authorities if we are legally obliged to do so.

14. Transfers outside the EU/EEA

Where data is transferred to countries outside the EU/EEA (see sections 8 and 9), this is done on the basis of an adequacy decision of the European Commission (United Kingdom; USA for companies certified under the EU-US Data Privacy Framework) or on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

15. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on our legitimate interests (Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply write to info@centrodelinguas.com. We will reply within one month.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt.

16. Children

Our forms are not intended for children under the age of 13. According to Art. 16 of Portuguese Law No. 58/2019, children under 13 may only give consent with the authorisation of their parents or legal guardians. Enrolments of minors are handled by their parents or legal guardians.

17. Security

Our website is transmitted exclusively via an encrypted connection (HTTPS). We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. However, no transmission over the internet is completely secure.

18. Changes to this Privacy Policy

We update this Privacy Policy when our website or the legal requirements change. The current version is always available on this page; the date at the top shows when it was last updated.

19. Contact

If you have any questions about data protection, please contact us at info@centrodelinguas.com or use our contact form.