Privacy policy

Controller

ANDAMAS CONSULTANCY S.L.

Privacy contact

privacy@andamas.agency

Country

Spain

• Account data such as email address, display name, account identifier and email-verification state.
• Authentication data needed to keep sessions secure. Passwords are stored only as cryptographic hashes, not in readable form.
• Learning data such as Path enrolments, completed steps, progress, Advanced access, Final Lab attempts and Achievement records.
• Support messages, transactional email delivery data and limited technical or security information needed to operate and protect the service.

Account creation, authentication, progress storage and delivery of the Lab experience are processed because they are necessary to provide the service you request. Security, fraud prevention, abuse prevention and service integrity may be processed on the basis of our legitimate interests. Records may also be processed where required by law.

Marketing or newsletter messages are separate from the Lab account. If we offer them, they will use their own opt-in and can be withdrawn independently.

ANDAMAS Lab currently supports email/password sign-in and one-time sign-in links sent through our transactional email infrastructure. Email verification is used when a new account is created.

The Lab uses specialist infrastructure and service providers where necessary, including hosting or infrastructure providers and transactional email providers.

Where a provider processes personal data outside the European Economic Area, the relevant transfer must rely on an applicable adequacy decision or other appropriate safeguards required by data-protection law.

Account and progress data is kept while the account is active and for as long as reasonably necessary to provide the service. Authentication challenges and short-lived verification records expire according to their security purpose. Support and security records are retained only for an appropriate operational period or where required for legal claims or compliance.

Depending on the circumstances, you may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent where consent is the legal basis. Contact privacy@andamas.agency to exercise a right or ask a privacy question.

You may also lodge a complaint with the Agencia Española de Protección de Datos (AEPD) or, where applicable, another competent supervisory authority in the EU/EEA.

ANDAMAS Lab is designed for independent use by adults and working-age learners. We do not knowingly design the service to profile children or use children's data for advertising.

We use access controls, secure session cookies, password hashing, rate limiting and infrastructure isolation appropriate to the service. No internet service can guarantee absolute security, but authentication secrets are kept outside the public application code and are not intentionally exposed to browsers.