Privacy policy
This is a translation for information only. The Spanish version is the legally binding one: Spanish version.
Last updated: 26/10/2026.
Summary
- The course and the exam do not ask for any personal data or sign-up.
- Only if you pass and order the certificate do we ask for your name, your document number and, if you wish, your employer, to issue it and so that it can be verified.
- We do not keep your full document number: only the part shown on the verification page (for example, ***4567**) and an encrypted fingerprint that lets us check that it matches if you type it again.
- To the email address you give when paying, we send the link to your certificate and the link to your invoice, and the new links if you use «Recover your certificate». We do not keep the address: only an encrypted fingerprint, so that you can recover your certificate. If the daily sending limit is reached, the email waits in a queue until it can be sent (2 days at most) and is deleted once sent.
- We do not use cookies or tracking tools.
Data controller
Nuvola Studio SL, tax ID (CIF) B70955885, Paseo Zorrilla 22, 2.º A, 47006 Valladolid. Email: delantal@nuvolastudiogroup.com.
What data we process and what for
| Data | What for | Legal basis | How long |
|---|---|---|---|
| Full name; type of document, visible part of the document number and its encrypted fingerprint; employer (optional); exam mark. | To issue your certificate and allow anyone with the code to verify it. | Performance of the contract you enter into with us when you order the certificate (Article 6(1)(b) of the General Data Protection Regulation). | 5 years from issue (see «Why 5 years», below), unless you ask us to delete it earlier. |
| The same data from an order that is never paid. | To complete the payment. | Pre-contractual steps at your request (Article 6(1)(b)). | Deleted automatically after 2 days. |
| Date and time when you accept the conditions and the loss of the right of withdrawal. | To be able to prove that you gave that consent. | Legitimate interest in being able to prove that you gave that consent, as consumer law requires (Article 6(1)(f)). | The same as the order. |
| Encrypted fingerprint of the email address you enter on the Stripe payment page (we do not keep the email address in plain text). | So that you can recover your certificate if you lose the link, on «Recover your certificate», by entering that email address and your document number: we send the new links to that email address. | Performance of the contract (Article 6(1)(b)). | The same as the certificate. |
| Payment data. | To charge for the certificate. | Performance of the contract. | Processed by Stripe as an independent controller (see below). We do not see or keep your card details. Billing data is kept for as long as tax law requires. |
Exam answers are not stored: only the mark of the passed exam, which appears on the certificate. To mark each attempt, we keep for 2 days which questions you were given, without any of your personal data.
Why 5 years
We keep the certificate data so that your employer, or an inspection, can verify it while you use it as proof of your training. This training is usually renewed after about 4 years, and 5 years covers that period with a margin. After that time, we delete the data and the code can no longer be verified.
You can ask us to delete it earlier at any time: write to delantal@nuvolastudiogroup.com with your certificate code (for example, DL-ABCD-2345) and we will delete it within one month at most. From then on the certificate can no longer be verified, even if you keep the PDF.
If your employer pays for your certificate
If you take the course with your employer's invitation link, your employer will see in its company dashboard your full name, the type of document and its visible part, your mark, the date and your certificate code, and will be able to download a copy of your certificate with the document number partly hidden. That is why you use its link: if you do not want your employer to see this, take the course on your own. About the business, we keep its company name, the places bought, the Stripe invoice and the email address it paid with (to send it the link to its company dashboard and to be able to recover it), for 5 years.
What is shown on the public verification page
Anyone who has your certificate code (for example, your employer, when scanning the QR code) can see your full name, the type of document and its visible part, the course, your mark and the date. The document number is hidden following the criteria of the Spanish Data Protection Agency (AEPD): for a DNI, only four digits in the middle are shown. Your employer does not appear on the verification page.
Who else processes your data
- Cloudflare (Cloudflare, Inc., United States) hosts the website and the database, as a data processor: it only processes the data following our instructions. The database is set up to store the data in the European Union.
- Brevo (Sendinblue SAS, France) sends, as a data processor, the email with the link to your certificate or your company dashboard and to your invoice.
- Stripe (Stripe Payments Europe, Ltd., Ireland) processes the payment by card, Google Pay or Apple Pay, collects the email address and issues the invoice. For payment data it is an independent controller: it processes the data under its own privacy policy, among other things to meet its legal obligations and to prevent fraud.
We do not sell or pass on your data to anyone else, unless required by law.
Transfers outside the European Union
Cloudflare and Stripe belong to groups based in the United States, and some data may be processed there (for example, for support or for the security of their service). These transfers are based on the EU-US Data Privacy Framework and, failing that, on the standard contractual clauses approved by the European Commission, which form part of their data processing agreements (Articles 45 and 46 of the General Data Protection Regulation). You can ask us for more information at delantal@nuvolastudiogroup.com.
What is stored in your browser
While you take the exam and download the certificate, the website stores in the memory of that tab (not in cookies) your answers, the result and the document number you have entered, so that it can generate the PDF. It is deleted when you close the tab.
Your rights
You can ask for access to your data, its rectification or erasure, object to its processing, or ask for its restriction or portability by writing to delantal@nuvolastudiogroup.com and stating your certificate code. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD).