Privacy Policy

1. Scope, definitions, and roles

This policy covers the Website, contacts, administration, support, security, and the SaaS. Definitions are interpreted under applicable law.

Epistemic LAS acts as controller for its commercial contacts, account administration, security, support, and own obligations. The Institution is generally controller of educational data and Epistemic LAS its processor; the final role depends on actual decisions and must be reflected in the contract.

2. Data categories and sources

• professional details, institution, role, and request content received from the person or their organization;
• account identity, role, tenant, language, access states, and administrative data supplied by the Institution;
• academic data, instruments, rubrics, assessments, knowledge, competencies, results, and reports submitted or generated under institutional instructions;
• support messages, access logs, technical events, and security signals generated when operating the Service.
• consent preferences, online identifiers, and technical device, browser, URL, referral, and interaction information when the visitor authorizes website measurement.

3. Purposes and legal bases

We process controller data to answer requests and take pre-contractual steps; perform and administer contracts; enable accounts and support; protect systems and prevent abuse based on legitimate interests; comply with legal duties; manage consented communications; and, only with consent, analyze Website use and measure campaigns or conversions. As processor, we process educational data only to provide and protect the Service under documented instructions. Measurement does not send Google the contact-form fields.

4. Educational data and institutional instructions

The Institution determines which groups, instruments, and data are necessary, who has access, and for how long. Epistemic LAS does not reuse educational data for advertising or incompatible independent purposes. An instruction that appears to violate applicable law will be reported to the Institution unless legally prohibited.

5. Required data and consequences of withholding it

Fields will be limited to what each purpose requires. Without contact details we may be unable to respond or contract; without identity, tenant, role, or credentials we cannot enable access; and without educational data defined by the Institution some measurements or reports cannot be generated. Optional data must be identified as such.

6. Recipients, providers, and subprocessors

Data is accessed only by authorized personnel, the relevant Institution, necessary infrastructure, email, support, or operations providers, and authorities where a valid duty applies. Google Ireland Limited receives technical measurement data only for purposes the visitor has consented to through Google Tag Manager, Google Analytics 4 and, once enabled, Google Ads. Subprocessors, locations, services, and the change-notification mechanism must be stated in the agreement or contractual list. We do not sell personal data or disclose it for third-party advertising.

7. International transfers

Before using a provider or enabling an integration outside the European Economic Area, we identify the location and require a valid mechanism, such as an adequacy decision or standard contractual clauses with supplementary measures where needed. Google measurement services may process data outside the EEA under the safeguards described in its data protection terms and privacy policy. This page does not replace the SaaS contractual list of locations and safeguards.

8. Retention and data disposition

We retain controller data for the relationship and the periods needed for requests, security, legal duties, and claims. Google Analytics 4 retains event data for 2 months and user data for 14 months; cookies and preferences follow the periods stated in the Cookie Policy. Institution Data follows the contractual retention schedule, documented instructions, and legal restriction periods. On termination, it is exported, returned, restricted, or deleted under those instruments.

9. Security and incidents

We apply technical and organizational measures proportionate to risk and described in more detail in Data Security. We investigate incidents and assist the Institution with information needed for its obligations. Notices to individuals or authorities depend on role, risk, and legal deadlines; no system eliminates every risk.

10. Cookies, storage, and external links

The Cookie Policy contains the current inventory of cookies, localStorage, and sessionStorage. A third-party link or integration is also governed by the third party’s policy; inclusion does not authorize incompatible data use or automatically add that provider to the Service.

11. Students, minors, and decisions with significant effects

The Institution must have appropriate legal basis, notices, authorizations, and safeguards before submitting student or minor data. The Service provides measurements and evidence; it does not authorize a decision with legal or similarly significant effects to be made solely by automated means. The Institution remains responsible for configuring human review and challenge channels where applicable.

12. Rights and complaints

You may request access, rectification, deletion, objection, restriction, or portability where applicable, withdraw consent without affecting prior processing, and complain to the Spanish Data Protection Agency. Write to info@epistemic-las.com. If the Institution controls your educational data, we will forward the request or identify the responsible channel and assist under the agreement.

13. Changes and contact

We will publish changes with a revised date and communicate those materially affecting an active service through the contractual channel. For privacy, data protection, or the data protection officer when one is appointed: info@epistemic-las.com.