Privacy policy
Version 1.3 · Last updated: 14 October 2026
This policy explains how CESGEN processes the personal data of people who visit campus.cesgen.com, register, enrol in or buy courses, or contact us, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD). It applies to everyone who uses the campus, wherever they live.
1. Data controller
Centro de Estudios en Genómica y Nutrición SLU (CESGEN), tax ID (NIF) B25759184.
Address: Parque Científico y Tecnológico Agroalimentario de Lleida, Turó de Gardeny, 25003 Lleida (Spain).
Contact for data protection matters: contacto@cesgen.com or the contact form.
CESGEN has not appointed a data protection officer because, given the type and volume of its processing, it is not required to do so (Article 37 GDPR and Article 34 LOPDGDD).
2. What data we process, why, on what legal basis and for how long
2.1. Contact form
| Data | Name, email address and the message written. To prevent mass submissions, the server keeps for one hour an encrypted value (hash) derived from the IP address, which cannot be used to identify it. |
| Purpose | To reply to the enquiry and, if it concerns a course or an order, to deal with that request. |
| Legal basis | The consent given by ticking the box on the form (Article 6(1)(a) GDPR) and, where the enquiry relates to a contract or its preparation, taking steps before entering into a contract or performing the contract (Article 6(1)(b) GDPR). |
| Retention | The message is not stored on the website: it is delivered by email to CESGEN’s mailbox. It is kept while the enquiry is dealt with and for up to 12 months afterwards, unless it leads to a complaint or a contract, in which case it is kept with the records of that matter. |
2.2. Course opening alerts
| Data | Name, email address, the course of interest (or “any course”), the language of the website at the time of signing up, and the date and version of the consent. Kit, the service used to send the alerts, also records the confirmation of the address and, as is usual with these services, the delivery and opening of the emails and clicks on their links. |
| Purpose | To let you know by email when enrolment opens for the courses you chose. It is not used for any other purpose and is not shared with third parties. |
| How it works | When you send the form, the campus adds your address to Kit, which sends an email asking you to confirm it. No alert is sent until the address is confirmed. Every alert includes a link to unsubscribe. If Kit is unavailable at that moment, the campus keeps the sign-up and tries again for one day; once Kit has received it, the campus deletes its copy. |
| Legal basis | Consent (Article 6(1)(a) GDPR and Article 21 LSSI). You may withdraw it at any time using the unsubscribe link in any email or by writing to us, without affecting the lawfulness of the processing carried out before. |
| Retention | Until consent is withdrawn or, at most, 24 months from signing up or from the last alert sent. It is then deleted. The date, version and confirmation of the consent may be kept, blocked, for as long as needed to prove that it was obtained. |
2.3. Student account and courses
| Data | Username, first name and surname, email address and password (stored encrypted, never in plain text); the language of the account; the courses you are enrolled in and the start and end dates of access; progress, completed lessons, quiz answers and marks, and certificates (which bear the student’s name); and the messages, questions in lesson discussions and reviews that the student chooses to post. |
| Purpose | To create and manage the account, provide the courses during the access period, send the account and course emails in the student’s language, issue certificates and deal with the student’s enquiries. |
| Legal basis | Performance of the contract (Article 6(1)(b) GDPR), including for free courses. |
| Who can see it | Questions in discussions and reviews are visible, with the name shown on the profile, to the other students on the course and to the instructor; reviews may be shown on the course’s public page. Private messages are only seen by the student and the instructor. For this reason, we recommend not including personal data in discussions or reviews, and never health or genetic data. |
| Retention | While the account is active. If the student asks to close the account, the account and the course data are deleted, except for anything that must be kept by law (section 2.4). Accounts with no activity for 3 years and no course with current access will be deleted after notice by email. |
2.4. Purchases, payments and invoicing
| Data | Billing details (first name and surname or company name, address, state, province or region, postcode, country, email address, telephone number if provided and, where applicable, tax ID, EU VAT number or UK VAT number); courses bought, amounts, taxes, date and the language of the website where the order was placed; the payment method used (card), without the card number, which CESGEN does not receive; the result of the check of the EU VAT number in VIES or of the UK VAT number; and, as proof of consent to immediate access to the courses (Article 103(m) of the Spanish consolidated text of the General Law for the Protection of Consumers and Users, TRLGDCU), the date and time, the IP address and the text accepted at checkout. |
| Purpose | To process the order and the payment, enrol the student, issue and send the invoice, apply taxes correctly according to the country and to whether the customer is a consumer or a business, handle refunds and withdrawals, keep the accounts and prevent payment fraud. |
| Legal basis | Performance of the contract (Article 6(1)(b) GDPR); compliance with legal obligations on tax, accounting and consumer protection (Article 6(1)(c) GDPR: VAT and invoicing rules, the Spanish Commercial Code and the TRLGDCU); and the legitimate interest in preventing fraud and in being able to defend against claims (Article 6(1)(f) GDPR). |
| Retention | Billing and accounting data, 6 years from the end of the financial year (Article 30 of the Spanish Commercial Code), which also covers the tax limitation period. The proof of consent to immediate access, the same period as the invoice. |
2.5. Withdrawal requests
| Data | Name, email address, order number, course, date and time of the request and the content of the statement. |
| Purpose | To process the withdrawal, send the acknowledgement of receipt and, where applicable, the refund. |
| Legal basis | Compliance with a legal obligation (Article 6(1)(c) GDPR, in connection with Articles 102 to 108 TRLGDCU). |
| Retention | Together with the order records (section 2.4). |
Record of first access to paid courses. So that we can show whether the right of withdrawal has been lost (section 11 of the terms of sale), we record the first time the buyer opens the content of each paid course.
| Data | Date and time of first access, the lesson, quiz or assignment opened and the IP address, stored with the order. Only the first access to each course is stored, not later activity. |
| Purpose | To show whether the buyer has accessed the course content and, therefore, whether withdrawal applies. |
| Legal basis | CESGEN’s legitimate interest in being able to show that the contract has been performed and to defend itself against any claims (Article 6(1)(f) GDPR). |
| Retention | Together with the order records (section 2.4). |
2.6. Security and technical operation
| Data | IP address, browser, operating system, pages requested, date and time, which the server records automatically; and, when accounts are registered, a temporary count of the number of sign-ups from the same IP address to stop automated registrations. |
| Purpose | To keep the campus secure and working, detect abuse and resolve incidents. |
| Legal basis | CESGEN’s legitimate interest in the security of its systems (Article 6(1)(f) GDPR). |
| Retention | Server logs, for the limited time the hosting provider keeps them for the security of the service; sign-up checks, 24 hours at most. |
2.7. What we do not do
The campus has no newsletter and does not send commercial communications, except for the opening alert that you expressly request (section 2.2). Emails about your account, orders and courses are service communications.
The campus does not use analytics or advertising tools, does not load fonts or other resources from external services, and has switched off the sending of plugin usage data to their makers.
CESGEN does not sell personal data, does not use it to build profiles and does not take automated decisions with legal or similarly significant effects on people.
3. Source of the data and mandatory data
The data are provided by the person concerned, except the result of the VAT number check, which comes from VIES (European Commission and EU tax authorities) or from HMRC via VAT Sense. The fields marked as mandatory on each form are needed for the stated purpose: without them we cannot reply, create the account or process the purchase.
The campus is intended for adults. You must be at least 18 years old to create an account, enrol in a course (including free courses) or buy one.
4. Recipients and processors
CESGEN does not share data with third parties, except where required by law (for example, with the Spanish Tax Agency or with judges and courts). To provide the service, it uses the following providers, which process data on CESGEN’s behalf and on its instructions (processors, Article 28 GDPR) or, where stated, as independent controllers:
| Provider | Service | Location and safeguards |
|---|---|---|
| Webempresa Europa, S.L. | Hosting of the website and its database, the website’s outgoing mail server and CESGEN’s mailbox | Spain (EU) |
| Kit (formerly ConvertKit) | Sending the course opening alerts: address confirmation, alerts and unsubscriptions | United States. Transfer with the safeguards of its data processing agreement (section 5) |
| Stripe Payments Europe, Limited | Processing payments by card. Stripe acts as an independent controller for its own processing for fraud prevention and compliance with its legal obligations | Ireland (EU). It may transfer data to Stripe, Inc. (United States) with the safeguards in section 5 |
| Holded Technologies, S.L. | Invoicing and accounting software: receives the billing and order data to issue the invoice and sends it by email | Spain (EU) |
| BunnyWay d.o.o. (Bunny.net) | Hosting and playback of the course videos; receives the IP address of whoever plays a video | Slovenia (EU) |
| weio Ltd (VAT Sense) | For UK businesses only: checking with HMRC the UK VAT number entered at checkout | United Kingdom, a country with an adequacy decision of the European Commission |
| Anthropic | Artificial intelligence assistant (Claude) that CESGEN uses to manage the campus and that may access user and order data in the admin area | United States. Transfer with the safeguards of its data processing agreement (section 5) |
EU VAT numbers of businesses are checked with the European Commission’s official VIES service, which queries the tax authority of the country concerned.
5. International transfers
Some providers may process data outside the European Economic Area. In those cases, the transfer is based on an adequacy decision of the European Commission (such as the one for the United Kingdom, or the EU-US Data Privacy Framework for companies that have signed up to it) or on the standard contractual clauses approved by the Commission and included in the contract with the provider. You can ask us for information about these safeguards.
6. Your rights
Anyone, wherever they live, may exercise before CESGEN their rights of access, rectification, erasure, objection, restriction of processing and portability, and may withdraw consent at any time, without affecting the lawfulness of the processing carried out before. To do so, write to contacto@cesgen.com, use the contact form or send a letter to the address given in section 1. If we have reasonable doubts about the identity of the person making the request, we may ask for additional information to confirm it. We will reply within one month, which may be extended in the cases provided for in the GDPR.
If you consider that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, Spain; www.aepd.es) or with the supervisory authority of the EU country where you live. If you live outside the European Union, you may also contact the data protection authority of your country. Before doing so, you may tell us, in case we can resolve it.
7. Security
CESGEN applies technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), passwords stored encrypted, restricted access to the admin area and backups. Payment card data do not pass through CESGEN’s servers: they are handled by Stripe.
8. Genetic and health data
The courses deal with genetic and health data, but the campus does not ask students for their own genetic or health data. Please do not send such data through the forms, the course discussions or messages. If anyone sends them, CESGEN will not use them and will delete them.
9. Changes to this policy
CESGEN may update this policy to reflect changes to the campus or to the law. The version in force is the one published on this page, with its date. If a change significantly affects processing based on consent, the people concerned will be informed.