Legal document
Privacy policy
Effective from 26 July 2026. Last updated: 26 July 2026.
At Marc & Structures (www.marcandstructures.com) we process personal data in line with Regulation (EU) 2016/679 (GDPR) and applicable Spanish data-protection law. This notice explains how, in plain language.
1. Data controller
Identity: the Marc & Structures web project, controller for data collected through this site.
Contact for rights and privacy queries: marc@marcandstructures.com.
We do not publish a Data Protection Officer (DPO) contact unless one becomes mandatory or is appointed voluntarily.
2. Purposes, legal bases, and data
We process only the data needed for each purpose. The applicable bases are consent for the newsletter and legitimate interests to protect the site and maintain technical traceability.
| Activity | Typical data | Purpose | Legal bases (indicative) |
|---|---|---|---|
| Newsletter | Email address; preferences if collected | Send content if you subscribe | Explicit consent, which may be withdrawn at any time |
| Course account and learning progress | Email address, completed modules, scores, attempts, and learning events | Authenticate learners, preserve progress, and unlock content based on mastery | Performance of the requested service and consent when creating the account |
| Browsing, security, hosting (e.g. Cloudflare Pages/Workers) | IP address, date/time, browser type, technical logs | Deliver the site, mitigate abuse (DDoS, bots), technical statistics | Legitimate interests and/or technical necessity |
3. Retention
Newsletter data is kept until you withdraw consent. Course progress is kept while the account remains active or until you request deletion. Technical logs are retained for the limited period configured by the infrastructure provider or while needed to investigate an incident.
4. Recipients and processors
To run the site we may use providers that process data on our behalf, including:
- Cloudflare, Inc. (infrastructure, CDN, Workers/Pages): Privacy policy
- Supabase, Inc. (authentication and course-progress database): Privacy policy
- Resend (email delivery): Privacy
We do not sell your personal data. We may disclose information if required by law or to defend legal rights before authorities or courts.
5. International transfers
Some providers may process data outside the European Economic Area (e.g. the United States). Where required, we rely on GDPR safeguards (e.g. EU Commission Standard Contractual Clauses or other recognised mechanisms). You may request more detail at marc@marcandstructures.com.
6. Your rights
You may exercise access, rectification, erasure, restriction, objection, and where applicable data portability, and withdraw consent at any time, by emailing marc@marcandstructures.com. We may ask for reasonable identity verification. You may also lodge a complaint with a supervisory authority; in Spain, the Agencia Española de Protección de Datos (AEPD): www.aepd.es.
Instructions to request data deletion for forms and newsletters: Data deletion instructions. Spanish version: Instrucciones de borrado de datos.
7. Children
The site is not directed at children under 14 (or the age required in your jurisdiction). If you are a parent or guardian and believe we collected a child’s data, contact us for deletion.
8. Cookies and local storage
This version of the site does not load advertising or behavioural analytics tools or set non-essential cookies from the website code. The course may save progress in your browser’s local storage; that information remains on your device and can be removed through your browser settings.
Infrastructure providers may process technical data that is strictly necessary to deliver and protect the service. If non-essential tools are added later, this policy will be updated and prior consent will be requested where required.
9. Automated decisions
No decisions with legal or similarly significant effects are made solely through automated processing. The course tutor uses locally prepared responses and does not send questions to an external service.
10. Security
We apply reasonable technical and organisational measures (e.g. encrypted connections where supported, access controls, API keys via server-side proxies). No system is perfectly secure; report suspected incidents to the contact address.
11. Changes
We will post updates on this page and adjust the “effective from” date. Please review periodically.
12. Informational text
This document is not a substitute for legal advice. If processing is expanded—for example through advertising, profiling or non-essential analytics—the policy and, where required, consent mechanisms will be updated.
Website terms of use · Data deletion · marc@marcandstructures.com