Trivellini Academy

Privacy policy

Last updated: 2026-10-15.

1. Data controller

Trivellini Hair Group SLP, Av. de la Aurora 69, Málaga. [email protected]. https://trivellini.learnsuite.pro

2. Data processor

Codelabs Studio, S.L. (Tax ID B88708797), Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre, Málaga, España. Registro Mercantil de Málaga, hoja MA-198508, inscripción 1ª. [email protected]. https://learnsuite.pro. Codelabs Studio, S.L. processes data on behalf of the controller under an article 28 GDPR agreement (see the Data processing agreement).

3. What we process and why

  • Account: name, email, password (encrypted at the identity provider), language. Purpose: providing the service. Basis: contract.
  • Progress and assessment: lessons watched, quiz answers, certificates issued. Basis: contract.
  • Purchase and territorial licence: IP country and VPN/proxy signals, card and billing country, verified phone prefix, device identifier and time zone, playback sessions. Purpose: setting your zone price, enforcing the territorial licence, preventing fraud and resale. Basis: contract and legitimate interest in protecting the content. Kept for the life of the licence plus twelve months.
  • Phone: number verified by SMS, for travel passes and account protection. Basis: contract.
  • Identity verification (only for courses that require it): document and selfie processed by Stripe Identity; we keep only the result and the verified name. Basis: contract and legal obligation where applicable.
  • Conversational tutor: your questions and its answers, to provide the service and improve the syllabus. Basis: contract. Never used to train third-party models.
  • Recorded 1:1 sessions: only if the learner and the instructor both accept it in the room; the date of each consent and the version of the accepted text are recorded. The recording is stored in the European Union (Cloudflare R2) and transcribed on our own servers. If the academy switches it on, a Google language model (Gemini) prepares a summary. With the instructor's approval, a few general teaching points without personal data may be added to the tutor of the academy's learners; never the recording, the transcript or the summary. Only the learner and the academy can see the recording, the transcript and the summary. Either of them can revoke consent at any time and erase, from their own area, the recording, the transcript, the summary and those tutor points. Basis: consent (Article 6(1)(a) GDPR). Kept until either of them revokes it.
  • Watermark: your name and part of your email are shown over the video during playback. Basis: legitimate interest in protecting the content.
  • Communications: transactional emails (verification, invoices, confirmations). Basis: contract.
  • Instructor voice and likeness (biometric data): we clone the instructor's voice, as part of the work we do for their academy, for a single purpose: dubbing their own courses into other languages with the mouth synced over their original video. Legal basis: their explicit written consent (Articles 6(1)(a) and 9(2)(a) GDPR), documented in writing. It is not used for any other purpose, sold or shared. The voice provider (ElevenLabs, Inc., United States) acts as a sub-processor under standard contractual clauses. To synchronise the lips, KIE (Singapore) and Volcengine (China) receive the video of the instructor's face and the audio dubbed in their voice, also as sub-processors under standard contractual clauses (Article 46(2)(c) GDPR). The instructor can withdraw consent at any time, as easily as it was given, by writing to [email protected]; on withdrawal their voice stops being used and the voice model is destroyed, without affecting earlier processing.

4. Retention

For as long as the account exists and afterwards as long as legal obligations require (five years for invoicing data). You can request account deletion; we erase data at the identity provider, the video storage and the tutor indexes. The instructor's voice model is kept only while their consent and their relationship with the academy last, and is destroyed on withdrawal or when the service ends.

5. Recipients and transfers

The providers listed on the Sub-processors page, under processing agreements and, outside the EEA, the European Commission's standard contractual clauses. Data is hosted in the European Union (Germany).

6. Your rights

Access, rectification, erasure, objection, restriction, portability and not being subject to automated decisions. Write to [email protected]. You may also complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.

7. Automated decisions

The price zone and the territorial licence are decided automatically from the signals in section 3. If the outcome looks wrong, ask for human review at [email protected]: an order marked "under review" is decided by a person.

8. Country annexes

  • Brazil (LGPD): legal bases equivalent to GDPR; the controller above answers as data controller; rights before the ANPD.
  • United States (CCPA/CPRA, California): we do not sell or share personal data for advertising; rights of access, deletion and correction through the same channel.
  • India (DPDP Act 2023): verifiable consent for the stated purposes; rights of correction, erasure and complaint before the Data Protection Board.
  • United Kingdom (UK GDPR): same rights; transfers under the IDTA or the UK addendum to the standard clauses.
  • Argentina (Law 25.326), Mexico (LFPDPPP), Paraguay (Law 6534/2020) and the rest of Latin America: ARCO rights through the same channel; the controller is the one in section 1.
Trivellini Academy