Nebrija Institutes

Nebrija Institutes Privacy Policy

Users are informed that the personal data they provide, by completing any online form, by email or by any other means, will be processed in accordance with this Privacy Policy.

Who is responsible for the processing of your data?

  • Mailing address: Calle Santa Cruz de Marcenado, no. 29-31, 28015 Madrid.
  • Phone number: 91 452 11 03.
  • Email:

Who is the entity's Data Protection Officer (DPO) and how can they help you?

We inform you that we have a Data Protection Officer (DPO), which is a legally established figure whose main functions are to inform and advise the entity on the obligations that affect it in terms of personal data protection and supervise their compliance. In addition, the DPO acts as a point of contact with the entity for any question related to the processing of personal data, so, if you wish, you can contact him/her:

For what purpose do we process your personal data, what is the legitimizing basis for said processing and for how long will they be kept?

The data provided will be processed with the following purposes, depending on the reason for which they have been submitted:


Resolve queries and questions, as well as process requests for information or any type of request that is made by users through any of the contact forms that are made available to them.


Submission of informative communications by any means. Through these communications, users will be informed about the different services offered by NEBRIJA INSTITUTES, as well as the activities and events organized by them. For these purposes, the data will be processed on the legal basis of the consent of the person who provides them. Said consent can be withdrawn at any time, although this will not affect the legality of the processing carried out previously. Providing the data is voluntary, although, in case of not doing so, they cannot be processed for the indicated purposes. Therefore, the communication of your personal data for these purposes is a necessary requirement so that we can attend to the requests made, as well as to send, where appropriate, the entity's commercial communications. The data will be kept for the time necessary to respond to your request, petition or query, and until we consider it definitively closed. Subsequently, they will be kept as a communication log for a maximum of one year, unless the user requests their deletion, to any of the reference contact addresses. Finally, if the user consents to the sending of commercial communications, the data may be stored indefinitely for this purpose, until the user opposes their sending. The categories of data that will be processed for these purposes will be the following: Identification and contact data.


Process applications for admission to the academic programs of Institutes, and manage any activity and service associated with them (accommodation, events, excursions, activities, etc.). The processing of the data is necessary for the correct registration and participation in the program, so it is mandatory that personal data be provided, as it would be impossible to register as a student of Institutes otherwise.

In this case, the data will be processed on the basis of the contractual relationship maintained between the parties. The data will be kept while you are a student of Institutes and, even after, until the possible responsibilities that may arise from your relationship with the person responsible for the processing expire, and for all the time required by the applicable regulations.

Likewise, unless students express their opposition, their data may be used to send them information, by any means, about the services, activities and events carried out by Nebrija Institutes. The prospective offer of the academic services, activities and events of Nebrija Institutes is based on the satisfaction of the legitimate business interest of being able to offer our students the contracting of other academic activities or services. Said legitimate interest is recognized by the applicable legal regulations, which expressly allow the processing of personal data on that basis for direct marketing purposes. However, students have the right to oppose this processing of their data, being able to do so by any of the means provided in this clause.

For the indicated commercial purpose, your data may be kept indefinitely, unless the student objects to it.


As part of the academic function, Nebrija Institutes may proceed to record the classes, through the entity's teaching tools, in order to offer the possibility of later viewing to guarantee accessibility to the contents by students, and to constitute a study material for the preparation of evaluations, being able to record the students during their possible participation. Interventions in class are considered another part of the teaching activity. The recording will be, where appropriate, available through the tools that the entity makes available to students, whose access will be restricted to the students and teachers of Nebrija Institutes, as well as to the employees of the entity in charge of maintaining the said system. In the aforementioned cases, the provision of data for this purpose is mandatory, and it is impossible for the student to participate in the classes otherwise. It is prohibited for students to record classes for later dissemination or to be used for purposes other than those indicated above.

Likewise, it will be possible to record the evaluations carried out to guarantee the students' attendance and the completion of the test, preventing students from engaging in suspicious behavior during the academic tests.


During participation in the different activities and events carried out by Nebrija Institutes, images/voice of the participants may be recorded (taking pictures and videos). When the processing is part of the educational function, the image/voice of the participant may be captured without their consent, since the legitimizing basis will be the performance of the teaching and educational function, and it is mandatory for the interested party to provide their data for this purpose, otherwise it prevents compliance with the academic-contractual relationship. However, when the capture of the images/voice does not correspond to said educational function, but rather are images of activities or events that are usually recorded for dissemination and promotion purposes on the Nebrija Institutes website, brochures, social networks or any other similar means of communication owned by Nebrija Institutes, we will proceed to obtain the consent of the interested parties. For this purpose, the data may be kept by Nebrija Institutes indefinitely, unless the user objects by contacting any contact address indicated. In the event that the image of the participant is captured in an incidental manner, in accordance with Organic Law 1/82, it will not be considered an illegitimate interference with privacy or with one's image, and may be captured without the need to obtain the express consent of the affected party.

The processing of your image for the indicated purpose of diffusion and promotion is not mandatory, therefore, if the participant does not authorize us, their data may not be processed for this purpose. Consent may be withdrawn at any time, although this will not affect the legality of the data previously processed.

In any case, Nebrija Institutes reserves the right to take photographs and recordings of all the activities and events that it organizes, individually or in collaboration with third parties; therefore, in the case that the interested party wants their image and voice to be captured and used for the purpose described, they must express their consent. When they have not expressed their consent, they must refrain from voluntarily participating in the photographs and recordings that Nebrija Institutes take during them and send an e-mail to in advance, with a written communication expressly reminding them of their wish for their image not be captured, so that Nebrija Institutes can take the appropriate measures to prevent their image and voice from being processed.

How do we treat your process on Social Networks?

If you become a friend or follower of us on social media, we will process your data to keep you informed of our activities and promotions through said channels. These data will be processed on the legal basis of your consent and will be kept as long as you remain a friend or follower of ours, and you may revoke your consent at any time, although this will not affect the legality of the processing carried out previously. Providing the data for this purpose is voluntary, although, if you do not do so, you will not be able to be a friend or follower on social media.

In the cases in which the user registration is done through social networks, the personal data that we will process will come from the social network in question, to which, previously, the interested party will have provided said data for the purposes foreseen in their corresponding privacy policies. The data categories that we will collect from the social network in question are those that appear on our registration form and that you have provided to said social network. If, in order to proceed with the registration on our website, more information than that provided by the social network is necessary, you must additionally complete it in our registration form, subject to the privacy conditions provided in this clause.

To what recipients will your data be communicated?

The data provided may be transferred to the following entities:

  • To the Public Administrations in the cases provided for by Law and for the purposes defined therein.
  • To financial entities for collection management.
  • To the insurance entities with which Institutes have to arrange a Medical Insurance when necessary, or in case it is requested by the student.
  • Transportation companies, or those that organize trips, excursions and activities of any kind in which the student has registered, so that they can properly manage their participation in said activities.
  • To Nebrija University, when students enjoy the facilities or academic services or of any kind offered by the University, as well as when it is necessary to enroll students in the University to take courses that are carried out through Nebrija University for the purposes of credit validation, as this transfer being necessary for the correct development of the services offered by Institutes. If the student expresses their consent, their data may also be transferred to Nebrija University so that it can send commercial communications about the services it offers. The consent may be revoked at any time, although this will not affect the legality of the data previously processed. This last transfer of data to the University is voluntary; if not authorized, the student will not receive commercial communications from this entity. If the student consents, the University may keep their data indefinitely for this commercial purpose, unless the student expresses their wish to delete them.
  • On the other hand, as a consequence of the academic service offered and so that the student can complete their studies, their data may be communicated to companies or organizations with which this center has signed collaboration agreements, with the purpose of developing the Work Center Training (WCT).

What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation about whether or not we are processing personal data that concerns them. Interested persons have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request its deletion when, among other reasons, the data is no longer necessary for the purposes for which they were collected.

Under the conditions provided for in the General Data Protection Regulation, the interested parties may request the limitation of the processing of their data or its portability, in which case we will only keep them for the exercise or defense of claims.

In certain circumstances and for reasons related to their particular situation, the interested parties may oppose the processing of their data. If you have given consent for a specific purpose, you have the right to withdraw it at any time, without affecting the legality of the processing based on the consent prior to its withdrawal. In these cases, we will stop processing the data or, where appropriate, we will stop doing so for that specific purpose, except for compelling legitimate reasons, or the exercise or defense of possible claims.

All the aforementioned rights can be exercised through the means of contact that appear at the beginning of this clause.

Faced with any violation of your rights, especially when you have not obtained satisfaction in their exercise, you can file a claim with the Spanish Agency for Data Protection (contact details accessible at, or any other competent control authority. You can also obtain more information about your rights by contacting those organizations.

What responsibility do you have for your personal data?

Users are responsible for the information provided through this website to be true. For these purposes, they are responsible for the veracity of all the data that they communicate and will keep the information provided conveniently updated, in such a way that it responds to their real situation. Users will be responsible for the false or inaccurate information provided and for the damages that this causes to the owner of this website or to third parties.

What measures are taken in the processing of personal data?

NEBRIJA INSTITUTES undertakes to use the personal data provided in accordance with the purposes indicated in this Privacy Policy, guaranteeing the security and confidentiality of the personal data provided. To this end, it has implemented the security measures of a technical and organizational nature that are necessary to prevent its alteration, loss, processing or unauthorized access, in accordance with the provisions of the applicable regulations.

What responsibility do you have in the processing of third party data?

In the event that the personal data of a third party has been provided, it is the sole responsibility of the person who does so to have previously obtained the consent of that person for their data to be processed by us, having previously informed them of everything provided for in Article 14 of the General Data Protection Regulation.