Sex_School_Web_2

Privacy

Effective Date: 21 February 2026

This Privacy Policy explains how XO.ED Learning S.L. (“we”, “us”, or “our”) collects, uses, and protects personal data when you use sexschoolhubs.com (the “Website” or the “Service”).

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), Spain’s Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD), and other applicable European and Spanish data protection laws.

  1. Data Controller

The controller responsible for processing your personal data is:

XO.ED Learning S.L.
Avd Mare Nostrum
Castellón
Spain
CIF / VAT ID: ESB75739946
Email: [email protected]

  1. Scope of This Policy

This Privacy Policy applies to:

• Visitors to the Website
• Registered users
• Subscribers and purchasers of digital educational content
• Individuals contacting us by email

It does not apply to third-party services accessed via external links, including payment or verification providers, which operate under their own privacy policies.

  1. Personal Data We Collect

3.1 Data You Provide

We may collect:

• Email address
• Account login credentials (passwords are stored in encrypted or hashed form)
• Subscription and purchase status
• Billing-related information (excluding full payment details)
• Communications sent to us

3.2 Data Collected Automatically

When you access the Website, we may collect:

• IP address
• Device and browser information
• Operating system
• Date and time of access
• Referring URLs
• Technical and security logs

This data is processed to ensure platform functionality, maintain security, prevent fraud, and improve service performance.

Legal basis: Article 6(1)(f) GDPR (legitimate interest).

  1. Customer Accounts

If you create a customer account, we process the data required for registration and service access.

If you delete your account, your personal data will be deleted unless retention is required for legal, accounting, or tax obligations (Article 6(1)(c) GDPR).

IP addresses related to account access may be temporarily stored for security and fraud prevention purposes. They are deleted or anonymized within a limited timeframe unless needed for legal claims.

Legal basis: Article 6(1)(b) GDPR (contract performance) and Article 6(1)(f) GDPR (legitimate interest).

We do not use automated decision-making or profiling.

  1. Payments (Epoch)

Payments are processed by Epoch, an independent third-party payment processor.

Epoch processes payment data such as name, card or bank account information, and transaction data necessary to complete the payment.

We do not receive or store:

• Credit card numbers
• CVV/security codes
• Full bank account details

Payment data is processed directly by Epoch under its own privacy policy and security standards.

Legal basis: Article 6(1)(b) GDPR (contract performance).

  1. Contact

If you contact us via [email protected], we process your name, email address, and message content to respond to your inquiry.

Legal basis:
• Article 6(1)(a) GDPR (consent), or
• Article 6(1)(b) GDPR (if related to a contractual matter), or
• Article 6(1)(f) GDPR (legitimate interest in responding to inquiries).

We retain contact communications for up to six months after the last communication unless legal retention obligations apply.

  1. Newsletter

We send newsletters only with your explicit consent.

Legal basis: Article 6(1)(a) GDPR.

Subscription requires your email address. You may optionally provide your name.

We use a double opt-in procedure. Registration and confirmation timestamps, including IP address at sign-up, may be logged to document consent.

You may unsubscribe at any time using the link provided in each newsletter.

To document lawful consent, subscription data may be retained for up to three years.

  1. Cookies

We use cookies to ensure technical functionality and improve user experience.

Cookies may be:

• Session cookies (deleted after browsing session)
• Functional cookies
• Analytical cookies (if applicable, subject to consent where required)

Legal basis:
• Article 6(1)(f) GDPR (legitimate interest for essential cookies)
• Article 6(1)(a) GDPR (consent for non-essential cookies)

You may configure your browser settings to refuse cookies. However, disabling cookies may limit website functionality.

  1. Transfers to Third Countries

Where personal data is transferred outside the EU/EEA (for example, through payment or technical service providers), such transfers occur only:

• For contract performance
• On the basis of consent
• On the basis of legal obligation
• Under appropriate safeguards in accordance with Articles 44–49 GDPR

Such safeguards may include Standard Contractual Clauses approved by the European Commission or transfers to jurisdictions recognized as providing adequate protection.

  1. Data Security

We implement appropriate technical and organizational security measures to protect personal data, including:

• SSL/TLS encryption
• Secure hosting infrastructure
• Access control restrictions
• Monitoring against unauthorized access

Security measures are continuously reviewed and adapted to technological developments.

  1. Your Rights

Under GDPR and LOPDGDD, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time

To exercise your rights, contact:
[email protected]

You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos – AEPD).

Right to Object

If we process your personal data based on legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

If we process your data for direct marketing purposes, you may object at any time, and we will cease processing for such purposes.

  1. Minors

SexSchoolHubs provides sexual education content primarily intended for adults and young adults in accordance with applicable laws.

Where legally required, access may be restricted to adults only.

We do not knowingly collect personal data from minors where prohibited by law.

  1. Changes to This Policy

We may update this Privacy Policy when necessary due to legal, technical, or operational changes.

The updated version will be published on this page with a revised effective date.