Privacy policy

At Mister Fox Spanish School we respect your privacy. This policy explains, in plain language, what personal data we collect, why we use it and how we protect it when you visit mrfoxspanish.com or purchase our services. It is complemented by our Personal Data Processing Policy (Colombian Law 1581 of 2012).

1. Data controller

The data controller is Mister Fox Group S.A.S. BIC, NIT 901.481.515-2 (Mister Fox Spanish School), with campuses in Pereira (Carrera 11B #1A-40, La Rebeca) and Medellín (Carrera 76 #41-07, Laureles). Contact: [email protected] · WhatsApp +57 302 370 5357.

2. What data we collect

• Identity and contact details: name, ID document, date of birth, nationality, email, phone number. Your record can hold more than one email or phone number: a primary one, which is the one we use to write to you, and secondary ones that only serve to recognise you when you come back (for example, the address you used for the placement test or a number you no longer use).
• Academic data: level, attendance, test results and certificates.
• Visa documents: passport and supporting documents required to issue your acceptance letter, when you request this service.
• Payment data: payments are processed through Wompi; the school does not store card numbers, we only receive the transaction confirmation and the data needed for invoicing.
• Technical signals from forms: when you submit a form on the site (enrollment, booking, purchase, placement test or contact) we store, together with what you typed, the random identifier of your browser (the mf_did cookie), your approximate country, your browser type and an encrypted, irreversible version of your IP address. We never store the IP address in clear text.

3. How we use your data

• To manage your enrollment, classes, attendance and certificates.
• To issue invoices and manage payments and balances.
• To send you service communications (confirmations, class reminders, payment notices).
• To send you marketing communications only with your consent; you can opt out at any time using the unsubscribe link included in every email.
• To recognise you when you come back through another channel (the website, the campus kiosk, the site assistant or the front desk), so that your classes, hours and payments stay on a single record and no duplicate record is opened.
• To prevent fraud and abuse, for example repeated use of free trial classes or of first-enrollment promotions.
• To comply with legal and educational reporting obligations (SIET) and, if you request it, to process your visa acceptance letter.

4. Cookies and analytics

We use technical cookies necessary for the site to work (language, approximate country, security and fraud prevention) and analytics tools (Google Analytics) to measure visits and improve the site. Analytics is on by default (the school's legitimate interest, never for third-party advertising) and no pop-up notice is required. You can turn it off from your browser settings; the details and the full list of cookies with their duration are in the Cookie Policy. We do not use cookies to sell you third-party advertising.

5. Contact details, signals and duplicate records

Several emails or phone numbers. A new contact detail only enters your record when you confirm it (by creating your portal account, by changing the email of that account or by completing a payment), when our team records it with you, when one of your forms brings it together with your ID document, or when we merge two records that were both yours. A form submitted with an email we already know does not change the data already stored; at most it fills in what was missing. You can ask us at any time to correct or remove any of your emails or phone numbers, whether primary or secondary, and to change which one is the primary. Notices, the portal and the kiosk always use the primary contact; a secondary one never receives messages.

Form signals. The technical signals described in section 2 are kept for 180 days and are then deleted automatically. We only use them to prevent fraud and to detect duplicate records, never for advertising or commercial profiling.

Duplicate record detection. When two records share identity data (the same ID document, the same email, the same name and date of birth, or several weaker signals such as a shared phone number or browser), the system flags them as a possible duplicate for our team to review. In doubtful cases we also ask an artificial intelligence system for an opinion; it receives a reduced version of the data: the ID document reaches it masked, and your IP address, your browser and the details of your payments (only counts) are never sent to it. That opinion is only an aid. The decision to merge two records is always made by a member of our team, and none of your data is merged or deleted automatically. When two records are merged we keep the full history (classes, payments, certificates and contact details) in a single one, and you can ask us to review that merge if you believe it was a mistake.

6. Data retention

We keep your data for as long as there is an academic or commercial relationship with you and, afterwards, for the periods required by Colombian accounting, tax and education regulations. Once those periods expire, data is securely deleted or anonymized. Technical signals from forms have their own 180-day period, explained in section 5.

7. Security

We apply reasonable technical and organizational measures to protect your data: role-based access controls, encryption in transit, private document storage and access logging. No system is infallible, but we work to minimize risks.

8. Your rights

You may access, update, correct and delete your data, and withdraw your authorization, by writing to [email protected]. These rights apply to each of the emails and phone numbers on your record, primary or secondary, and to the merging of records described in section 5. The detailed procedure and legal response times are set out in our Personal Data Processing Policy.

Last updated: September 2026.