Who we are

St. Anne’s School is a British school in Madrid, founded in 1969, educating children from one to eighteen years of age. This notice explains how we collect and use personal data, and applies to this website and to the school’s relationship with prospective families, pupils, parents and guardians, staff and visitors.

Data controller
St. Anne’s School
Address: Av. de Alfonso XIII, 162, 28016 Madrid, Spain
Telephone: +34 91 345 90 60
Email: dpo@stannesmadrid.com
Website: stannesmadrid.com

If you need the full registered name and tax identification number (CIF) of the entity that operates the school — to make a formal request or a complaint, for example — please ask for them at dpo@stannesmadrid.com and we will provide them.

Data Protection Officer
Under Spanish law, article 34.1.d) of Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights, schools providing regulated education must appoint a Data Protection Officer. You may contact ours at dpo@stannesmadrid.com.

The law we apply

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, and with Spanish Organic Law 3/2018 of 5 December on Data Protection and the Guarantee of Digital Rights.

Whose data we hold, and what we use it for

Prospective families who contact us
When you complete the information request form on this website, or write to us, or telephone us, we collect your name and surname, your telephone number, your email address, the number of children you are enquiring about, your message and, where you tell us, how you heard about the school. We use this to answer your enquiry, arrange a visit and take you through the admissions process. The legal basis is your consent and the steps taken at your request prior to entering into a contract.

Pupils, parents and guardians
Once a child joins the school we hold identification and contact details for the child and for parents or guardians, academic records and assessment results, attendance records, pastoral and disciplinary records, information needed for school transport, dining and extracurricular activities, and billing and payment details. We use this to provide the education contracted, to look after pupils while they are in our care, and to comply with the obligations that education law places on schools. The legal bases are the performance of the contract, our legal obligations and, where stated, your consent.

Health and other special category data
We hold information about allergies, medical conditions, medication, dietary requirements and any special educational needs, together with emergency contact details, where families provide it. We use it exclusively to protect the health and safety of the child and to give appropriate educational support. The legal bases are explicit consent and, in an emergency, the vital interests of the child.

Images and recordings of pupils
Photographs and video of pupils taken at school events, in class or on trips are used for school communications and, where families have agreed to it, on the website and on the school’s social media channels. This is done on the basis of the specific consent given by parents or guardians, which may be withdrawn at any time by writing to us.

Staff and job applicants
We process the personal data of employees and of candidates for the purposes of recruitment, employment management, payroll, training and compliance with employment, tax and social security obligations, and with the safeguarding checks required of those who work with children.

Visitors to this website
We collect the data described in the cookies section below, together with anything you choose to send us through the forms on the site.

How long we keep it

Enquiry data from families who do not enrol is kept only for as long as the enquiry remains active, and is then deleted. Pupil and family records are kept for the duration of the child’s time at the school and afterwards for the periods that education, tax, accounting and employment law require of us. The periods we apply are these:

• Academic records. The pupil’s academic file and academic history (expediente académico and historial académico), and the evaluation documents that go with them, are kept by the school indefinitely, because education legislation requires them to be preserved and to be available to the pupil and to any school the pupil later moves to.
• Enquiries from families who do not enrol. Kept only while the enquiry is active, and then deleted.
• Enrolment and contractual records. Kept for as long as the child is at the school and afterwards for the periods below that apply to the tax, accounting and legal records they form part of.
• Invoicing and accounting records. Six years from the date of the last entry, as article 30 of the Commercial Code (Código de Comercio) requires.
• Tax records. Four years, the limitation period in article 66 of the General Tax Act (Ley General Tributaria), counted from the end of the period for filing the return concerned.
• Employment, payroll and social security records. Four years, the period in article 21 of the Act on Offences and Penalties in the Social Order (Ley sobre Infracciones y Sanciones en el Orden Social), during which the labour and social security inspectorate may require them.
• Applications from candidates we do not appoint. Kept for the duration of the selection process and then deleted, unless the candidate agrees to our keeping the application on file for future vacancies.
• Photographs, recordings and anything else we use with your consent. Kept until that consent is withdrawn, and removed from our active systems once it is.
• Records that may be needed to defend a legal claim. Once the purpose they were collected for has ended, these are blocked rather than used: kept only at the disposal of the courts, the Spanish Data Protection Agency and the public authorities, as article 32 of Organic Law 3/2018 requires, until the relevant limitation period expires. For ordinary contractual claims that period is five years (article 1964 of the Civil Code).

When a period ends the data is deleted, or anonymised where we wish to keep figures that no longer identify anyone.

Who we share it with

We do not sell personal data and we do not share it for third-party advertising. We do share it where it is necessary, and only to the extent necessary, with:

• the educational authorities of the Comunidad de Madrid and the Spanish Ministry of Education, and the examination boards and bodies that award the qualifications our pupils sit, where the law or the qualification requires it;
• the school management platform used by families and pupils, Alexia;
• the customer relationship platform on which admissions enquiries from this website are received, GoHighLevel;
• the providers who host this website and the school’s email and IT systems, and our banks, insurers, auditors and professional advisers;
• the emergency and health services, where a pupil’s health or safety requires it;
• the courts, the police and public authorities where we are legally obliged to do so.

Every provider who handles personal data on our behalf does so under a written data processing agreement and may use the data only on our instructions.

Transfers outside the European Economic Area

Some of the providers named above are established outside the European Economic Area, in particular the platform that receives admissions enquiries from this website and the analytics and social media tools described in the cookies section. Where data is transferred outside the EEA, it is done on the basis of the European Commission’s standard contractual clauses or another transfer mechanism permitted by the General Data Protection Regulation.

Cookies and third-party services on this website

This website uses cookies and loads content from third parties which may set cookies of their own or receive your IP address. At present these are:

• cookies strictly necessary for the site to work and for the WordPress platform on which it is built;
• Google reCAPTCHA, used to protect the forms against automated abuse;
• Google Fonts, which supplies the typefaces used on the site;
• the GoHighLevel form embedded in the information request pages;
• the Meta pixel, associated with the school’s Facebook and Instagram presence, and content embedded from those networks;
• Gravatar, which supplies profile images.

You can block or delete cookies at any time from your browser settings, though some parts of the site may then not work as intended. If you have any question about the cookies this site uses, write to dpo@stannesmadrid.com.

Children and consent

Under article 7 of Spanish Organic Law 3/2018, a child of fourteen or over may consent to the processing of their own personal data. Below that age, consent must be given by a parent or guardian. Where a pupil’s data is processed on the basis of consent, we obtain it accordingly.

How we protect it

We apply the technical and organisational measures required by the General Data Protection Regulation to keep personal data secure, to restrict access to those who need it in order to do their work, and to keep staff trained in their data protection duties. Where a personal data breach occurs and it is likely to result in a risk to the people affected, we will notify the Spanish Data Protection Agency, and the people affected, within the time limits the law sets.

Your rights

You may ask us at any time for access to your personal data, and for it to be rectified or erased. You may also ask us to restrict how we use it, object to its use, ask for it to be transferred to another controller where that applies, and withdraw any consent you have given, without that affecting what we did with the data before you withdrew it. Where the data belongs to a child, these rights are exercised by the parent or guardian.

To exercise any of them, write to dpo@stannesmadrid.com or to the school’s address above, stating what you are asking for and enclosing a copy of a document that identifies you.

If you believe we have not dealt with your request properly, you may complain to the Spanish Data Protection Agency, Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Changes to this notice

We may update this notice when the way we handle personal data changes, or when the law requires it. The date below tells you when it was last revised.

Last updated: 18 September 2026.