Privacy Policy

Last updated: November 5, 2026

This policy explains what personal data we collect through ambs.education and our other contact channels, what we use it for, our legal basis for doing so, who we share it with and how long we keep it.

At a glance

1. Who is responsible for your data

Marlin Capital Partners SL, trading as Aula Magna Business School (AMBS).
Tax ID (NIF): B64937006
Address: C/ Mandri 22, baixos 3, 08022 Barcelona, Spain
Privacy contact: info@ambs.education

2. What we collect, why, on what basis and for how long

2.1. When you ask about one of our programs

When you request information through a form on this site, a lead form in a Facebook or Instagram ad, by email or on WhatsApp, we collect:

• Your contact details: first and last name, email address, phone number and country of residence.
• The details of your request: the program you’re interested in, your language and, on forms that ask, whether you plan to invest in your education and roughly how much.
• Our conversations with you (emails, calls and messages).

What we use it for: to send you information and the program brochure, to get in touch by phone, email or WhatsApp to answer your questions and, if you book one, to set up your free career guidance session.

Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).

How long we keep it: two years from our last contact with you. After that we delete it, unless you’ve enrolled (section 2.3) or agreed to receive updates from us (section 2.4).

2.2. How you used the program page

When you submit the form on one of our program pages, we also record a few details about that visit: how long you spent reading, how far you scrolled, which sections you viewed and which button you last clicked. We use this to give your enquiry a rough interest level (high, medium or low).

What we use it for: to understand what you’re interested in and to prioritize and tailor our reply. It is never used to make automated decisions about you; it simply helps our team plan their follow-up.

Legal basis: our legitimate interest in handling enquiries well (Article 6(1)(f) GDPR). You can object at any time by emailing info@ambs.education.

How long we keep it: the same as your enquiry (two years from our last contact).

2.3. Enrollments, purchases and course access

If you enroll or buy a course, we process your name and contact details, billing details, order details and information about your course access and progress. We never store your card details: payments are handled directly by PayPal or WooPayments (powered by Stripe).

What we use it for: to process your enrollment or purchase, give you access to the course, support you while you study and issue invoices.

Legal basis: performance of our contract with you (Article 6(1)(b) GDPR) and, for invoicing and accounting, compliance with our legal obligations (Article 6(1)(c) GDPR).

How long we keep it: for as long as our relationship lasts, then six years for accounting records and invoices (Article 30 of the Spanish Commercial Code), or longer if another law requires it.

2.4. News and event invitations

If you give us permission, we’ll email you about other AMBS programs and events.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 21 of Spanish Law 34/2002, LSSI-CE). You can withdraw it whenever you like using the unsubscribe link in every email, or by writing to info@ambs.education.

How long we keep it: until you withdraw your consent.

2.5. Measuring our advertising

We advertise our programs on Facebook, Instagram and Google. To see which ads are working:

• If you accept analytics and advertising cookies, we use Google Analytics, Google Ads and the Meta Pixel, as explained in our Cookie Policy.
• When you submit an enquiry form, we let Meta know an enquiry has been made and send your email address and phone number in hashed form (turned into a code that can’t be reversed), so Meta can match it to the ad you saw. If you later move forward in the admissions process, we share that stage too, with the same hashed details.

Legal basis: for cookies, your consent (Article 22(2) LSSI-CE and Article 6(1)(a) GDPR). For sharing enquiries with Meta, our legitimate interest in measuring how our ads perform (Article 6(1)(f) GDPR). You can object at any time by emailing info@ambs.education.

For this data, we and Meta Platforms Ireland Ltd. are joint controllers for collecting it and passing it to Meta. What Meta does with it afterwards is explained in Meta’s Privacy Policy.

How long we keep it: each cookie’s lifetime is listed in the Cookie Policy; Meta keeps the data it receives in line with its own policy.

2.6. Social media

If you follow or message AMBS on social media, we’ll use your profile details and messages to reply to you and manage our presence on that platform. Legal basis: our legitimate interest (Article 6(1)(f) GDPR). Each platform also processes your data under its own terms.

You don’t have to give us any data, but without your contact details we can’t respond to your request. We don’t make any decisions about you based solely on automated processing that have legal or similarly significant effects.

3. Service providers who process data on our behalf

Payments are handled by PayPal and WooPayments (Automattic, powered by Stripe) as independent controllers, under their own privacy policies.

We only share your data with authorities, courts or public bodies when the law requires us to.

4. International transfers

Google LLC and Meta Platforms, Inc. may process data in the United States. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognized in its adequacy decision of July 10, 2023. For more details, email info@ambs.education.

5. Your rights

At any time, you can ask us to:

• Give you access to the data we hold about you.
• Correct anything that’s inaccurate.
• Delete your data.
• Stop using it where we rely on legitimate interests, in particular under sections 2.2 and 2.5.
• Restrict its use, keeping it but not using it while a complaint is resolved.
• Send it to you in a structured format so you can take it to another organization.
• Withdraw your consent, without affecting anything we did before.

Email info@ambs.education and tell us which right you want to exercise. If we need to confirm it’s really you, we’ll only ask for what’s strictly necessary. We’ll reply within one month.

If you’re not happy with our response, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority in the EU country where you live.

6. Children

Our programs are designed for adult professionals. If you’re under 14, please don’t send us your details without your parent’s or guardian’s consent.

7. Security

We use technical and organizational measures appropriate to the risk to protect your data against loss, unauthorized access and alteration.

8. Changes to this policy

If we update this policy, we’ll post the new version here with its date. If a change affects something we do based on your consent, we’ll ask for your consent again.

This policy is also available in Spanish. If the two versions ever differ, the Spanish one prevails.