Legal

Privacy Policy

How we process your personal data under EU GDPR.

Last updated: 2026-05-25

Draft pending counsel review. Wording will be ratified before launch. Substance is RGPD-compliant.

1. Controller

The controller of the personal data processed via this website is APEX Basketball Performance (the “Academy”), registered at Agora Barcelona International School, Sant Esteve Sesrovires, Barcelona, ES. Contact: info@apexbasketballbarcelona.com. CIF / NIF: TBD, pending client confirmation.

2. Data we process

  • Inquiry form fields: first name, last name, email, phone, country of residence, player age, source attribution, message body.
  • Technical metadata: SHA-256-hashed IP address (used solely for rate-limiting), timestamp of submission, user-agent string (server log only).
  • Analytics (with consent): Google Analytics 4 sets identifiers and collects page-views, event interactions (CTA clicks, FAQ opens, PDF downloads, outbound clicks), device/browser/locale. IP addresses are anonymised by GA4 server-side.
  • Bot challenge: Cloudflare Turnstile may set a short-lived token cookie and exchange a challenge response with Cloudflare to verify you are not a bot.

3. Legal basis (RGPD Art. 6)

  • Consent (Art. 6.1.a): analytics cookies, marketing-pixel-equivalent identifiers. You can grant or withdraw consent at any time via the cookie banner.
  • Pre-contractual measures (Art. 6.1.b): processing of the inquiry form, necessary to respond to your admissions request.
  • Legitimate interest (Art. 6.1.f): abuse prevention (rate-limit hash, captcha verification, server logs).

4. Retention

Inquiry form submissions are retained for up to 24 months for follow-up correspondence and admissions-pipeline review, then deleted from the admissions inbox. Rate-limit hash files are auto-purged after 60 minutes. Analytics data follows the GA4 retention setting selected by the Academy (default: 14 months). Cookie consent state is stored in your browser localStorage until you clear it.

5. Recipients and transfers

Personal data is shared with the following processors strictly to deliver the service:

  • Google LLC (Google Analytics 4 + Google Fonts): analytics and font delivery. Transfer to the United States under the EU-U.S. Data Privacy Framework.
  • Cloudflare, Inc. (Turnstile bot challenge): challenge verification. Cloudflare is DPF-certified.
  • Namecheap (Private Email + hosting): email delivery of your inquiry and EU-region server logs.

No data is sold or shared with third parties for advertising.

6. Your rights (RGPD Art. 15–22)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time. Email info@apexbasketballbarcelona.com and we will respond within 30 days.

7. Right to lodge a complaint

You may lodge a complaint with the Spanish Data Protection Authority, the Agencia Española de Protección de Datos (www.aepd.es).

8. DPO contact

Data Protection contact: info@apexbasketballbarcelona.com. A formal DPO is appointed when statutory thresholds are met; this contact is monitored regardless.

9. Updates

We may update this policy. Material changes are announced on this page and dated above.

Apply for 2026–27