EN
Español English

Privacy Policy

Last updated: October 2026

This policy explains which personal data we process when you use auditena.com, for what purpose, on which legal basis, for how long, and which rights you have under the EU General Data Protection Regulation (GDPR) and applicable German law.

1. Controller

Erick Oziel Hernández Díaz
Lichtburgring 18, 13355 Berlin, Germany
Email: info@auditena.com

Auditena is my freelance teaching activity. More details in the legal notice.

2. Visiting the website

Whenever you open a page, the server automatically logs technical data: your IP address, the date and time, the requested page, the result of the request and, if you are signed in, your account's identifier. We use it to run the site, find errors and protect it from abuse (legal basis: Art. 6(1)(f) GDPR, legitimate interest in a secure and stable service). Logs are rotated daily and deleted automatically after 30 days.

The site's fonts are served from our own server; visiting the pages loads no resources from Google or other third parties.

3. Cookies

We only use technically necessary cookies, which require no consent (§ 25(2) TDDDG):

  • lang: remembers your language (Spanish or English). Lifetime: one year.
  • session: keeps you signed in and protects forms against attacks (CSRF). Deleted when you close the browser.
  • remember_token: only if you tick "Remember me" when signing in; keeps you signed in. Lifetime: 30 days.

We use no analytics, advertising or tracking cookies.

4. User account

To create an account we process your name, your email address, your password (stored only as a hashed value, never in readable form), the language you registered in, when you accepted the Terms of Service and which version, and when you confirmed your email.

  • Email confirmation: when you register, we send you a link to confirm your address.
  • Manual review: we review each registration before activating it; for this we see your name and email.
  • Access to content: we store which courses and resources you have access to, to show them in your library.
  • Service emails: we write to you when your account is approved, when you request a password reset and when your password changes.

Legal basis: Art. 6(1)(b) GDPR (user contract and pre-contractual steps). Without this data we cannot create the account.

Retention: for as long as your account exists. You can ask us to delete it at any time. Unconfirmed registrations are deleted periodically.

5. Contact form and email

If you write to us, we process your name, email and message to reply. The message is stored on the site and forwarded to us by email. Legal basis: Art. 6(1)(b) GDPR if your enquiry concerns a course or service; otherwise Art. 6(1)(f) GDPR (legitimate interest in replying). We delete messages when they are no longer needed and at the latest 12 months after the enquiry is closed.

6. Newsletter

If you subscribe, we first email you to confirm the subscription (double opt-in); you only receive the newsletter after confirming. We process your email address and chosen language and store the subscription and confirmation dates as proof of your consent. Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time by writing to us or with the link in every issue. We keep your data until you withdraw consent.

7. YouTube and Vimeo videos

Course pages may include videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, USA). Videos do not load automatically: only when you click "Load video" does your browser connect to the provider, which receives data such as your IP address and may use cookies. For YouTube we use the privacy-enhanced mode (youtube-nocookie.com). Legal basis: your consent by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For details, see the privacy policies of Google and Vimeo.

8. Online classes and recordings

Live course sessions are held by video conference using Microsoft Teams (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) or Zoom (Zoom Communications, Inc., 55 Almaden Boulevard, San Jose, CA 95113, USA), depending on the course; the platform is stated in each course's invitation or confirmation. Both act as processors (Art. 28 GDPR).

When you take part, the name you display, your email address (for the invitation), technical connection data (such as IP address and device) and, if you turn them on, your image, your voice, chat messages and anything you share on screen are processed. You can take part with a first name only and without camera or microphone, asking your questions in the chat. Legal basis: Art. 6(1)(b) GDPR (delivering the booked course).

Recordings: sessions are recorded so course participants can watch them again; we announce this when you book the course and at the start of each session, and the platform shows it while recording. A recording includes my screen and my voice and, if you turn them on while recording, your image, your voice and visible chat messages. Your appearance in the recording is based on your consent (Art. 6(1)(a) GDPR), which you express by turning on your camera or microphone after the notice; you can avoid it by keeping them off. Recordings are only available to the participants of that course, in the members' area (hosted on Vimeo, see section 7), for the period stated when booking the course, and are then deleted. We do not use recordings showing participants for any other purpose; if we publish course content elsewhere, we only use material in which only the instructor appears.

Where data is processed outside the European Economic Area (in particular by Zoom in the USA), the transfer is based on the EU-U.S. Data Privacy Framework or on standard contractual clauses (see section 9). Microsoft processes EU customer data within the EU (EU Data Boundary).

9. Service providers

We do not sell your data. To run the site we work with:

  • Namecheap, Inc. (4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA): web hosting, database and email server, as a processor (Art. 28 GDPR).
  • Microsoft (Teams) or Zoom: video conferencing for live classes (see section 8).
  • Vimeo: hosting of course recordings (see sections 7 and 8).
  • Stripe: processing of course payments (see section 10).
  • YouTube and Vimeo: only if you load a video (see section 7).

Where data is processed outside the European Economic Area, in particular in the USA, the transfer is based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework), where the provider is certified, or on EU standard contractual clauses (Art. 46 GDPR).

10. Course purchases

If you book a course, we process the data needed for the contract and invoicing (Art. 6(1)(b) GDPR): your name, email address, billing address and, if you book for a company, its name and tax number, plus the course booked, the amount, the date and your acceptance of the Course booking conditions.

Payments with Stripe: payments are processed by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland), on a Stripe payment page. You enter your card, PayPal, Apple Pay or Google Pay details directly with Stripe; we never see or store your full card details, only, for example, the card brand and last four digits. Stripe processes payment data to carry out the transaction and, as an independent controller, to prevent fraud and meet its legal obligations. See Stripe's privacy policy. If you choose PayPal, PayPal's privacy policy also applies.

Invoices and accounting records are kept for the statutory retention periods (up to 10 years, § 147 AO, § 257 HGB; Art. 6(1)(c) GDPR).

11. Your rights

You have the right to:

  • access your data (Art. 15 GDPR);
  • have it corrected (Art. 16 GDPR);
  • have it erased (Art. 17 GDPR);
  • restrict its processing (Art. 18 GDPR);
  • data portability (Art. 20 GDPR);
  • object to processing based on legitimate interest (Art. 21 GDPR);
  • withdraw consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3) GDPR).

To exercise them, email info@auditena.com. You can also lodge a complaint with a supervisory authority, for example the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany.

12. Security

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), passwords stored only in hashed form, confirmation and reset links that expire, and restricted access to administration.

13. Children

Auditena is not intended for children under 16, and we do not knowingly process their data.

14. Automated decisions

We make no automated decisions and do no profiling within the meaning of Art. 22 GDPR.

15. Changes to this policy

We update this policy when our data processing changes. The current version is always the one published on this page, with its update date.