Controller
Trocalia Digital S.L. (tax ID B70751490), Barcelona. For any privacy matter, write to info@formativia.com.
If you buy: your data as the person in charge at your company
We process the company name, its tax ID if you give it to us, and your name, email and phone to provide the service, give you access to the control tower and deal with your queries. Basis: performance of the contract.
Payment is handled by Stripe; we do not see or store your card details. Basis: the contract and our tax obligations.
If you are a learner: we process your data on behalf of your company
When your company adds you (or you sign up with its link), we process your name, your work email, the language, your ratings, your connections and connected time, the lessons and checks you complete, your exam attempts and mark, the messages you write on the board or to the tutor, and the download of your licence.
The controller of that data is your company; we are the processor and use it only to deliver the training to you and so that your company can evidence it. Your company sees your progress, your time and your mark. Your course mates see your name on the board and whether you are online, nothing else.
We do not record what you type into your AI tools: practice exercises take place outside the platform.
To exercise your rights over this data, contact your company first. You can also write to us and we will pass it on.
Public verification of licences
Anyone who has a licence code can check it at formativia.com/verificar. They will see the holder’s name, the company, the ratings, the date of issue, the syllabus version and whether it is still valid. They will not see the email or the mark. The code is held by the holder and their company; they decide whom to show it to.
Records from the anti-money-laundering course are checked the same way: they also show the course, the sector and modules, the hours and how long they are valid. The email and the mark are not shown either.
Aptitude check and contact
The aptitude check is marked in your browser: your answers are not sent anywhere. Only if you ask for the result by email do we receive your address and your score, with your consent, to send it to you; we delete them after 30 days and do not use them for anything else.
The “Green channel or red channel?” quiz works like the aptitude check. If a course is not yet on sale and you ask us to let you know, we keep your email, with your consent, for that one notice only, and delete it afterwards or after 180 days. If, when buying the anti-money-laundering course, you tell us who your company’s representative before Sepblac is, we use their name and email to enrol them on the course.
Messages from the contact form are used to reply to you. Basis: your request.
IP address and technical logs: for the security of the service and to prevent abuse. Basis: our legitimate interest.
Who else is involved
We use providers that process data on our behalf, under contract and with safeguards: Stripe (payments), SMTP2GO (sending emails) and our hosting provider in the European Union. They are our sub-processors as regards learners’ data.
Some may be in the United States or have sub-processors there. In those cases the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.
We do not send learners’ data to any artificial intelligence provider. We do not sell data or use it for advertising.
For how long
Order and invoicing data, six years, as required by commercial and tax law.
Learners’ data and the training record, for as long as the company’s access lasts (12 months) and four more years, so that the company can evidence the training to whoever asks. The company can ask us to delete them earlier; in that case the licences can no longer be verified.
Contact messages that do not lead to an order, one year.
Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data by writing to info@formativia.com. If you believe we are not handling it properly, you can complain to the Spanish Data Protection Agency (aepd.es).