Privacy Policy

Fluenco Academy (“Fluenco”, “we”, “us”, or “our”) is a digital language education provider headquartered in Mexico, offering English and Spanish assessment and training services to corporate clients and individual learners worldwide.

For the purposes of this Privacy Policy and applicable data-protection law — including the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (“LFPDPPP”) — Fluenco Academy is the Data Controller of the personal data we collect through our website, learning platform, and related services (collectively, the “Services”).

We collect only the personal data necessary to provide and improve the Services. The categories include:

• Identification data: full name, work email address, employer/company name (for corporate clients), preferred language, country/time zone.
• Account & authentication data: hashed password, login timestamps, role within your organization (e.g., learner, HR contact, instructor).
• Educational data: placement-test responses, proficiency level (CEFR A1–C2), lesson attendance, performance feedback, milestones.
• Communications data: messages you send us, audit/consultation requests, support tickets.
• Technical data: IP address, browser type, device identifiers, pages visited, and similar information collected through cookies and analytics tools (e.g., PostHog) for security, performance, and product analytics.

We do not knowingly collect data from children under 16.

Under GDPR, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to deliver the Services you or your employer have contracted (placement tests, classes, dashboards) and to send transactional emails (invites, password resets, lesson reminders).
• Legitimate interests (Art. 6(1)(f)) — to maintain accounts, prevent unauthorized access, troubleshoot, and produce aggregated analytics that help us improve.
• Consent (Art. 6(1)(a)) — for marketing communications, withdrawable at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other regulatory requirements.

Under the LFPDPPP, we likewise process personal data based on a legitimate purpose, the consent of the data owner (where required), and the principles of lawfulness, consent, information, quality, purpose, fidelity, proportionality, and responsibility.

Fluenco Academy is established in Mexico. When we receive personal data from individuals or businesses located in the European Economic Area, the United Kingdom, or other jurisdictions whose laws restrict cross-border data transfers, we transfer that data to Mexico only with appropriate safeguards in place.

For transfers from the EEA/UK to Mexico we rely on the Standard Contractual Clauses (“SCCs”) adopted by the European Commission under Decision (EU) 2021/914 (and the UK International Data Transfer Addendum where applicable). A copy of the SCCs is available on request to info@fluencoacademy.com.

We perform transfer-impact assessments and apply supplementary technical and organizational measures (encryption in transit and at rest, strict access controls, vendor due diligence) to ensure an essentially equivalent level of protection.

We share personal data only with:

• Sub-processors that help us deliver the Services (e.g., cloud hosting, email delivery, customer-support, payment, and analytics providers). Each sub-processor is bound by a written contract requiring confidentiality and equivalent security standards.
• Corporate clients who have contracted Fluenco on your behalf (e.g., your employer’s HR or L&D team), strictly for the purpose of monitoring progress and attendance under the program.
• Authorities or third parties where disclosure is required by law, court order, or to protect the rights, property, or safety of Fluenco, our users, or the public.

We do not sell your personal data.

We retain personal data only for as long as necessary for the purposes described above, namely:

• Account and learning records: for the duration of your subscription and up to 24 months thereafter to handle disputes, references, or returning learners.
• Transactional and billing records: up to 10 years to comply with Mexican tax and accounting law.
• Marketing data: until you withdraw consent.
• Backups containing personal data: cycled out within 90 days.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase (“right to be forgotten”) your data when no longer necessary or where you withdraw consent;
• Restrict or object to certain processing activities;
• Data portability in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, without affecting prior lawful processing;
• Lodge a complaint with your local supervisory authority (e.g., the Mexican INAI, or your EU national DPA).

To exercise any of these rights, email info@fluencoacademy.com with reasonable detail. We will respond within the timeframes required by applicable law (no later than 30 days under GDPR, 20 business days under LFPDPPP).

We implement industry-standard administrative, technical, and physical safeguards designed to protect personal data — including 256-bit SSL/TLS encryption in transit, encryption at rest, hashed passwords (bcrypt), role-based access control, audit logging, and regular vulnerability scanning. See our Security Statement for details.

Our website uses essential cookies (for session management) and limited analytics cookies (PostHog) to understand usage patterns and improve the platform. You can manage cookie preferences through your browser settings.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date and, where the change is material, notify you by email or through the Services.

Questions, requests, or complaints relating to this Privacy Policy can be addressed to: