Privatlivspolitik

This Privacy Policy explains how Well Contro Pro Academy S.L. (commercially known as MDS Academy )

collects and processes personal data through its website www.mdsspain.com and its online booking system, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data Controller

• Controller: Well Contro Pro Academy S.L. (MDS Academy)

• Address: Plaza Costa del Sol No10, Edificio Entreplazas 1-98, Torremolinos 29620, Málaga, Spain

• Contact: info@mdsspain.com

  The online booking system used on this website was designed and is technically maintained by Corellian-AI (www.corellian-ai.com), a division of Heredia & Price Capital, acting as technical provider.

  2. Personal Data We Process

  Depending on your relationship with MDS Academy, we may process the following categories of personal data:

• Candidate identification data: name and surname, date of birth, nationality, passport or national ID number, CR number (well control certification registration number), photograph.

• Contact and professional data: email address, telephone number, employer/company, job title.

• Booking and billing data: course and week booked, seat and accommodation details, quotes, invoices, payment references and billing information.

• Uploaded documents: copies of passports or ID documents, training certificates and other documents you provide during onboarding.

• Training history: courses attended, exam dates, accreditation body (IWCF, IADC, OPITO, GWO), results and certification records.

• Website usage data: cookie identifiers and analytics data (see section 8).

  You warrant that the data you provide is accurate, and that you have proper authorization when providing data about third parties (for example, when a company books training for its employees).

3. Purposes and Legal Bases

Managing bookings and delivering the contracted training courses

Invoicing, accounting and tax obligations

Performance of a contract (6.1.b)

Legal obligation (6.1.c)

Purpose Legal basis (GDPR art. 6)

Certification and registration with accreditation bodies (IWCF, IADC, Performance of a contract (6.1.b) and OPITO, GWO) legal/contractual certification requirements

Sending commercial communications about our courses and services Consent (6.1.a), which you may withdraw at any time

MDS Academy — GDPR Privacy Policy (2026)

Page 1

MDS Academy PRIVACY POLICY (GDPR)

Purpose Legal basis (GDPR art. 6)

Responding to enquiries and quote requests Legitimate interest (6.1.f) / pre-contractual measures (6.1.b)

4. Recipients and Processors

Personal data may be shared with the following categories of recipients, only to the extent necessary:

• Accreditation bodies (IWCF, IADC, OPITO, GWO and equivalent), for certification of your training.

• Payment processor: Stripe, for card payments only. MDS Academy does not store full card numbers.

• Cloud storage: Google Cloud Storage, for secure storage of uploaded documents and photographs.

• Analytics and tag management: Google Analytics and Google Tag Manager (see section 8).

• Calendar and email services: Google Calendar (course scheduling) and email service providers (booking confirmations and notifications).

• Technical provider: Corellian-AI (division of Heredia & Price Capital), which maintains the booking system on our behalf under a data processing agreement.

• Public authorities, where required by law.

  5. International Transfers

  Some of the providers listed above (Google, Stripe) are based in, or may process data in, the United States. Such transfers are carried out under the EU–US Data Privacy Framework , to which those providers are certified, and/or Standard Contractual Clauses approved by the European Commission, together with additional safeguards where appropriate.

  6. Retention Periods

• Booking, billing and invoicing data: for the duration of the contractual relationship and thereafter for the periods required by Spanish tax and commercial legislation (generally up to 6 years).

• Training and certification records: for as long as necessary to evidence your certification history and comply with accreditation body requirements.

• Uploaded identity documents: only for as long as needed for identity verification and certification purposes.

• Marketing data: until you withdraw your consent or object.

• Cookie and analytics data: according to the periods stated in the cookie banner.

  When data is no longer needed, it is securely deleted or anonymized.

  7. Your Rights

  You have the right to:

• Access the personal data we hold about you.

• Rectify inaccurate or incomplete data.

• Erase your data ("right to be forgotten"), where applicable.

• Object to processing based on legitimate interest, and to direct marketing at any time.

• Restrict processing in the circumstances provided by the GDPR.

• Data portability: receive your data in a structured, commonly used, machine-readable format.

Website analytics and cookies Consent (6.1.a)

MDS Academy — GDPR Privacy Policy (2026)

Page 2

MDS Academy PRIVACY POLICY (GDPR)

• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to info@mdsspain.com , indicating the right you wish to exercise and enclosing proof of identity. If you consider your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es ).

8. Cookies

This website uses a cookie consent banner. Non-essential cookies (analytics, advertising) are only installed after you give explicit, informed consent, in line with AEPD guidance. You can accept, reject or configure cookies from the banner and change your choice at any time. For further details, see the cookies section of our Terms & Conditions / cookie policy.

9. Security

MDS Academy has adopted the technical and organizational security measures required by law to protect personal data against loss, misuse, alteration, unauthorized access and theft, including encrypted transmission, access controls and secure cloud storage. However, no Internet security measure is completely impregnable.

10. Updates to this Policy

We may update this Privacy Policy to reflect legal or operational changes. The current version, with its date, will always be available on www.mdsspain.com.

Last updated: 2026 — Well Contro Pro Academy S.L. (MDS Academy)

MDS Academy — GDPR Privacy Policy (2026)

​