This page explains what personal data Mestrium collects, why it uses it, who processes it and what you can request at any time.
Data controller
Harmonicode S.L., Spanish tax ID B22588917, Calle Tagamanent, 9, 08396 Sant Cebrià de Vallalta, Barcelona, Spain. For questions about this page, email hello@mestrium.com.
What data Mestrium collects
- Your account: name, email address and password, protected using a cryptographic hash function.
- Your purchases: cursos adquiridos, importe pagado, dirección de residencia, datos de facturación e identificación fiscal cuando solicites factura. Conservamos el país de residencia declarado, los datos de domicilio necesarios para la operación, los impuestos aplicados, la referencia del cobro y, si Stripe lo facilita, el país emisor del medio de pago. Contrastamos la IP de la conexión y su país aproximado para documentar la localización fiscal y detectar diferencias que necesiten revisión. La geolocalización se calcula en nuestro servidor con una base local de DB-IP.com (CC BY 4.0); no enviamos la IP del cliente a este proveedor. En compras sin IVA fuera de la UE pedimos domicilio y población para completar el justificante. Estos datos se utilizan para la facturación y la contabilidad y se conservan durante los plazos legales aplicables. No almacenamos el número completo de tarjeta ni su código de seguridad; se envían directamente al proveedor de pagos.
- Your learning: completed lessons and progress; quiz results, certificates and points when those features are enabled.
- What you post: reviews, comments and questions about courses.
- Consents: terms you accept when registering or purchasing, and the date of acceptance.
- Instructor agreements: declared identity and representation, account and email at the time of acceptance, the version and full text accepted, express declarations, date and time, and an integrity hash. These are used to manage the collaboration and evidence obligations, with access restricted to the instructor concerned and administration. They are retained during the relationship and for the legally required periods to handle claims.
- Newsletter: your email address, only if you subscribe.
- Messages: course questions and messages, and what you send to hello@mestrium.com.
- Technical data: IP address and browser in server logs, to protect the website.
Purposes and legal bases
- To provide your courses —account, access, progress and support—: as necessary to perform the contract you accept when registering or purchasing.
- To manage instructor collaborations and evidence their terms: as necessary to perform the contractual relationship with the instructor; any subsequent retention needed to bring or defend claims is based on the legitimate interest in evidencing the obligations undertaken.
- To issue invoices and maintain accounting records: to meet legal obligations.
- To send you news: because you requested it. You can unsubscribe from any email.
- To maintain website security and prevent fraud: for Mestrium’s legitimate interests.
Who else processes your data
Mestrium does not sell your data. These providers process it to provide their services:
- Netcup (Germany): hosting the website and its database.
- Hetzner Online (Germany): backups and a test environment during the transition to the new server.
- Brevo (France): sending website emails.
- Cloudflare: domain management and forwarding emails addressed to hello@mestrium.com.
- Bunny.net (Slovenia): playback of videos hosted on this service.
- Stripe: payment processing in accordance with its own privacy policy.
- Holded: management of invoices and accounting records for Harmonicode S.L.
The instructor of a course you are enrolled in can view your name, progress in that course, your posts and questions you send through the course.
Some providers may process data outside the European Union. When this happens, safeguards required by law apply, such as the European Commission’s standard contractual clauses or an adequacy decision.
How long data is kept
- Account and learning data: for as long as the account is open. When it is closed, this data is deleted except where retention is required by law.
- Invoices and purchase records: six years, in accordance with Spanish law.
- Newsletter: until you unsubscribe.
- Server logs: 14 days.
Your rights
You may request access to your data, rectify it, erase it, restrict processing, object to processing, receive it in a portable format and withdraw consent you have given. Email hello@mestrium.com. If you are not satisfied with the response, you may complain to the Spanish Data Protection Agency (aepd.es).
Age
You must be at least 16 to create an account. Younger students need their parent or guardian to do so for them.
If ownership of the business changes
If Mestrium becomes part of another company in the same group or is acquired by another entity, your data may be transferred to the new owner, who must continue to comply with this policy. We will notify you before this happens.
Cookies and changes
Cookie use is explained in the Cookie policy. If this policy changes materially, we will notify you by email or through the website.
Last updated: 29 October 2026.