We keep your personal data safe and use it only for what this page says.
Who we are
Rack and Return (Proyectos Tigre y Panda SL, NIF B66953126), Calle Bailén 23, P SA Pta 2, 08010 Barcelona. We decide how your data is used. Contact us at info@rackandreturn.com.
What we collect and why
| What | Why |
|---|---|
| Name, email, phone | To take your booking, send your confirmation and reminders, and answer you |
| Invoice details (and company name and tax number if you ask for a company invoice) | To issue your invoice and keep our accounts |
| Date of birth, legal name, course, dates, exam details | To register you with WSET and keep the records WSET requires |
| What you tell us about adjustments | To arrange reasonable adjustments |
| Payment details | Your card is handled by our bank’s payment system. We never see or keep your full card number. We keep the order, amount and date. |
| Your answer to “How did you find us?” | To understand which of our marketing works |
| Your email and chosen topic, if you ask us to tell you about a date or a course | To email you about it |
| Messages you send us, by email or WhatsApp | To answer you |
| Browsing information (cookies) | Only if you accept cookies: to count visits and measure our advertising |
| Class recordings | Online courses may use recordings of past classes. They are shared privately with enrolled students and removed after the assessment window. We tell you when a class is recorded. If you do not want to appear in a recording, tell us and we will leave you out or delete it. |
If you book places for other people, you give only your own details. Each student then fills in their own details by email.
Our legal reasons
We use your data for these legal reasons: to carry out the contract you make with us when you book (booking, payment, registration, teaching); to meet legal duties (invoices and tax records); with your consent (marketing emails, sharing your data with WSET, adjustments you tell us about, and non-essential cookies), which you can withdraw at any time; and for our legitimate interest in keeping the site secure and preventing fraud.
Who sees your data
WSET. To register you and run exams and certificates, we share your data with WSET and its authorised third parties, with your consent. Read WSET’s privacy notice.
People who help us run the school: our team, your teacher (class lists only) and service providers under written agreements: hosting, email, payments, backups, accounting, and advertising and analytics (only with your cookie consent). Our main providers are: Hostinger (website hosting); Amazon Web Services (sending email); Comercia Global Payments and Redsys (card payments); Google (backups, and Classroom for online courses); Google Analytics, Google Ads and Meta (analytics and advertising), only with your cookie consent; and our accountants. We use each of them under its data processing terms. People outside our team who help with advertising see only advertising and analytics data. Some of these providers process data outside the EU, for example in the United States. In that case the transfer relies on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.
We do not sell or rent your data.
How long we keep it
- Student records, complaints and adjustment requests: at least three years, as WSET asks.
- Invoices and accounting records: 6 years, as Spanish commercial and tax rules require.
- Marketing emails: until you unsubscribe.
- Date choices and interest sign-ups: 24 months after your last contact with us, or until you ask us to delete them.
- Class recordings: removed after the assessment window.
Who can see the records
Only the people who need them: Michael Salverda, Mirela Adam, your teacher for class lists, and the providers above. We store records securely.
Your rights
You can ask to see your data, correct it, delete it, limit how we use it, object to its use, receive a copy, or withdraw a consent you gave. Write to info@rackandreturn.com. We reply within one month. You can complain to the Spanish data protection authority (AEPD, www.aepd.es).
Age
Our courses are for people aged 18 or over. We do not knowingly collect data from younger people.
Cookies
The first time you visit, a banner in English, Spanish and Catalan lets you accept or refuse cookies. Analytics and advertising cookies load only after you accept. Our Cookies page lists them.
If something goes wrong
If your data is lost or stolen in a way that puts you at risk, we tell you and WSET.
Changes
We post changes here and update the date below.
Last reviewed: 30 October 2026.
