Personal Data Processing and Privacy Policy
Effective September 11, 2026
Published in Spanish and English. If the versions differ, the Spanish version prevails.
This Policy explains how MPC LAW STUDIO, as data controller, collects, uses, stores, shares, and deletes personal data associated with Legal English 5, and how data subjects may exercise their habeas data rights. It applies to the website, account, learning activity, support, trial, and subscriptions.
Data controller
| Provider | María del Pilar Cruz, natural person conducting business under the trade name MPC LAW STUDIO |
|---|---|
| Tax ID | 52.148.660-7 |
| Website | https://www.legalenglish5.com |
| Judicial notices | Calle 78 No. 9-58, apartamento 602, Bogotá D.C., Colombia |
| Telephone | +57 301 237 7281 |
| support@legalenglish5.com |
Team responsible for petitions, inquiries, and complaints: MPC LAW STUDIO Personal Data Protection and User Support, available at support@legalenglish5.com.
Legal framework and principles
Processing is carried out under the Colombian Constitution, Law 1581 of 2012, Decree 1074 of 2015, and other applicable Colombian rules. The Provider applies the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security, and confidentiality.
Personal data processed
- Identity and contact data: name, email address, and organization information when provided by the user.
- Account and authentication data: account identifiers, protected credentials, session tokens, and access records. Passwords are not stored in readable text.
- Learning data: terms viewed or saved, progress, answers, quiz results, streaks, preferences, and in-Service activity history.
- Subscription and payment data: plan, trial status, billing dates, amount, currency, transaction identifiers, payment status, and a payment-method reference. The Provider does not store the full card number.
- Technical and security data: IP address, browser, device, language, date and time, event logs, and strictly necessary cookies or equivalent technologies.
- Support and compliance data: messages, requests, complaints, evidence of acceptance, accepted legal-document versions, and documents supplied by the user.
- Profile image, only if the Service enables the feature and the user chooses to upload one.
The Provider does not request sensitive data for the ordinary provision of the Service. Users should not send such data through support channels unless strictly necessary. If sensitive-data processing becomes necessary, its optional nature will be explained and explicit authorization will be requested unless a statutory exception applies.
Processing purposes
- create, authenticate, and administer the account;
- provide educational content, save preferences, and display progress;
- activate the trial, administer the subscription, process payments, and prevent fraud;
- respond to requests, provide support, and manage data-subject and consumer rights;
- maintain security, diagnose failures, prevent abuse, and improve Service stability;
- comply with accounting, tax, contractual, evidentiary, and authority requirements;
- send necessary transactional communications about the account, security, billing, and material changes; and
- send marketing communications only under separate authorization or a lawful permission, with an opt-out mechanism.
Personal data is not sold or used for behavioural advertising. The Provider does not make decisions producing legal effects for the user solely through automated processing.
Processors providers and disclosure
The Provider limits access to parties that need it for the stated purposes. Data may be transmitted to service providers acting as processors under instructions, confidentiality, security, and data-protection obligations. The principal known providers are Supabase, for authentication, database, and product infrastructure, and Mercado Pago, for payment-method activation and payment processing. Mercado Pago may also act as an independent controller for information it collects directly in its own environment.
Hosting, transactional communication, support, security, or professional-advisory providers may also participate as necessary. Data may be disclosed to authorities under a valid legal duty or request. Data is not shared so third parties can conduct their own advertising without authorization.
International processing
Some providers may process or store information outside Colombia. When an operation is an international transmission, the Provider will establish the contractual obligations required for the processor to handle data under this Policy and Colombian law. When it is a transfer, the Provider will verify an adequate level of protection or the applicable exception or authorization.
Security and confidentiality
The Provider uses reasonable and proportionate administrative, technical, and organizational measures to protect data against unauthorized access, loss, alteration, use, or disclosure. Measures include access controls, authentication, separation of duties, logs, and rules governing access to user data. No system is infallible, so the Provider manages incidents and provides notices to data subjects and authorities where required.
Retention and database term
Legal English 5 databases will remain in force while the Service operates and for additional periods necessary to fulfil authorized purposes and legal obligations. Account and learning data is kept while the account is active or until deletion is requested, unless a legal or contractual duty applies. Payment, billing, consent, security, and complaint records are retained for applicable evidence, limitation, accounting, and rights-defence periods. Backups are deleted or overwritten according to technical cycles and remain restricted in the meantime.
After the purpose is fulfilled and applicable periods expire, data is securely deleted, anonymized, or blocked.
Data-subject rights
Data subjects may:
- access, update, and correct their personal data;
- request proof of authorization, unless a statutory exception applies;
- obtain information about how their data has been used;
- file a complaint with the Colombian Superintendence of Industry and Commerce after completing the direct procedure where required;
- withdraw authorization or request deletion where appropriate;
- access processed personal data free of charge; and
- request a portable copy of available information where technically reasonable and without affecting third-party rights.
Inquiries and complaints
Requests may be submitted free of charge to support@legalenglish5.com with the subject line "Personal data". They must include the requester's name, sufficient information to verify identity, a clear description of the request, a response address, and relevant documents. Heirs, representatives, and agents must prove their capacity. The Provider may request reasonable information to prevent improper disclosure.
Inquiries will be answered within ten business days after receipt. If this is not possible, the Provider will explain why and state a new date, no more than five additional business days later. Complaints will be processed within fifteen business days from the day after receipt; if this is not possible, the Provider will explain why and state a new date, no more than eight additional business days later. Incomplete complaints are handled under the statutory cure procedure.
Withdrawal deletion and account removal
A data subject may withdraw authorization or request deletion through the stated channels unless a legal or contractual duty requires retention. Withdrawal may be total or limited to optional purposes. When account deletion is requested through the product or by email, active future renewals will be stopped first, followed by deletion or anonymization of data that need not be retained.
Account deletion differs from subscription cancellation and may be irreversible for progress and preferences. The Provider will confirm the result and any legally required retention.
Minors
Legal English 5 is not directed to persons under 18 and does not knowingly seek to collect their data. If the Provider identifies a minor's account without the legally required authorization and conditions, it will restrict the account and delete the information unless retention is required.
Policy changes
Changes will be published with their effective date. Material changes will be communicated before taking effect, and new authorization will be requested for incompatible purposes or where required by law. Previous versions and acceptance evidence will be retained where necessary.
Language
This Policy is published in Spanish and English. If the versions differ, the Spanish version controls, without prejudice to the data subject's statutory rights.