Privacy Policy

Last updated: 28 September 2026

1. Who is responsible for your data?

The controller of your personal data is Susan Torosyan, trading as Koyot Agency (“Koyot Agency”, “we”).

• NIF: Y7234226G
• Address: Calle Santísimo Cristo de la Fe, 19, 46920 Mislata, Valencia, Spain
• Email: info@koyotagency.com
• Phone: +34 673 666 116

For any question about your personal data, you can contact us at info@koyotagency.com.

2. Which personal data do we process?

Depending on how you interact with us, we process the following categories of data:

• Website visitors: technical data such as IP address, browser type and pages visited, and cookie data according to your cookie choices.
• People who contact us: name, organisation, country, email address, phone number and the information you share in the enquiry form or by email.
• Schools, coordinators and partner organisations: business contact details and the information needed to prepare and manage a mobility programme.
• Participants in a mobility programme (students and accompanying staff): identification and contact details, date of birth, field of study, language level, travel details, emergency contacts and, where necessary to organise the stay safely, information such as allergies, dietary requirements or relevant health information.
• Host companies and local partners: business contact details of contact persons.

Participant data is normally provided to us by the sending school or organisation, which is responsible for informing participants and, for participants under 18, their parents or legal guardians.

3. Why do we use your data and on what legal basis?

• To answer enquiries and prepare proposals: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• To organise and deliver mobility programmes, including internship placement, accommodation, transfers, language courses, activities and on-site support: performance of the contract with the sending organisation (Art. 6(1)(b)) and our legitimate interest in providing the service safely (Art. 6(1)(f)).
• To process health or dietary information needed for the safety and well-being of participants: explicit consent (Art. 9(2)(a)) or, in an emergency, the protection of vital interests (Art. 9(2)(c)).
• To meet accounting, tax and other legal obligations (Art. 6(1)(c)).
• To publish photos or testimonials of participants: only with prior consent (Art. 6(1)(a)); for minors, the consent of a parent or legal guardian.
• To send news or information about our services by email: your consent or, for existing business contacts, our legitimate interest. You can unsubscribe at any time.
• To keep the website secure and understand how it is used: our legitimate interest and, for non-essential cookies, your consent.

4. Who do we share your data with?

We only share data when needed for the purposes above:

• Host companies, accommodation providers (such as host families and residences), transport providers and activity providers involved in the programme.
• Koyot Academy, for language courses.
• Insurance providers, doctors or emergency services, when necessary.
• IT and service providers that support us, such as website hosting, email and form services, under a data processing agreement.
• Public authorities, when required by law.

We do not sell personal data.

5. International transfers

Some of our IT providers may process data outside the European Economic Area. In that case, we make sure appropriate safeguards are in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

6. How long do we keep your data?

• Enquiries that do not lead to a programme: up to 12 months after our last contact.
• Programme data: for the duration of the programme and afterwards for as long as needed to meet legal obligations and to handle possible claims.
• Health information: deleted once the programme has ended, unless it is needed to deal with an incident.
• Photos and testimonials: until consent is withdrawn.
• Accounting and tax data: for the periods required by Spanish law.

7. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability and to withdraw your consent at any time, without affecting processing carried out before the withdrawal.

To exercise your rights, email info@koyotagency.com. We may ask you to confirm your identity. If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority in your country.

8. Minors

Our services are aimed at schools and organisations. The enquiry form is intended for adults acting on behalf of an organisation. Data of participants under 18 is processed on the basis of the information and consents collected by the sending organisation from parents or legal guardians.

9. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and we only give access to people who need it for their work.

10. Cookies

Our website uses cookies. You can find more information and change your preferences in our cookie policy and the cookie banner.

11. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version.