Legal
Privacy Policy
Last updated: 3 June 2026
Who we are
Piktalent is the mobility brand of The Student Mobility Group S.L., headquartered at Avenida Flota de Indias 16, 41011 Sevilla (Spain), and operating across Europe and the USA. The Student Mobility Group is the data controller for personal data processed via the piktalent.com websites. This notice explains what personal data we collect, why, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR, the Spanish LOPDGDD, and equivalent laws in the jurisdictions where we operate.
You can reach our privacy contact at [email protected].
Data we process and why
1. Contact forms, applications, and quote requests
When you submit a contact form, partner enquiry, internship application, or quote request we process the data you provide — typically name, email, phone, institution / company, role, country, message, and where relevant your CV, study field, and programme preferences. We use this data to respond to your enquiry, deliver the requested service, and meet our contractual and legal obligations.
Legal basis: contract performance (Art. 6(1)(b) GDPR) and legitimate interest in operating the service (Art. 6(1)(f) GDPR). For CV data this is supplemented by Art. 6(1)(a) consent where required.
2. Email and operational communication
We use the email address you provide to reply to your enquiry and send transactional updates relating to a programme or quote you requested. We do not add you to a marketing list without your explicit opt-in.
3. Anti-spam and abuse prevention
We apply rate-limiting and content checks to form submissions to prevent abuse. This processing is based on our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
Analytics & IP-based geolocation
We run a first-party analytics pipeline to understand which pages are useful and to improve the site. Analytics is only activated after you accept the analytics category in our cookie banner. If you reject non-essential cookies, no analytics events are sent to our servers. We do not use Google Analytics, advertising cookies, cross-site trackers, or behavioural profiling, and we do not sell or share data with advertising networks.
What we record per session
- An anonymous random session and visitor identifier (no name, no email).
- Page paths visited, time spent, scroll depth, and clicks on links or buttons.
- Browser language, timezone, screen size, and device type (mobile / tablet / desktop).
- Referrer URL and UTM campaign parameters when present.
- Approximate location (country and city only), resolved from your IP address.
How IP geolocation works
When your browser pings our analytics endpoint, the server reads the IP address from the network request and sends it to ipapi.co to resolve country and city. We never store your raw IP address. Only the resolved country / city strings are written to our database, alongside the anonymous session id.
Legal basis & retention
- Legal basis: consent (Art. 6(1)(a) GDPR), captured via our cookie banner.
- Data minimisation: no profiling, no advertising, no sale of data, no third-party trackers.
- Retention: analytics events are deleted after 90 days; sessions after 180 days. Sessions linked to a submitted enquiry follow the contact-leads retention below.
- Geolocation can be disabled globally by our team at any time.
- You can change your consent at any time from the panel or the footer link.
Who we share data with
We share personal data only with processors strictly needed to run the service and always under a GDPR-compliant data processing agreement:
- Supabase (database, authentication, edge functions) — hosted in the EU.
- ipapi.co — receives the request IP at the moment of an analytics ping to return country and city. The raw IP is not stored on our side.
- Transactional email and infrastructure providers we use to reply to your enquiry.
We do not sell personal data and we do not share data with advertising networks.
International transfers
Where data is transferred outside the European Economic Area we rely on the European Commission's Standard Contractual Clauses (SCCs) and equivalent safeguards. For US-based providers we use providers covered by the EU–US Data Privacy Framework where available.
Retention summary
- Analytics events: 90 days, then permanently deleted.
- Analytics sessions: 180 days, then permanently deleted.
- Contact / quote / application leads: up to 24 months from last contact, then deleted or anonymised, unless a legal obligation requires longer.
- Email correspondence: as long as needed to address your enquiry plus a reasonable archive period.
Your GDPR rights
Under GDPR you have the right to:
- Access the personal data we hold about you (Art. 15).
- Have inaccurate data corrected (Art. 16).
- Have your data deleted, subject to legal retention limits (Art. 17).
- Restrict or object to processing based on legitimate interest (Art. 18 & 21).
- Receive your data in a portable format (Art. 20).
- Withdraw consent at any time, including analytics consent via our cookie settings.
- Lodge a complaint with your local data protection authority. For Spain this is the Agencia Española de Protección de Datos (AEPD).
To exercise any of these rights, email [email protected]. We respond within one month.
Children
Our services are aimed at higher-education institutions, VET centres, companies, and adult participants. We do not knowingly collect data from children under 16. If you believe a minor has submitted data, contact us and we will remove it.
Changes to this notice
We will update the date at the top of this page whenever we change how we process data. Material changes will be highlighted on our homepage and, where required, we will re-request your consent.