Privacy Policy for yeshcube Praxis 26/27 Applications

This is a translation of the Spanish original, provided for convenience. In the event of any discrepancy between language versions, the Spanish version prevails.

Effective date: August 19, 2026.
Last updated: August 19, 2026.

1. Purpose of this policy

This Privacy Policy explains how Yeshcube Tech, S.L. processes personal data in connection with applications to yeshcube Praxis 26/27, including application submission, assessment, interviews, communications with applicants and, where applicable, preparation and formalization of participation.

This policy supplements yeshcube’s general Privacy Policy and specifically applies to Praxis 26/27 application-related processing.

Where there is a difference between the two policies regarding Praxis application data, this specific policy will govern that processing.

2. Data controller

The data controller is:

Yeshcube Tech, S.L.
Tax ID: B21900543.
Trade name: yeshcube.
Registered office: C. de la Travesía, SN, Poblados Marítimos, 46024 Valencia, Spain.
Valencia Commercial Registry, File V 225222.
General email: hello@yeshcube.com.
Data protection and legal contact: legal@yeshcube.com.
Website: https://yeshcube.com.

These details correspond to the information currently published in yeshcube’s legal documentation. yeshcube

3. Who this policy applies to

This policy applies to individuals who:

• Apply to any Praxis 26/27 track.
• Take part in interviews or subsequent stages of the selection process.
• Provide additional documentation to verify their educational status or placement feasibility.
• Receive conditional admission and enter the formalization process.
• Communicate with yeshcube regarding their application.
• Explicitly request consideration for future opportunities after the process has ended.

It may also apply to representatives, tutors, or contacts at universities, Vocational Education and Training institutions, or other educational organizations when their data is required to coordinate or formalize participation.

4. Personal data we may process

yeshcube applies the principles of data minimization and purpose limitation and will request only information reasonably required to manage and assess an application and, where applicable, formalize participation. The GDPR requires personal data to be adequate, relevant, and limited to what is necessary for the intended purpose. EUR-Lex

4.1 Identification and contact information

This may include:

• First and last name.
• Email address.
• Telephone number.
• Country of residence where relevant.
• Communication language.
• Age or date of birth only when required to verify legal or educational requirements.
• Additional identification details when required at the formalization stage.

4.2 Educational information

This may include:

• University, VET institution, or other educational institution.
• Degree, program, qualification, or course of study.
• Academic year or level.
• Enrollment status.
• Placement or workplace training requirements.
• Required hours or period when known by the applicant.
• Learning objectives or requirements set by the educational institution.
• Information required to determine whether participation can be formally arranged.

4.3 Professional and skills information

Where relevant to the selected track, we may process:

• Résumé or CV.
• Additional training.
• Previous experience, if any.
• Skills and knowledge.
• Portfolio.
• GitHub or other professional repositories voluntarily provided.
• LinkedIn profile voluntarily provided.
• Publications, research, academic work, or professional work provided by the applicant.

The AEPD establishes that information requested during a selection process must be connected to the purpose of that process and must respect the principles of data minimization and proportionality. AEPD

4.4 Application information

This may include:

• Selected track.
• Motivation for joining Praxis.
• Learning objectives.
• Availability.
• Potential participation period.
• Application form responses.
• Preferences relating to the delivery of the placement where they are relevant.
• Communications maintained during the process.

4.5 Assessment information

The process may generate:

• Interview notes.
• Assessment of alignment with the selected track.
• Assessment of learning objectives.
• Availability and compatibility observations.
• Other application-related notes.
• Stage outcomes.
• Proposed track or project where applicable.

Assessment notes and subjective evaluations relating to an identifiable applicant are also personal data and remain subject to GDPR safeguards. AEPD

4.6 Formalization information

If an application progresses to conditional admission, we may request or receive additional information required to formalize participation, including:

• Proof of enrollment.
• Information required for academic or training agreements.
• Learning plan information.
• Data required for applicable Social Security obligations.
• Insurance or occupational risk prevention information where required.
• Mobility or residence information for international applicants where necessary.
• Educational tutor or institutional contact details.

Whether participants in training placements are included in the Social Security system depends on the type of studies and the corresponding arrangement. Seguridad Social

5. Data we do not generally request

To assess an application, yeshcube does not need information unrelated to the academic and educational requirements of the program.

For that reason, as a general rule, the following will not be requested:

• Information on political opinions or political affiliation.
• Trade union membership.
• Religion or beliefs.
• Sexual orientation.
• Information on sex life.
• Genetic data.
• Biometric data intended to uniquely identify a person.
• Medical or health information, unless there is a duly justified legal or adaptation need at a later stage.
• Criminal records, unless an applicable rule expressly requires them for a specific activity.

The AEPD warns that only relevant data should be collected during a selection process and that special categories of data require a specific legal basis. AEPD

Applicants should avoid voluntarily including in their CV or documentation any sensitive information that is not necessary for Praxis.

6. Purposes of processing

Personal data may be used for the following purposes.

6.1 Managing the application

This includes:

• Registering the application.
• Identifying the track applied for.
• Verifying the general requirements.
• Organizing the selection process.
• Communicating with the applicant.
• Requesting additional information where necessary.

6.2 Assessing the fit with Praxis

This includes assessing:

• The relationship between the applicant’s studies and the track.
• Learning objectives.
• Motivation.
• Relevant knowledge and skills.
• Availability.
• Compatibility with active projects.
• Initial feasibility of the training placement.

6.3 Managing interviews

Data may be used to:

• Schedule interviews.
• Conduct the interview.
• Document the relevant aspects of the conversation.
• Add the necessary assessments to the application file.

Answers given during an interview do not in themselves constitute consent to any subsequent processing and must be used exclusively within a legitimate purpose previously disclosed. AEPD

6.4 Managing selection and conditional admission

This includes:

• Communicating the outcome of each stage.
• Proposing an alternative track where there is a better fit.
• Making a preliminary assignment to a project.
• Verifying whether formalization is possible.
• Communicating any conditional admission.

6.5 Formalizing participation

If an application is selected, data may be used to:

• Coordinate with the educational institution.
• Prepare agreements, arrangements, annexes and training plans.
• Appoint the corresponding tutors.
• Manage administrative obligations.
• Meet Social Security obligations.
• Manage risk prevention and insurance where applicable.
• Prepare onboarding onto the project.

6.6 Managing queries, incidents and rights

We may also process data to answer queries, manage incidents, handle complaints and process data protection requests.

6.7 Complying with legal obligations

yeshcube may retain or disclose certain data where necessary to comply with a legal obligation, respond to requests from competent authorities, or establish, exercise or defend claims.

7. Legal bases

7.1 Managing and assessing the application

The primary legal basis is Article 6(1)(b) GDPR, which permits processing necessary to take steps, at the request of the data subject, prior to formalizing a relationship.

The applicant voluntarily submits their application, asking yeshcube to assess their possible participation in Praxis.

Consent is not used as the general basis for those operations that are necessary in order to process the application.

The GDPR expressly distinguishes between consent and processing necessary to take steps at the request of the data subject before a relationship is formalized. EUR-Lex

7.2 Compliance with legal obligations

Where processing is necessary to comply with obligations arising from education, Social Security, risk prevention, immigration or other applicable regulations, the basis will be Article 6(1)(c) GDPR.

7.3 Defense of rights and secure operation of the process

Certain processing that is strictly necessary to prevent abuse, protect systems, maintain traceability, or establish and defend claims may rely on yeshcube’s legitimate interests under Article 6(1)(f) GDPR, following a balancing assessment where required.

7.4 Future opportunities

Retaining a profile after the original purpose of the application has ended, in order to consider that person for future opportunities, will not happen automatically.

Where yeshcube wishes to offer this possibility, it must request a separate, voluntary authorization.

Refusing to give that consent will not affect the Praxis application.

Consent may subsequently be withdrawn at any time.

The AEPD notes that using an application later for a talent pool or a future process requires its own legal basis once the initial purpose has been exhausted. AEPD

7.5 Marketing communications

Data provided to Praxis will not automatically be used for newsletters, advertising or marketing communications.

Such communications will require the corresponding legal basis and, where applicable, separate consent.

Participation in Praxis will not be conditional on accepting marketing communications.

8. Sources of personal data

Most information will be provided directly by the applicant through:

• The application form.
• The CV.
• The interview.
• Documentation provided at a later stage.
• Communications with yeshcube.
• Professional links voluntarily provided.

Where the application progresses, we may also receive information from the university, VET institution or other educational institution where it is necessary to verify or formalize participation.

Where information is not obtained directly from the applicant, yeshcube will provide the information required by Article 14 GDPR within the legally applicable period and conditions. EUR-Lex

9. LinkedIn, GitHub, portfolios and public professional presence

yeshcube may review content included in professional profiles, portfolios, repositories or websites where:

• The applicant has provided the link themselves.
• The information bears a reasonable relationship to the track or to the elements to be assessed.
• The processing is necessary and proportionate for the application.

The fact that information is publicly accessible on the internet does not in itself authorize the indiscriminate collection or assessment of personal information about an applicant. The AEPD requires a professional purpose, necessity, relevance and a valid legal basis. AEPD

yeshcube will not request access to private profiles or social media credentials.

10. Automated decision-making and artificial intelligence

Admission to or exclusion from Praxis will not be based solely on automated processing that produces legal effects or similarly significantly affects the applicant.

Digital or artificial intelligence tools may, where appropriate and subject to suitable safeguards, be used for ancillary tasks such as organization, administrative classification or document support, but decisions on whether an application progresses must retain human involvement.

Article 22 GDPR establishes specific safeguards against decisions based solely on automated processing that produce legal effects or similarly significant effects. EUR-Lex

If yeshcube substantially changes this system in the future and introduces profiling or automated decisions with significant effects, it must give prior information about that processing and apply the corresponding safeguards.

11. Recipients

Data will be processed by the people at yeshcube who need to access it in order to manage Praxis, in accordance with criteria of necessity and confidentiality.

Where an application progresses to formalization, certain data may be disclosed, where necessary, to:

• The applicant’s university, VET institution or other educational institution.
• Academic tutors or officers.
• Organizations responsible for managing administrative aspects of the placement where applicable.
• Social Security or other public administrations where there is a legal obligation.
• Insurance providers where insurance is mandatory.
• Public authorities, courts or tribunals where there is a legal obligation.
• Other recipients whose involvement is necessary to formalize participation and is covered by a valid legal basis.

Application data will not be shared with other Allies organizations merely because a person applies to Praxis.

12. Service providers and processors

yeshcube may use technology providers to deliver necessary services relating to:

• Hosting and infrastructure.
• Form management.
• Document storage.
• Email.
• Communications.
• Scheduling and videoconferencing.
• Security.
• Internal management of the process.

Where such providers process personal data on behalf of yeshcube, they must act as processors under Article 28 GDPR and be subject to the corresponding contract and to confidentiality and security obligations. EUR-Lex

Using a provider does not authorize that provider to use application data for its own independent purposes.

13. International transfers

yeshcube will seek to keep its primary processing within the European Economic Area.

If any necessary provider involves an international transfer of data, that transfer will only take place where a valid mechanism under the GDPR exists, such as:

• An adequacy decision of the European Commission.
• Standard contractual clauses.
• Another safeguard recognized under Articles 44 and following of the GDPR.

Where legally required, information about the safeguards used may be requested.

yeshcube’s current general policy likewise establishes that transfers outside the EEA are not part of routine processing and that, where they are necessary, safeguards recognized under European law must be used. yeshcube

14. Data retention

14.1 Applications that are not selected

Data will be retained for the duration of the process and for the period strictly necessary to close the call, address queries and, where applicable, determine any responsibilities arising from the process.

Once that purpose has ended, the data will be deleted or blocked in accordance with the applicable legal obligations.

The application will not automatically be added to a permanent talent database.

14.2 Applications that are selected

Where a person joins Praxis, the data necessary to document and manage their participation will become part of the corresponding file and will be retained for as long as necessary to:

• Manage participation.
• Evidence the training activity.
• Comply with academic, administrative and Social Security obligations.
• Address potential responsibilities.
• Comply with the applicable legal periods.

Data from the process that is no longer necessary must be deleted in accordance with the storage limitation principle. EUR-Lex

14.3 Talent pool and future opportunities

Where a person expressly authorizes their profile to be retained for future opportunities, they will be informed, at the time that consent is requested, of the applicable period or of the criteria used to determine it.

That consent may be withdrawn at any time.

The AEPD indicates that, once the initial purpose of a process has ended, keeping a CV for future processes requires a different legal basis. AEPD

15. Security and confidentiality

yeshcube will adopt technical and organizational measures appropriate to the risk in order to protect data against:

• Unauthorized access.
• Loss.
• Alteration.
• Destruction.
• Improper disclosure.
• Use for incompatible purposes.

Internal access will be limited to the people who need to use the data to carry out their duties.

yeshcube is also responsible for the proper custody of the CVs and other documentation submitted by applicants. The AEPD recalls that documentation received during a selection process is protected by the GDPR principles of integrity and confidentiality. AEPD

16. Applicant rights

Data subjects may exercise the following rights, where applicable:

• Access to their personal data.
• Rectification of inaccurate or incomplete data.
• Erasure.
• Restriction of processing.
• Objection.
• Portability where applicable.
• Withdrawal of consent where processing is based on consent.
• The right not to be subject to certain solely automated decisions.

These rights are governed principally by Articles 15 to 22 GDPR. EUR-Lex

The existence of internal assessments about an application does not remove their status as personal data or the rights recognized by the regulations, although certain rights may be subject to the limits provided for by law. AEPD

17. How to exercise these rights

Requests may be sent to:

legal@yeshcube.com.

They may also be sent by post to:

Yeshcube Tech, S.L.
C. de la Travesía, SN.
Poblados Marítimos.
46024 Valencia, Spain.

The request must make it possible to identify the data subject sufficiently and must specify the right they wish to exercise.

yeshcube may request additional information only where there is reasonable doubt about the identity of the person making the request.

As a general rule, the GDPR establishes a period of one month to respond, which may be extended in certain cases depending on the complexity and number of requests. EUR-Lex

18. Complaints to the supervisory authority

If a person considers that the processing of their personal data infringes the applicable regulations, they may lodge a complaint with the Spanish Data Protection Agency.

Exercising this right is independent of the possibility of contacting yeshcube beforehand through legal@yeshcube.com.

The Spanish Data Protection Agency is the Spanish supervisory authority competent to oversee the application of data protection regulations in the areas within its remit. AEPD

19. Applicants who are minors

Praxis may receive applications from minors where their official studies legally allow a training placement.

In those cases, participation will be subject to the authorizations, safeguards and procedures required by the regulations and by their educational institution.

yeshcube will limit the processing of a minor’s data to what is strictly necessary to manage their application and any participation.

Where legally necessary, the data and involvement of the corresponding legal representatives will be requested.

The general rules on digital consent of minors in yeshcube’s general services policy must not be interpreted as replacing the specific academic or legal authorizations required to take part in Praxis.

20. Third-party data

Applicants should avoid including in their CV, portfolio or documentation any personal data of third parties that is not necessary.

Where data on teachers, tutors, references or other contacts is provided, there must be a legitimate reason for doing so and the information must be limited to what is strictly necessary.

yeshcube may contact those people only where it is relevant to the process and a valid legal basis exists.

21. Verification of information

yeshcube may request documents intended to verify information relevant to eligibility or formalization, in particular:

• Enrollment.
• Qualification or studies.
• Requirements of the educational institution.
• Training availability.
• Necessary administrative documentation.

Verification will be limited to information relevant to Praxis.

No general investigation into the private life of applicants will be carried out.

22. Withdrawal of an application

An applicant may withdraw their application at any time by notifying yeshcube.

Withdrawal means that the processing operations linked to assessing the application that are no longer necessary will cease.

yeshcube may keep certain data blocked where necessary to comply with legal obligations or to address potential responsibilities arising from the process.

23. Relationship with subsequent formalization

This policy principally governs the processing associated with the application and selection for Praxis.

Where a person is finally onboarded, there may be additional processing relating to:

• Delivery of the placement.
• Tutoring.
• Monitoring and assessment.
• Access to tools and systems.
• Project activities.
• Information security.
• Risk prevention.
• Compliance with academic obligations.
• Administrative management.

Where any of that processing requires information additional to what this policy contains, the corresponding information will be provided before that processing begins.

24. Separation between Praxis and future professional relationships

Participation in Praxis and any subsequent employment or professional relationship are different purposes.

Praxis data will not automatically be used to formalize a future employment relationship.

If a professional opportunity arises later, the processing and information corresponding to that new process will apply.

Joining yeshcube’s priority talent pool must not be interpreted as unlimited authorization to retain indefinitely all the data generated during Praxis.

25. Updates to this policy

yeshcube may amend this Privacy Policy where necessary to adapt it to:

• Regulatory changes.
• Changes to Praxis.
• Changes to the application procedures.
• New academic or administrative obligations.
• Relevant changes to the tools used to manage the process.

Where an amendment substantially affects the processing of an application already submitted, the people affected will be informed before the new processing is applied, where the regulations so require.

The version in force will be permanently available at yeshcube.com.

26. Applicable regulations

This policy has been drawn up taking particular account of:

• Regulation (EU) 2016/679, the General Data Protection Regulation. EUR-Lex
• Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights. Boletín Oficial del Estado
• Guidelines and criteria published by the Spanish Data Protection Agency on the processing of data in selection processes. AEPD
• Royal Decree 592/2014, as regards external university academic internships and their formalization. Boletín Oficial del Estado
• The Vocational Education and Training and in-company training regulations in force, where applicable. Boletín Oficial del Estado
• The Social Security regulations applicable to training internships. Seguridad Social

27. Information to be shown on the form

The Praxis application form must include a first layer of privacy information visible before submission.

Recommended notice:

Controller: Yeshcube Tech, S.L.
Purpose: to manage, assess, and resolve the application to yeshcube Praxis 26/27 and, where the application progresses, prepare its potential formalization.
Legal basis: steps taken at the applicant’s request before potential formalization and compliance with applicable legal obligations.
Recipients: data will not be disclosed except where required to formalize participation, comply with legal obligations, or through service providers acting on behalf of yeshcube.
Rights: access, rectification, erasure, restriction, objection, and other applicable rights through legal@yeshcube.com.
Additional information: Privacy Policy for yeshcube Praxis 26/27 Applications.

The AEPD specifically recommends a layered information system and requires that, where data is obtained directly through a CV or a form, privacy information be provided at the time of collection. AEPD