Privacy Policy

1. Data controller

For the purpose of this Privacy Policy and the GDPR, the data controller is Yaman, Järvevana tee 9, Kesklinna linnaosa, Harju maakond, 11314, Tallinn, Estonia, registration number 17309824. Email: [email protected].

We deliver our immigration services together with our immigration partner, Bureaucracy International Group B.V. (the Netherlands), which processes your data on our behalf under a data processing agreement, solely for your immigration process. See section 17 of our Terms & Conditions.

2. What personal data we collect

• Identifying information: name, surname, date of birth, nationality, identity documents, postal address, email, phone number.
• Migration data: travel history, previous visas, passport, official documents.
• Financial data: proof of income, bank statements, payslips.
• Health data only when strictly necessary for a migration procedure (for example a medical certificate).
• Browsing data: IP address, approximate location, browser and operating system.
• Other documents you submit yourself through your dashboard, and the questions you send us through our website's contact form.

3. Legal basis for processing

Under the GDPR we must have a lawful basis to collect and use your personal data. We rely on one or more of the following:

• Performance of a contract: when processing is necessary to deliver the services you contracted.
• Consent: when you have given clear consent for a specific purpose, such as receiving news from us.
• Legitimate interests: when processing is necessary for our legitimate interests, such as answering your enquiry, provided your rights do not override them.
• Legal obligation: when the law requires us to process your data.

You can withdraw your consent at any time.

4. Consent for minors

Where consent is the lawful basis, we only process the data of children under 16 with verified parental consent. Children's data included in a family application is provided and managed by the main applicant.

5. How we collect data

• Through forms on our website, such as the contact form and the signup form.
• Through the documents you upload to your private client dashboard.
• Through direct communication: email, phone calls, text messages and messages in your dashboard.

6. What we use your data for

• To answer your questions and provide our immigration advisory services.
• To prepare and process your visa or residence application, manage your account and perform our contract with you.
• To send you service messages by text message to the phone number you give at signup: case updates, document and appointment reminders and payment notifications. You can opt out at any time by replying STOP or writing to [email protected].
• To communicate with the Spanish authorities, consulates and immigration offices on your behalf.
• To comply with legal obligations, and to prevent fraud and protect our services.
• With your consent, to send you news and information about our services. You can unsubscribe at any time.

7. Our AI assistant

Your client dashboard includes an AI assistant that summarises where you are in your application, tells you which documents are still needed and what to do next, and answers your questions. To do this, your case information (such as your service, progress, documents and payments) is shared with an AI service operated for us under confidentiality. It is used solely to assist you within your dashboard: never for advertising, never to train third-party AI models, and never shared with, sold to or made available to anyone else.

8. Who we share your data with

Only when strictly necessary to provide the Service:

• Our immigration partner, which prepares and manages applications on our behalf (section 1).
• Migration authorities, embassies and consulates.
• Technology service providers, under confidentiality agreements.
• Operational service providers: sworn translators, printing, courier and postal services.
• Other advisers, such as tax or health insurance providers, only with your permission.

We never sell or rent out your personal data.

9. Where we store your data

Your data is stored on a secure platform hosted on servers that meet European security standards. Documents are encrypted in transit and at rest, and only your case manager and authorised staff can access your files.

10. How long we keep your data

We keep your data as long as needed for the purposes it was collected for, and then for the periods the law requires. Your case files are kept for the duration of your process and archived for 10 months after your case is closed, then permanently deleted unless Spanish tax or immigration law requires longer. Invoicing and administrative records are kept for the period tax law requires. Health data is kept only while necessary and then deleted. Enquiries that do not lead to a case are deleted within 12 months.

11. Your rights

• Access: know exactly what data we process about you.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Objection: object to the processing of certain data.
• Portability: receive your data in an electronic format.
• Restriction: ask us to restrict processing in certain conditions.

To exercise your rights, write to [email protected] and include a copy of your ID so we can verify your identity.

12. Transfers of personal data

We take all reasonable steps to make sure your data is treated securely and in line with this policy. Your data is not transferred to an organisation or country unless adequate controls are in place. If data needs to be transferred outside the European Economic Area, we make sure appropriate safeguards are in place under the GDPR, such as standard contractual clauses.

If we are involved in a merger, acquisition or asset sale, we will ask for your consent before sharing or transferring your personal data as part of it.

13. Cookies

We use only the cookies needed to run the Service: session cookies that keep you logged in to your dashboard and secure the forms you send, and cookies that remember choices such as your language. We do not use advertising cookies. You can set your browser to refuse cookies, but parts of the Service, such as logging in, will then not work.

14. Information security

We apply technical and organisational measures to protect your data against loss, misuse, unauthorised access, disclosure or alteration. While we use commercially acceptable means to protect it, no method of transmission over the internet is 100% secure.

15. Links to other websites

The Service may link to websites we do not operate. We have no control over and assume no responsibility for their content or privacy policies, and advise you to review the privacy policy of every site you visit.

16. Changes to this policy

We may update this policy at any time. We will tell you about significant changes through our website or by email. Changes take effect when they are posted; the "Last updated" date shows when that was.

17. Contact us

For questions about this policy or how we handle your data, write to [email protected]. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the data protection authority in your country.