Find My Visa →

Privacy Policy

Last updated: June 18, 2026

1. About This Policy

This Privacy Policy explains how EspanaGo ("we", "us", "our") collects, uses, stores, and protects personal data when you visit espanago.com (the "Site") or engage us for immigration consulting services related to moving to Spain.

We process personal data in accordance with Regulation (EU) 2016/679 (the EU General Data Protection Regulation, "GDPR"), the UK GDPR, and Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). By using the Site, you confirm you have read and understood this Policy.

This Policy does not apply to third-party websites that may be linked from the Site. Each third party is responsible for its own privacy practices.

2. Data Controller

  • Controller: EspanaGo (operated by Andrey Rodionov, autónomo — self-employed, registered in Spain) [TODO: confirm autónomo NIF / registration number]
  • Address: Valencia, Spain (full postal address available on request) [TODO: confirm registered postal address]
  • Privacy contact: privacy@espanago.com [TODO: confirm this mailbox is active and monitored]
  • General contact: hello@espanago.com

Data Protection Officer (DPO): We have not appointed a statutory DPO because our processing does not meet the mandatory thresholds in Article 37 GDPR (we are not a public authority, and our core activities do not involve large-scale systematic monitoring or large-scale processing of special-category data). All data protection requests are handled by the privacy contact above. [TODO: confirm with a Spanish data-protection professional that no DPO obligation arises under LOPDGDD Article 34 for the relevant service categories.]

3. Personal Data We Collect

Depending on how you interact with us, we may process the following categories of personal data:

  • Identification and contact data: first and last name, email address, phone number, and messenger handles (WhatsApp, Telegram).
  • Immigration case data: information you provide so we can advise you — country of current residence, nationality, visa status, professional background, family composition, income range, and relocation timeline.
  • Engagement records: emails and messages exchanged with us, notes from consultations, and copies of supporting documents you share with us in the course of a residency application (such as passport scans, employment contracts, or criminal record certificates).
  • Technical data (collected automatically): IP address, browser type and version, device and operating system, referring URL, pages visited, time on page, interaction events, and cookie identifiers.

We do not intentionally collect special categories of personal data under Article 9 GDPR (data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation). If you voluntarily provide any such data in the context of an immigration matter, we will process it only with your explicit consent and only to the extent strictly necessary.

4. Purposes of Processing

  • Responding to enquiries submitted via the contact form, email, WhatsApp, or booking tools.
  • Providing immigration consulting services, including case strategy, document guidance, and filing support.
  • Entering into and performing a service agreement with you.
  • Sending service-related communications about your case or appointment.
  • Sending marketing communications — only where you have given separate, explicit consent.
  • Measuring website usage and improving content and user experience (analytics, subject to your consent).
  • Complying with legal, accounting, and tax obligations under Spanish law.

5. Legal Bases for Processing (Article 6 GDPR)

  • Consent (Art. 6(1)(a)): for analytics and performance cookies, for marketing communications, and for any special-category data you voluntarily share. You may withdraw consent at any time — see Section 9.
  • Performance of a contract (Art. 6(1)(b)): for delivering the consulting services you have engaged us for, and for steps taken at your request prior to entering a contract (e.g., a pre-contract consultation or booking).
  • Legal obligation (Art. 6(1)(c)): for invoicing, accounting records, and other retention obligations under Spanish tax and commercial law.
  • Legitimate interests (Art. 6(1)(f)): for keeping the Site secure, preventing fraud, and responding to direct enquiries from prospective clients. Our legitimate interests do not override your fundamental rights and freedoms. You may object at any time — see Section 9.

6. Recipients and Processors

We share personal data only with the following categories of recipients, each subject to appropriate contractual safeguards (Article 28 GDPR Data Processing Agreements where applicable). We do not sell personal data to third parties.

  • Hosting provider — to operate and serve the Site. [TODO: identify provider and confirm DPA in place]
  • Email provider — to send and receive correspondence. [TODO: identify provider (e.g., Google Workspace, Zoho) and confirm DPA]
  • Google Analytics 4 (Google Ireland Ltd) — to measure aggregated, pseudonymised usage of the Site. Activated only with your consent via the cookie banner.
  • Scheduling tool — to manage appointment bookings. [TODO: confirm provider (e.g., Calendly, TidyCal) and confirm DPA and data residency]
  • Messaging platforms (WhatsApp / Meta Platforms Ireland Ltd; Telegram FZ-LLC) — when you choose to contact us via these channels. We do not initiate unsolicited messages.
  • Spanish public authorities and immigration bodies — when filing a residency application on your behalf, with your authorisation.
  • Accountants and tax advisors — to meet our accounting and tax obligations under Spanish law.

7. International Data Transfers

Some of our processors (for example, Google and Meta) are based outside the European Economic Area (EEA), primarily in the United States. Transfers to such countries are protected by appropriate safeguards under Chapter V GDPR, including:

  • The EU–US Data Privacy Framework (adequacy decision adopted by the European Commission on July 10, 2023), where the processor is certified under that framework.
  • Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914).
  • Supplementary technical and organizational measures where required.

We monitor the legal status of the EU–US Data Privacy Framework and will update this Policy if the transfer mechanism changes. [TODO: confirm current, valid transfer mechanism for each processor — in particular for Google Analytics and WhatsApp/Meta — at time of publication.]

You may request details of the safeguards in place by writing to privacy@espanago.com.

8. Retention Periods

We keep personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law.

  • Enquiry data (submitted via forms, email, or chat without engaging us for a paid service): retained for up to 24 months from the date of last contact, then deleted or anonymised. [TODO: confirm this period with a data-protection professional]
  • Client case data: retained for the duration of the engagement and up to 6 years after closure, in line with Spanish tax and commercial retention requirements (Article 30, Código de Comercio). [TODO: confirm exact period with a Spanish accountant or tax advisor]
  • Accounting and invoicing data: 6 years (Article 30, Spanish Commercial Code).
  • Cookies and analytics data: retention periods are set out in the Cookie Policy.
  • Cookie consent records: [TODO: define retention period for consent-log records — typically 12–24 months]

When retention periods expire, data is either securely deleted or irreversibly anonymised.

9. Your Rights Under GDPR

Under GDPR Articles 15–22, you have the following rights in relation to your personal data:

  • Right of access (Art. 15): to obtain confirmation of, and a copy of, the personal data we hold about you.
  • Right to rectification (Art. 16): to have inaccurate or incomplete data corrected.
  • Right to erasure / "right to be forgotten" (Art. 17): to have your data deleted where one of the legal grounds applies.
  • Right to restriction of processing (Art. 18): to pause processing in certain circumstances (for example, while disputing accuracy).
  • Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
  • Right to object (Art. 21): to processing based on legitimate interests (including direct marketing and profiling) at any time. We will stop processing unless we can demonstrate compelling legitimate grounds.
  • Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to lodge a complaint with the competent supervisory authority. In Spain: Agencia Española de Protección de Datos (AEPD) at aepd.es. For users in the United Kingdom: Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of the above rights, please write to privacy@espanago.com. We will respond within one month of receipt (extendable by two further months for complex or numerous requests, with advance notice to you). We will not charge a fee for reasonable requests. We may verify your identity before processing a request.

For detailed instructions and to manage your cookie preferences, see the Your Data Rights page.

10. Cookies

The Site uses cookies and similar technologies. Strictly necessary cookies are placed automatically. Analytics and any marketing cookies are placed only with your prior, informed consent collected via the cookie banner shown on your first visit. We implement Google Consent Mode v2, which means analytics tags are blocked until consent is granted.

For the full list of cookies, their purposes, retention periods, and instructions on how to manage or withdraw your consent, see our Cookie Policy. You can update your preferences at any time on the Your Data Rights page.

11. Security Measures

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction, including:

  • HTTPS encryption in transit;
  • Access controls and authentication on systems that store personal data;
  • Regular review of processor contracts and data-security practices;
  • Confidentiality obligations for all personnel with access to personal data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours where required under Article 33 GDPR, and will inform affected individuals without undue delay where a high risk to their rights is likely (Article 34 GDPR).

12. Children's Data

Our services are directed at adults considering relocating to Spain. We do not knowingly collect personal data from children. Under LOPDGDD Article 7, the age of digital consent in Spain is currently 14 years. If you believe a child has provided personal data to us without appropriate consent, please contact us at privacy@espanago.com and we will promptly delete it. [TODO: confirm the applicable age threshold in force at publication — a proposed Organic Law may raise it to 16.]

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our data-processing activities, applicable law, or guidance from supervisory authorities. The current version is always available at espanago.com/guide/privacy.html with the revision date shown at the top of this page. Material changes will be communicated via a prominent notice on the Site or by email where required by law.

14. Contact

For any question about this Policy or about how we handle your personal data, please write to privacy@espanago.com [TODO: confirm this mailbox is active], or to our general inbox at hello@espanago.com.

For questions about your residency application or our consulting services, please use hello@espanago.com or WhatsApp.

← Back to home