Privacy Policy

Last updated: 29 May 2026

1. About this Policy

This Privacy Policy explains how EspanaGo ("we", "us", "our") collects, uses, stores, and protects personal data when you visit espanago.com (the "Site") or engage us for immigration consulting services.

We process personal data in accordance with Regulation (EU) 2016/679 (the EU General Data Protection Regulation, "GDPR"), the UK GDPR, and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"). By using the Site, you confirm you have read and understood this Policy.

2. Data Controller

  • Controller: EspanaGo (operated by Andrey Rodionov, autónomo, Valencia, Spain)
  • Address: Valencia, Spain (full postal address available on request)
  • Email for privacy matters: privacy@espanago.com
  • General contact: hello@espanago.com

We have not appointed a statutory Data Protection Officer (DPO) because our processing does not meet the thresholds in Article 37 GDPR. The contact above handles all data protection requests.

3. Categories of Personal Data We Process

Depending on how you interact with us, we may process the following categories of personal data:

  • Identification and contact data: first and last name, email address, phone number, messenger handles (WhatsApp, Telegram).
  • Immigration case data: information you provide so we can advise you — country of residence, nationality, current visa status, professional background, family composition, income range, target relocation timeline.
  • Engagement records: emails and messages you send us, notes of calls, copies of identity and supporting documents required for a residency application (passport scans, employment contracts, criminal records, etc.).
  • Technical data (collected automatically): IP address, browser type and version, device and operating system, referring URL, pages visited, time spent, interaction events, cookie identifiers.

We do not intentionally collect special categories of personal data (Article 9 GDPR) such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. If you provide such data voluntarily as part of an immigration matter (for example, health-related information for a non-lucrative visa), we will process it only with your explicit consent and to the extent strictly necessary.

4. Purposes of Processing

  • Responding to enquiries submitted via forms, email, WhatsApp, or Telegram.
  • Providing immigration consulting services, including case strategy, document preparation, and filing support.
  • Entering into and performing a service agreement with you.
  • Sending service-related communications about your case.
  • Sending marketing communications — only where you have given separate, explicit consent.
  • Measuring website usage and improving content and user experience.
  • Complying with legal, accounting, and tax obligations under Spanish law.

5. Legal Bases for Processing (Article 6 GDPR)

  • Consent (Art. 6(1)(a)): for analytics cookies, marketing communications, and for processing special categories of data you voluntarily share.
  • Performance of a contract (Art. 6(1)(b)): for delivering the consulting services you have engaged us for and for steps taken at your request prior to entering a contract.
  • Legal obligation (Art. 6(1)(c)): for invoicing, accounting, and retention obligations under Spanish tax and commercial law.
  • Legitimate interests (Art. 6(1)(f)): for keeping the Site secure, preventing fraud, and analysing aggregated traffic data. Our legitimate interests do not override your fundamental rights and freedoms.

6. Recipients and Processors

We share personal data only with the following categories of recipients, each bound by appropriate contractual safeguards (Article 28 GDPR Data Processing Agreements where applicable):

  • Hosting provider — to operate and serve the Site.
  • Email provider — to send and receive correspondence with you.
  • Analytics providers (e.g., Google Analytics, Microsoft Clarity) — to measure aggregated, pseudonymised usage. Activated only with your consent.
  • Messaging platforms (Telegram FZ-LLC, WhatsApp LLC / Meta Platforms Ireland Ltd) — when you choose to contact us via these channels.
  • Spanish public authorities — when filing an immigration application on your behalf, with your authorisation.
  • Accountants and tax advisors — to meet our accounting and tax obligations.

We do not sell personal data to third parties.

7. International Data Transfers

Some of our processors (for example, Google, Microsoft, Meta) are based outside the European Economic Area, primarily in the United States. Such transfers are protected by appropriate safeguards under Chapter V GDPR, including:

  • European Commission adequacy decisions where applicable (e.g., the EU–US Data Privacy Framework).
  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Supplementary technical and organisational measures where required following the Schrems II ruling.

You can request a copy of the safeguards in place by writing to privacy@espanago.com.

8. Retention Periods

  • Enquiry data (data submitted via forms, email, or chat without engaging us): kept up to 24 months from last contact, then deleted or anonymised.
  • Client case data: kept for the duration of the engagement and up to 6 years after closure, in line with Spanish tax and commercial retention requirements.
  • Accounting and invoicing data: 6 years (Article 30 of the Spanish Commercial Code).
  • Cookies and analytics data: retention periods are listed in the Cookie Policy.

When retention periods expire, data is either securely deleted or irreversibly anonymised.

9. Your Rights Under GDPR

You have the following rights in relation to your personal data:

  • Right of access (Art. 15): to obtain confirmation of, and a copy of, the personal data we hold about you.
  • Right to rectification (Art. 16): to correct inaccurate or incomplete data.
  • Right to erasure / "right to be forgotten" (Art. 17): to have your data deleted where one of the legal grounds applies.
  • Right to restriction of processing (Art. 18): to pause processing in certain circumstances.
  • Right to data portability (Art. 20): to receive your data in a structured, machine-readable format.
  • Right to object (Art. 21): to processing based on legitimate interests, including profiling, and to direct marketing at any time.
  • Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before withdrawal.
  • Right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or your local supervisory authority.

To exercise any of these rights, write to privacy@espanago.com. We will respond within one month (Article 12(3) GDPR), extendable by two further months for complex requests. Detailed instructions and a request template are on the Your Data Rights page.

10. Cookies

The Site uses cookies and similar technologies. Strictly necessary cookies are placed automatically; analytics and marketing cookies are placed only with your consent collected via the cookie banner. See our Cookie Policy for the full list and management instructions.

11. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:

  • HTTPS encryption in transit;
  • Access controls and authentication on systems storing personal data;
  • Regular review of processor contracts and security practices;
  • Confidentiality obligations for all personnel with access to data.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours and, where required, inform affected individuals without undue delay (Articles 33–34 GDPR).

12. Children's Data

Our services are directed at adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. The current version is always available at espanago.com/privacy/ with the revision date at the top. Material changes will be communicated via the Site.

14. Contact

For any question about this Policy or how we process your personal data, write to privacy@espanago.com.

← Back to home