Privacy policy

The data controller for all personal data processed through this website is:

Name: Relocasa

Contact email: privacy@relocasa.tech

We collect different types of data depending on how you use our services:

• •Eligibility checker: your name, email, phone number (optional), nationality, income range, family composition (number of adults and children), passport type, work tenure, and answers to immigration-related questions. Purpose: to assess which Spanish visa routes may fit your profile.
• •Free consultation form: your name, email, phone number, nationality, visa interest, timeline, and a brief description of your situation. Purpose: to match you with a legal expert and schedule a consultation.
• •Document workflow: identity documents (passport, ID card), criminal-record certificates, bank statements, tax declarations, and other documents required for visa applications. Purpose: to facilitate document collection and review by your assigned legal expert.
• •Payment data: processed by Stripe. We do not store full card numbers on our servers.
• •Account data: your name, email, and role if you create an account.

We process your personal data on the following lawful bases:

• •Consent: for marketing communications and optional WhatsApp reminders. You can withdraw consent at any time.
• •Contract: for processing your consultation requests, document workflow, and payments necessary to provide the service you requested.
• •Legal obligation: for keeping records required by tax and accounting regulations.

We share your personal data with the following processors, each acting under their own data processing agreements:

• •Base44 — platform infrastructure, database hosting, and backend services.
• •Stripe — payment processing and checkout. Stripe processes your card data under PCI-DSS compliance.
• •DocuSign — electronic signature of contracts and legal documents.
• •Google Workspace — email communications and internal productivity tools.

Your data may be transferred to and processed in countries outside Spain, including the United States, where data protection laws may differ from those applicable in your country.

Specifically: Base44 processes data in the European Union and the United States, Stripe in the United States and the European Union, and DocuSign in the United States and the European Union.

We rely on appropriate safeguards, including standard contractual clauses, for these transfers.

We retain your personal data for the following periods:

• •Eligibility checker data: 12 months from your last interaction with our platform.
• •Consultation and case data: 6 years from case closure (Spanish statutory limitation period).
• •Document data: 6 years from case closure.
• •Payment records: 7 years, as required by Spanish tax regulations.
• •Email communication logs: metadata (recipient, subject, status, timestamps) retained for 6 years; rendered email content (body HTML) is automatically stripped after 180 days.
• •Marketing data: until you withdraw consent or request deletion.

Under applicable data protection law (including the GDPR), you have the following rights regarding your personal data:

• •Access: request a copy of the data we hold about you.
• •Rectification: request correction of inaccurate or incomplete data.
• •Erasure: request deletion of your data (subject to legal retention obligations).
• •Restriction: request that we limit processing of your data.
• •Portability: receive your data in a structured, machine-readable format.
• •Objection: object to processing of your data for certain purposes, including marketing.
• •Withdraw consent: withdraw any consent you have previously given, at any time.

To exercise any of your rights, contact us at privacy@relocasa.tech with the subject line 'Data Rights Request'.

We will respond to your request within the timeframe required by applicable law (typically within one month).

If you wish to file a complaint, you may also contact the relevant data protection authority in your jurisdiction.

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security reviews.

Payment data is handled exclusively by Stripe, which is PCI-DSS compliant.

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@relocasa.tech.

We may update this privacy policy from time to time. We will notify users of significant changes by posting a notice on this page.

Last updated: 31 July 2026