Privacy Policy

Identity of Data Controller

The party legally responsible for the processing of your personal data is:

At Move Spain Visa, we are fully committed to protecting your personal data and respecting your privacy. This Privacy Policy outlines how we collect, use, share, and protect your data in compliance with the EU General Data Protection Regulation (GDPR, EU 2016/679), which governs our processing activities under Spanish law.

We act in two distinct capacities that may involve different data processing: (i) as an immigration document-preparation and advisory service, and (ii) as ASISA's exclusive insurance agent. Where a specific rule applies only to the insurance mediation activity, this is stated explicitly below.

Legal Basis for Processing

We process your personal data primarily under the legal basis of the Execution of a Contract (Art. 6.1.b of the GDPR) in order to provide and manage the immigration advisory services you contract. For sending marketing communications, we rely on your Explicit Consent (Art. 6.1.a).

Where we process your data to arrange an ASISA insurance policy, the legal basis is likewise the Execution of a Contract (the insurance policy) together with your Explicit Consent for the processing of health data required to underwrite and administer that policy, as insurance mediation involving health data requires specific consent under Art. 9 GDPR.

What personal data do we collect?

• Identification and contact details: name, email, phone number
• Special Categories of Data (Sensitive Information): passport, criminal records, marital status, health certificates, etc.
• Information shared during consultations, forms, or video calls
• For insurance mediation: health-related information required by ASISA to issue and administer a policy (e.g., health declarations), and policy/payment details relevant to the insurance contract

Legal Basis for Sensitive Data: The processing of immigration-related sensitive data is strictly necessary for the management of applications in the public interest (visas) and is based on your Explicit Consent for us to prepare your immigration file before the Spanish authorities. Health data processed for insurance mediation purposes is based on your separate Explicit Consent given at the time of requesting an ASISA quote or policy.

Financial Data: When you purchase our immigration services, payment information (such as the last four digits of your card, billing address, and transaction details) is collected and processed by our third-party payment processor, Stripe. We do not store or have direct access to your full credit card number. Insurance premiums are paid directly to ASISA and are not processed by Move Spain Visa's own payment systems.

How do we use your data?

• To assess your visa eligibility and advise on strategy
• To review, prepare, and organize documentation
• To provide referrals to third-party providers (sworn translators, legal advisors, tax advisors, etc.)
• To arrange and administer an ASISA insurance policy on your behalf, in our capacity as ASISA's exclusive agent

Important: We are not lawyers or tax professionals. Any guidance on tax implications is based on general information only. Definitive legal or fiscal advice is provided by referred, certified professionals. Similarly, we are not an independent insurance broker: as ASISA's exclusive agent, any insurance-related guidance relates to ASISA products only.

Data storage and security

We implement appropriate technical and organizational measures (such as encryption and access control) to protect your data. We use a secure environment through Google Workspace and our Client Portal for document management and communication. These platforms meet international security standards.

Client Responsibility: While we use a secure Client Portal for sensitive documents, the responsibility of protecting your Client Portal credentials and avoiding the submission of sensitive documents via unencrypted channels (such as standard email) rests with the user. We are not liable for any data breaches resulting from misuse of email or client portal credentials.

All sensitive financial information relating to our immigration services is handled directly by Stripe and is subject to their advanced security protocols, ensuring that your data is protected against unauthorized access. Data relating to insurance mediation, including health declarations, is transmitted directly to ASISA through their designated agent channels.

Sharing your data (Third-Party Data Processors and Recipients)

Your data is shared only when:

• You explicitly authorize it
• It is necessary to complete a task you requested (e.g., contacting a translator, or arranging an ASISA policy)

Our Data Processors for the immigration services (e.g., sworn translators) are contractually obligated to comply with the GDPR through formal agreements. We do not perform international data transfers outside the European Economic Area (EEA) unless the client explicitly requests it and a protective data agreement is signed. We do not sell, rent, or commercially distribute your personal data under any circumstances.

ASISA: where you request an insurance quote or policy, your data (including health data where relevant) is transmitted to ASISA, Asistencia Sanitaria Interprovincial de Seguros, S.A.U., which is the Data Controller of your data for the whole insurance relationship. Because Séfora Villa Camacho acts as ASISA's exclusive agent rather than an independent broker, for this activity she acts as ASISA's Data Processor under article 203.1.a) of Royal Decree-law 3/2020, processing your data under ASISA's instructions to prepare your quote and application. ASISA's own privacy policy, available at asisa.es, governs its processing of your data as controller.

External collaborators (insurance mediation): As part of our insurance mediation activity, we work with external collaborators (colaboradores externos) under article 137 of Royal Decree-law 3/2020, who may refer prospective clients to us. These collaborators act as our Data Processors under article 203.1.c) of Royal Decree-law 3/2020 and have no access to your personal, financial, or health information. If one of them referred you to us, they receive only limited pseudonymised administrative information about your case, necessary for traceability and settling their referral fee (such as an internal reference, date, status, net premium, and fee amount), without names, full policy numbers, or health data.

For Payment Processing (immigration services): We share transaction data and billing information with Stripe, Inc., to successfully process your payments. Stripe acts as an independent Data Controller for the information it processes. You can review their Privacy Policy at: stripe.com/privacy

Additional Third-Party Processors:

• MailerLite: used to manage email marketing communications. Privacy policy at: mailerlite.com/legal/privacy-policy
• Meta (Facebook Pixel): used to measure advertising effectiveness. Only activates with your cookie consent. Privacy policy at: facebook.com/privacy/policy

Website usage analytics

If you accept analytics cookies in CookieYes, we use Microsoft Clarity to understand how visitors interact with this website. Clarity provides aggregated interaction maps and session recordings, such as clicks, scrolling and page navigation, so we can improve our pages. The Clarity script is not loaded until you accept analytics cookies.

You can change or withdraw your analytics choice through the CookieYes preferences panel. We configure Clarity to hide page content in recordings and do not install it on the external Client Portal. Microsoft explains how it processes data in its privacy statement: privacy.microsoft.com

Data retention and deletion

We adhere strictly to the principle of data minimization and only retain your data for as long as legally required or necessary to provide our services. Once this legal period has concluded, your data will be permanently deleted.

• Sensitive Data Deletion: Sensitive immigration documentation (passports, criminal records, etc.) will be deleted from our Client Portal within a maximum of 30 days after the service is completed or cancelled.
• Mandatory Retention: We will retain contact data, invoices, and communication records for a period of 4 years to comply with our tax, legal, and auditing obligations under Spanish law.
• Insurance Mediation Records: Data processed in our capacity as ASISA's exclusive agent (quotes, applications, communications with ASISA) is retained for the periods required under Spanish insurance distribution regulations, which may exceed the 4-year period above. Data held by ASISA as controller of your policy is retained according to ASISA's own retention policy.

Your GDPR rights

Regardless of your nationality or country of residence, you have the right to:

• Access, correct, or delete your personal data
• Request data portability
• Restrict or object to the processing of your data
• File a complaint with a data protection authority (AEPD in Spain)

Please Note: Your right to deletion is subject to legal and fiscal limitations. We cannot delete data (such as invoices and records of service provision) that we are legally required to retain under Spanish law (minimum 4 years), nor can we delete data ASISA is separately required to retain as controller of your policy — such requests relating to your policy should also be directed to ASISA.

You can exercise any of these rights over data held by Move Spain Visa by contacting us at: info@movespainvisa.com