Your data, handled the way I’d want mine handled.

Who is responsible for your data

Ioritz Uranga Galindo, attorney at law (abogado), is the data controller.  Contact: ioritz@spainnomadlawyer.com. Full identification details are in the Legal Notice.

What I collect, and why

• The assessment, the contact form and the tools that email you a result. Your name, email, phone if you give it, your answers or message, and which page or campaign brought you here.  I use them to reply and to prepare your written assessment.  Legal basis: your consent, given by a box you tick yourself, and the steps you ask me to take before a possible engagement.
• Follow-up emails. If you asked for an assessment and haven’t replied, I may write up to twice more.  Reply “stop” and I won’t.  Legal basis: the pre-contractual steps you started.
• Your case, if you engage me. Identity documents, criminal record certificates, employment and income records, bank certificates, qualifications, the details of family members who apply with you, and the personal details the official application form asks for (place of birth, parents’ first names, marital status, passport number and your address in Spain), which you type on your case page.  Legal basis: our engagement contract and the legal obligations that come with it.  Criminal record certificates are processed under article 10 of the GDPR and article 10.2 of Spain’s data protection law (LOPDGDD), which allows lawyers to handle the information clients give them to do their work.
• Family members. When you give me data about your partner or children for their applications, please show them this page.  They have the same rights as you.
• Signing and paying on your client page. When you sign the engagement letter I keep the name you typed, the time, your IP address and browser, and a fingerprint of the text you signed, as evidence of the signature.  Payments go through Stripe.  If you choose the success-fee model, Stripe keeps your card until the decision, and I ask Stripe to remove it if the application is refused.
• A review request. Three weeks after an approval I may ask you once for a review.  Legal basis: my legitimate interest.  Saying no, or saying nothing, ends it.

How I use AI

I use Claude, an AI model by Anthropic, as an assistant.  It prepares first drafts of my replies, sorts my inbox, gives a first read of how an enquiry fits the visa, gives documents you upload a first check (whether the apostille and dates look right), and answers my questions about a case.  I read, correct and decide everything myself.  Nothing is sent to you without me, and no decision about you is made by the AI. Anthropic processes this data under its commercial terms and does not use it to train its models.

What I never do

• No marketing lists or newsletters unless you explicitly ask for them.
• No selling or sharing your data with third parties for their own purposes.
• No advertising cookies unless you accept them.

Who receives your data

Only when your case needs it, and for that purpose:

• The Spanish authorities that decide your application, usually the Unidad de Grandes Empresas y Colectivos Estratégicos (UGE-CE) of the Ministry of Inclusion, or a Spanish consulate.
• A sworn translator on the Ministry of Foreign Affairs register, for the documents that need a sworn translation.
• A notary, apostille service or courier, when you use one I suggest.
• A tax adviser, only if you ask me to introduce you.

Service providers

These providers help me run the practice and act only on my instructions, under a data-processing agreement.  Those outside the EU rely on the EU–U.S. Data Privacy Framework where they are certified, and otherwise on the European Commission’s Standard Contractual Clauses.

• Vercel (US): hosts this website and the server that receives your forms, your uploads on the client page and your signature.
• Airtable (US): my case-management system, where enquiries and cases are recorded.
• Google Workspace (US): email, calendar, and the private folders that hold client documents.
• Anthropic (US): the AI assistant described above.
• Stripe (US): payments.  I never see or store your card number.
• Calendly (US): scheduling, only if I send you a booking link and you use it.
• Make (EU): automations I am replacing with my own server; while it runs it handles the same data.
• Google Analytics (US): visit statistics, only if you accept cookies.
• Ahrefs (Singapore): cookieless visit statistics.
• YouTube (US): only if you press play on the video on the home page.  Until then nothing loads from YouTube.

How long I keep it

If you don’t become a client, everything I hold about you is deleted 90 days after you write: your record, my notes and tasks, and our emails.  My monthly backups roll over after three months, so a deleted record is gone from every copy within that time.  Calendly keeps a booking under its own settings; ask and I’ll remove it there too.  You can ask me to delete everything sooner, at any time.

If you become a client, I keep your file while the case is open and for six years after it closes.  That is the period Spanish commercial and tax rules set for billing records, and it covers the time in which claims about the engagement can be brought.  Then it is deleted.

Cookies and similar storage

Here is everything this site stores on your device:

Vercel’s and Ahrefs’ statistics set no cookies and build no profile, and they don’t run on the assessment, client or admin pages.  You can change your choice at any time with “Cookie Preferences” in the footer.

Your rights

Under the GDPR you can ask for access to your data, its correction or deletion, a restriction of its use, a copy to take elsewhere, and you can object to its use.  Where I rely on your consent you can withdraw it at any time; that doesn’t affect what was done before.  Write to ioritz@spainnomadlawyer.com and I’ll handle it personally within the legal deadlines.  You can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos.

Last updated: 8 October 2026.