Data processing agreement
Last updated: 26 October 2026 · Version 2026-10
This agreement is entered into between the agency that accepts it in its private space (the Controller) and Younes Sbai, NIF 08117733K, of Calle Antonio Sedeño Cantos 4, 2.º D, 29640 Fuengirola (Málaga), España (the Processor), under article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It forms part of the terms of use and is accepted electronically: acceptance is recorded with the date, the person and the version.
1. Subject matter
The Processor processes, on behalf of the Controller, the personal data of people who take the Controller's immigration diagnosis, for the sole purpose of providing the Arraigo Spain service: displaying the diagnosis, receiving and storing contact requests, notifying the Controller, sending people their diagnosis when they ask for it by email, and allowing the Controller to manage and follow them up in the private space.
2. Duration
For as long as the Controller uses the service. On termination, clause 11 applies.
3. Data and data subjects
| Data subjects | The Controller's prospective clients who take the diagnosis; members of the Controller's team. |
|---|---|
| Identity and contact details | Name (if given), phone or WhatsApp, email, language. |
| Diagnosis answers | Nationality, age (in ranges), administrative and residence status, arrival or residence dates, family, work, study or financial situation (in ranges), goal and timeframe. |
| Follow-up data | Contact status, internal notes, assigned person and history of team actions. |
| Data not collected | The diagnosis does not ask about criminal records, expulsions or sanction proceedings: it only records, if the person indicates it, that there is “a point to review with a professional”. No health data or other special categories are collected. |
4. The Controller's instructions
The Processor processes the data only on the Controller's documented instructions, namely those in this agreement and the settings the Controller configures in its space. If it considers an instruction unlawful, it will say so immediately. It will not use the data for its own purposes, sell or share it, or use it to train systems or for advertising. In particular, it will not contact the Controller's prospective clients or offer them any services, its own or third parties'.
The Processor does not access the Controller's space unless the Controller expressly authorises a support access, limited to 7 days. During that access, contact details and notes stay hidden and every visit is logged and visible to the Controller.
5. Confidentiality
The Processor and anyone working for it with access to the data are bound by confidentiality, including after the agreement ends.
6. Security
The Processor applies, among others, the following measures (Art. 32 GDPR):
- Data hosted in the European Union and encrypted in transit (HTTPS/TLS) and at rest.
- Sign-in through single-use links valid for 20 minutes; 30-day sessions stored only as encrypted fingerprints and revoked when access is removed.
- Separation of each agency's data; option for each team member to see only their own contacts.
- Log of team actions on each contact.
- Hiding of the contact details of people who have not consented to be contacted.
- Database access only from the server, with service keys never sent to the browser.
7. Sub-processors
The Controller gives general authorisation for the following sub-processors, with which the Processor has contracts imposing equivalent obligations:
| Supabase | Database and files. Servers in the European Union. |
|---|---|
| Vercel | Website and functions hosting. Execution set to the European Union (Frankfurt). |
| Resend | Email delivery. Sent from the European Union (Ireland). |
The Processor will inform the Controller by email of any change of sub-processor at least 15 days in advance; the Controller may object and, failing a solution, cancel at no cost. Where a sub-processor based outside the European Economic Area may access the data, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses.
Services the Controller itself chooses to use with its clients (WhatsApp, its calendar, its payment provider, its email) are not sub-processors.
8. Data subjects' rights
The Processor will help the Controller respond to requests for access, rectification, erasure, objection, restriction and portability. If a person contacts the Processor, it will forward the request to the Controller without delay and in any case within 5 working days.
9. Personal data breaches
The Processor will notify the Controller of any security breach affecting its data without undue delay and at the latest 48 hours after becoming aware of it, with the information available so that the Controller can, where applicable, notify the supervisory authority within 72 hours.
10. Cooperation and audit
The Processor will make available to the Controller the information needed to demonstrate compliance with this agreement and will cooperate with any required impact assessments or prior consultations. Audits will be agreed with reasonable notice and at the expense of the party requesting them.
11. End of processing
When the service ends, the Controller has 30 days to request an export of its data. After that, the Processor will delete the data and its copies within a further 90 days at most, unless the law requires it to be kept blocked.
12. The Controller's obligations
The Controller guarantees that it has a legal basis for the processing, informs people through its diagnosis privacy policy (generated by the service with its details), handles their rights and decides how long to keep contacts in its space.