Privacy policy
Last updated: 26 October 2026 · Version 2026-10
This policy explains how the personal data of people who visit arraigospain.com, request a demo or use the agencies' private space is processed.
1. Data controller
Younes Sbai (NIF 08117733K), Calle Antonio Sedeño Cantos 4, 2.º D, 29640 Fuengirola (Málaga), España. Contact: info@arraigospain.com.
2. What data, why and on what basis
| Information or demo requests | Name, agency, email, phone or WhatsApp and the content of the message. To reply and, if you ask, arrange a demo. Basis: pre-contractual steps at your request (Art. 6.1.b GDPR). |
|---|---|
| Agency and team accounts | Name, email, role, access and a log of actions in the space (“who did what”). To provide the service and manage access and security. Basis: performance of the contract (Art. 6.1.b) and legitimate interest in service security (Art. 6.1.f). |
| Agency verification | Legal name, tax ID, address, manager's details and a document proving immigration work. To check that whoever publishes a diagnosis is a real professional. Basis: legitimate interest in preventing fraud against foreign nationals (Art. 6.1.f) and performance of the contract. |
| Billing (when the service is paid) | Tax and payment details. Basis: legal obligation (Art. 6.1.c). |
| Technical security | IP address, date and browser type in technical logs. To prevent abuse. Basis: legitimate interest (Art. 6.1.f). |
We do not use your data for third-party advertising, we do not sell it and we do not build commercial profiles.
3. How long we keep it
- Information requests: up to 12 months after the last contact if the service is not taken up.
- Account and verification: while the agency uses the service and then for the limitation periods of any liabilities.
- Billing data: the periods required by tax and commercial law.
- Sign-in links and sessions: 20 minutes and 30 days respectively; technical logs: up to 12 months.
4. Who can see the data
It is not shared with third parties unless the law requires it. We use providers that process data on our behalf under contract:
| Supabase | Database and files. Servers in the European Union. |
|---|---|
| Vercel | Website and functions hosting. Execution set to the European Union (Frankfurt). |
| Resend | Email delivery. Sent from the European Union (Ireland). |
| OVHcloud | Domain name and forwarding of the contact email. European Union. |
|---|---|
| Google (Gmail) | Inbox receiving emails sent to info@arraigospain.com. |
Some of these companies are based in the United States. Where data may be accessed from outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
If you message us on WhatsApp, that service is provided by WhatsApp/Meta under its own terms.
5. Your rights
You can request access, rectification, erasure, objection, restriction and portability by writing to info@arraigospain.com. You can also complain to the Spanish Data Protection Agency (www.aepd.es).
6. Security
Communications are encrypted (HTTPS), sign-in uses single-use links with no password that could be stolen, sessions and links are stored only as encrypted fingerprints, and verification documents are private and only accessible to Arraigo Spain's administration.