Policy on personal data processing

1. Who processes your data

For any question about your data, write to info@relotus-relocation.com with the subject line «Data protection». We have not appointed a Data Protection Officer (DPO): our activity does not fall within the cases in which Article 37 GDPR requires one.

2. What data we receive

From the forms on this site

There are four forms on the site. Each collects a different amount of data:

• The form under articles and on the reviews page — the subject of your enquiry and one contact detail: a Telegram handle, a WhatsApp number or an email address.
• «Free consultation» — your preferred means of contact and the contact detail itself.
• «Assess your relocation chances» — a contact detail, plus family composition, planned relocation date and approximate budget.

From our correspondence

Everything you tell us by messenger or email after your first enquiry: the circumstances of your relocation, your source of income, family composition, nationality. You provide this information voluntarily, and we ask you to send only what is genuinely needed for an answer.

From clients under a contract

If you enter into a contract with us, preparing your documents will require passport details, your NIE, information about income, certificates and other documents, the set of which depends on the procedure. We request them specifically and only to the extent necessary.

Automatically when you visit the site

IP address, browser and device type, pages viewed, referral source, cookie identifiers. See section 9 for details.

3. Why we process it and on what legal basis

Once the period expires, the data is deleted or blocked for the time during which a claim may still be brought against us, and destroyed at the end of that period.

4. Who we share data with

We do not sell your data and do not pass it on for third-party advertising. Access is given only to those without whom the service would not work:

• Website hosting — Beget, servers in Russia. Stores the site content and technical logs.
• Email provider — runs the mailbox that receives submissions from the forms.
• Yandex.Metrica (Yandex LLC, Russia) — visit statistics.
• Google Ireland Limited — Google Analytics and Search Console through the Site Kit plugin.
• Telegram and WhatsApp — if you have chosen to correspond by messenger, that correspondence passes through their servers on their terms.

With service providers that process data on our instructions we enter into agreements under Article 28 GDPR.

5. Client reviews

The site publishes video reviews by clients — showing their face, voice and name. This is personal data, and we publish it only with the explicit consent of the person concerned, given separately and specifically for that purpose. Consent is voluntary; refusing changes nothing and has no effect on the terms of our work with you.

If you recorded a review and have changed your mind, write to info@relotus-relocation.com — we will take it down from the site within a few working days and will not ask why. We have no control over copies that third-party platforms may have saved by then.

Client documents — decisions on applications, certificates, correspondence with authorities — are published only fully anonymised and only with separate consent.

6. Transfers of data outside the European Economic Area

Some of the services we use are located outside the EEA. Here is which ones and what that means.

• Russia. The site hosting (Beget) and the servers of Yandex.Metrica, our visit counter, are located there. Site content, technical logs and anonymised statistics pass through them. There is no European Commission adequacy decision in respect of Russia, so European safeguards do not apply there directly. We are moving the processing of enquiries to European infrastructure and will update this section once the move is complete.
• United States. Certain Google services. The transfer is made on the basis of the EU–US Data Privacy Framework adequacy decision.
• Messengers. Telegram and WhatsApp process correspondence under their own policies, over which we have no influence.

7. Your rights

Under the GDPR you may at any time request:

• Access — to find out what data of yours we hold and to receive a copy of it.
• Rectification — to correct inaccurate or incomplete information.
• Erasure — to delete data that is no longer needed for the purpose it was collected for.
• Restriction of processing — to freeze the data while a disputed point is being resolved.
• Objection — to object to processing based on legitimate interest.
• Portability — to receive the data in a machine-readable format or to ask us to transmit it to another controller.
• Withdrawal of consent — to analytics cookies, at any time and without giving reasons. Withdrawal does not affect the lawfulness of processing carried out before it. Our answer to your enquiry is not conditional on consent: we process the data because you asked us for help — but you may at any time ask us to stop the correspondence and delete it.

Write to info@relotus-relocation.com with the subject line «Data protection» and tell us what exactly you want. So as not to disclose your data to someone else, we may ask you to confirm your identity. We will reply within one month; if the request is complex, that period may be extended by a further two months — in which case we will tell you and explain why.

The right to erasure is not unconditional. If you have been our client, we keep the case materials for five years after the contract ends, in case of a dispute about what was done and how. Everything else we delete on first request.

If you are not satisfied with our answer, you have the right to lodge a complaint with the Spanish supervisory authority — the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You do not have to contact us before complaining, but it is usually quicker.

8. How we protect data

The site runs over HTTPS. Access to the mailbox receiving enquiries is protected by two-factor authentication and is limited to the staff who correspond with clients. Client documents are stored separately from general correspondence. We regularly delete what is no longer needed.

Absolute protection does not exist. If a breach occurs that is likely to create a risk to your rights, we will notify the AEPD within 72 hours and, where the risk is high, you personally as well.

9. Cookies

Cookies are small files that a website stores in your browser.

• Technical. Needed for the site to work: the language you selected, the state of the consent banner, protection of forms against automated submission. These are set without consent, because the site does not function without them.
• Analytics. Yandex.Metrica and Google Analytics — they show which pages are read and where visitors come from. These are set only after your consent in the banner.
• We do not use advertising cookies.

You can decline in the banner on your first visit. To change your decision later, clear the site’s cookies in your browser settings, after which the banner will appear again. Declining analytics cookies has no effect on your access to the content of the site.

10. Minors

The site and the services are intended for adults. We do not knowingly collect data of persons under 14 — the age from which Article 7 LOPDGDD allows consent to be given independently. Data of children who are part of a family is processed only within the scope of a contract and only as provided by their parents or legal representatives.

11. Changes to this policy

We update this document when the set of services or the way we process data changes. The current version is always available at relotus-relocation.com/en/privacy/, and the version date is shown at the top of the page. If a change affects your rights, we will note it on the page itself.