Privacy Policy

Effective: from 31 May 2026
Based on: EU 2016/679 (GDPR) and Spanish Ley Orgánica 3/2018 (LOPDGDD)

1. Data Controller

Business name: Nora Blaha (Autónomo)
NIF: B22822803
Registered office: Avenida de los Limones 15, 03501 Benidorm, Spain
Email: nora@norasespana.com
Phone: +34 601 906 119
Website: www.norasespana.com

2. Data we process

At registration: name, email, password (hashed), language preference.

During onboarding: nationality, target city, relocation goals, family situation.

During the service: ID/passport (image), home and Spanish address, mother's and father's name, payment confirmations (Stripe), bookings (Microsoft Bookings), uploaded documents, chat with coordinator.

Technical data: IP address, browser, device, login timestamps, audit log.

3. Purposes of processing

• Provide the Service (relocation, NIE, property assistance) — contract performance (GDPR Art. 6(1)(b))
• Email notifications — contract performance
• Statutory accounting and tax obligations — legal obligation (GDPR Art. 6(1)(c)), 4-6 years retention
• Security and abuse prevention — legitimate interest (GDPR Art. 6(1)(f))
• Marketing (newsletter, only with consent) — consent (GDPR Art. 6(1)(a))

4. Data recipients / Sub-processors

• Render Inc. (USA) — hosting backend; EU data centre (Frankfurt); SCC + DPA
• Cloudflare Inc. (USA) — CDN, DNS, R2 storage; SCC + DPA
• Neon Inc. (USA) — PostgreSQL hosting; EU region; SCC + DPA
• Stripe Payments Europe Ltd. (Ireland) — payment processing; PCI-DSS Level 1
• Microsoft Ireland — Bookings, email, Teams
• Resend Inc. (USA) — transactional email; SCC + DPA

We never sell your data to third parties.

5. Retention

• Account data: until deletion request or 3 years of inactivity
• Documents: 6 years from case closure
• Audit log: 1 year
• Payment data: by Stripe according to PCI-DSS

6. Your rights (GDPR Art. 15-22)

You have the right to: Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17) — available directly in the app, Restriction (Art. 18), Portability (Art. 20), Object (Art. 21), Withdraw consent (Art. 7), Lodge complaint with the AEPD.

Request via email: nora@norasespana.com — we respond within 30 days.

7. Security

• Passwords stored as bcrypt hash
• Database encrypted at rest (Neon)
• Document storage encrypted (Cloudflare R2)
• HTTPS only (TLS 1.2+)
• Audit log on all admin operations

8. Cookies

We use only technical cookies necessary for the Service to function. No advertising cookies. No third-party tracking.

9. Automated decision-making

We do not use automated decision-making or profiling within the meaning of GDPR Art. 22.

10. Children

The Service is for natural persons aged 18+.

11. Changes to this Policy

We notify users of changes by email and within the App, at least 14 days before they take effect.

12. Applicable Law

Spanish law and EU GDPR. Disputes: Spanish court of the Controller's registered office, except consumer's home court.