Controller
Eduard Pinedo, founding lawyer of HolaResidency, who practises as a self-employed lawyer, Carrer de Rocafort, 202, entresuelo 4ª, Barcelona. Privacy contact: [email protected].
What data we process
- Contact and eligibility enquiries: your name, email and the message you send us.
- Account data: name, email and password (stored only as a hash).
- Matter data: identification and contact details, nationality, passport and other identity documents, and the documents needed for the application (for example, employment, income, health insurance, criminal records, family or tax information), as required by the procedure you instruct us on.
- Engagement letter signature evidence: typed name, timestamp, IP address, browser user agent and a fingerprint of the signed text.
- Correspondence with you and with the administrations that handle your application.
- Billing data. Card payments are processed by Stripe; we do not store card numbers.
Purposes and legal bases
- Answering your contact or eligibility enquiry — your consent and the steps you ask us to take before entering into a contract (Art. 6(1)(a) and (b) GDPR).
- Managing your client account and the matters covered by your engagement letter, including preparing and filing applications on your behalf — performance of a contract (Art. 6(1)(b) GDPR).
- Billing and collecting fees — performance of a contract and legal obligation (Art. 6(1)(b) and (c) GDPR).
- Complying with our legal obligations, including accounting, tax and anti-money-laundering rules that apply to lawyers — legal obligation (Art. 6(1)(c) GDPR).
- Keeping records of the engagement and of what was filed in order to defend against possible claims — legitimate interest (Art. 6(1)(f) GDPR).
- Where special categories of data are needed for an application (for example, health data), they are processed because they are necessary to establish, exercise or defend your legal claims (Art. 9(2)(f) GDPR) and only to the extent the procedure requires.
Visit statistics
To know how the website is used (which pages are visited, in which language, from which website or campaign visitors arrive, and how many people take the next step), we keep anonymous, aggregated visit statistics on our own server, without cookies and without storing or reading anything on your device.
For each page view or step we record only: the page (without parameters or identifiers), the website language, the domain of the site you came from (not the full address), any campaign tags in the link (utm_source, utm_medium, utm_campaign), the device type (mobile, tablet or computer, deduced from your browser and then discarded), the date and, where relevant, a short code such as the service clicked or the route suggested by the eligibility check. We do not store your IP address, your browser's user agent, any identifier or anything you type in forms, so the statistics cannot be linked to you or combined into a profile. Your IP address is only used momentarily, in memory, to protect the service against abuse.
Legal basis: our legitimate interest in measuring and improving the website (Art. 6(1)(f) GDPR). The statistics stay on our own server (Arsys, servers in Spain), are not shared with anyone and are deleted after 400 days. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is recorded. You may object at any time by writing to [email protected].
Recipients
When we file an application on your behalf, we disclose to the competent public administration (consulates, immigration offices, police, tax agency, Social Security or other bodies) only the data the procedure requires.
Processors acting on our instructions: Arsys Internet S.L.U. (hosting, servers in Spain), Stripe Payments Europe Ltd. (payments) and our email service provider. We do not sell your data or use it for advertising.
International transfers
As a rule, your data stay in the European Economic Area. Only where Stripe needs to process payment data outside it does a transfer take place, covered by the safeguards Stripe applies (the EU–US Data Privacy Framework and the European Commission's standard contractual clauses).
Retention
Contact enquiries that do not lead to an engagement are deleted once answered, within a reasonable period. Active matters are kept while the engagement lasts. Closed matters, the engagement letter, signature evidence and uploaded documents are kept for 36 months after closing to handle possible claims, and then deleted. Data subject to a legal retention period (accounting, tax or anti-money-laundering records) are kept for as long as the law requires. Anonymous visit statistics are deleted after 400 days.
Professional secrecy
Everything you share with us about your matter is also covered by the lawyer's duty of professional secrecy, which continues after the engagement ends.
Security
Access to the platform is restricted by role and authenticated, and every access by our team to your matter and its files is logged.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to [email protected]. Some data cannot be erased while a legal retention period applies. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country of residence.