1. Introduction

Enter Spain ("we", "us", "our") is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), and all applicable EU and Spanish data protection legislation.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform and services.

2. Data Controller

The data controller is Enter Spain, operating from Spain. For any data protection inquiries, you can contact us at: privacy@enterspain.com

3. Data We Collect

We collect the following categories of personal data:

• Identity Data: Name, surname, date of birth, nationality, gender, passport/ID number.
• Contact Data: Email address, telephone number, postal address.
• Financial Data: Employment status, income information, bank account details (when applying for banking services).
• Technical Data: IP address, browser type, device information, cookies, and usage data.
• Profile Data: Relocation preferences, completed steps, and service selections.
• Communication Data: Records of communications with our support team.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): When you explicitly consent to share data with our partners (e.g., banking or insurance referrals).
• Contractual Necessity (Art. 6(1)(b) GDPR): To provide the services you have requested through our platform.
• Legitimate Interest (Art. 6(1)(f) GDPR): To improve our services, ensure security, and prevent fraud.
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable laws and regulations.

5. How We Use Your Data

• To provide and manage our relocation assistance platform.
• To generate official forms (e.g., EX-15, EX-18) with your personal data.
• To connect you with trusted partner services (banking, insurance) with your explicit consent.
• To track your relocation progress and provide personalized recommendations.
• To communicate with you about your account and services.
• To improve and optimize our platform.
• To comply with legal obligations.

6. Data Sharing with Partners

We share your personal data with third-party partners only with your explicit consent. This includes:

• Banking Partners: When you submit a bank account application through our platform.
• Insurance Partners: When you request a health insurance quote.

We have data processing agreements in place with all partners to ensure your data is handled securely and in compliance with GDPR. Partners may only use your data for the specific purpose you have consented to.

7. AI-Assisted Processing

Certain internal processes may use AI-assisted tools to help process applications, generate forms, or provide relocation assistance. These tools operate under our supervision and are subject to the same data protection standards as all other processing activities. No automated decisions with legal or significant effects are made without human oversight.

8. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account data: For the duration of your account plus 2 years after deletion.
• Partner referral data: 3 years from the date of submission, unless the partner requires a different retention period.
• Form generation data: 1 year from generation date.
• Technical/analytics data: 26 months (anonymized after this period).

9. Your Rights

Under GDPR and LOPDGDD, you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
• Right to Restrict Processing: Request limitation of how we process your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@enterspain.com or use the data request form in your account settings. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls and authentication mechanisms.
• Regular security assessments and monitoring.
• Staff training on data protection.

11. International Transfers

Your data is primarily processed within the European Economic Area (EEA). If any transfer outside the EEA is necessary, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses approved by the European Commission).

12. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

13. Supervisory Authority

You have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a prominent notice on our platform. We encourage you to review this policy periodically.

15. Contact

For any questions regarding this Privacy Policy or your personal data, please contact:
Email: privacy@enterspain.com