This policy explains what personal data XtraSpain collects, why, how it is used, and your rights under the General Data Protection Regulation (GDPR) and UK GDPR.
1. Who we are
XtraSpain is operated by [TODO-PLACEHOLDER: legal name], NIF [TODO-PLACEHOLDER], based at [TODO-PLACEHOLDER: address], Spain. Contact: hello@xtraspain.com.
2. What data we collect and why
Email address (via Kit / ConvertKit)
When you request the free guide or subscribe to updates, we collect your email address. This is processed by Kit (ConvertKit, LLC, USA). Lawful basis: consent. You can unsubscribe at any time via the link in any email.
Payment data (via Lemon Squeezy)
When you purchase a product, payment is processed by Lemon Squeezy (the merchant of record). XtraSpain does not receive or store your card details. Lemon Squeezy's privacy policy applies to payment processing.
Order data and documents (partner services)
When you order a Done for You service (sworn translation, background check coordination, Arrival Pack), you submit documents to the relevant vetted partner directly. XtraSpain acts only as introducer. The partner processes your documents under their own privacy policy. We do not store your documents. Documents shared with a partner are deleted within 90 days of the order being closed.
Visa Match tool
The Visa Match tool runs entirely in your browser. No personal data is sent to our servers unless you choose to email yourself the summary (via Kit). If you do, only your email address is stored by Kit.
Website analytics
[TODO-PLACEHOLDER: analytics provider and policy]. We use a cookieless analytics tool. No personal identifiers are stored.
3. Cookies
See our Cookie Policy.
4. Data sharing
We share data only with the processors listed above (Kit, Lemon Squeezy, vetted service partners) and only as necessary to deliver the service you requested. We do not sell your data.
5. International transfers
Kit is based in the USA. Data transfers are covered by standard contractual clauses. Lemon Squeezy is the merchant of record and operates under its own transfer safeguards.
6. Retention
Email addresses are retained until you unsubscribe. Order-related documents shared with partners are deleted within 90 days of order closure. We do not store payment or card data.
7. Your rights
Under GDPR and UK GDPR you have the right to access, correct, delete, restrict, or port your data, and to withdraw consent at any time. To exercise these rights, email hello@xtraspain.com. You also have the right to lodge a complaint with the relevant supervisory authority (AEPD in Spain, ICO in the UK).