legal notice and privacy policy

• For children under 14, personal data may only be processed when consent is provided or authorised by the holder of parental responsibility.
• For minors aged 14 to 17, consent may be provided by the minor or, where appropriate, by the holder of parental responsibility when the nature of the service or the processing requires parental authorisation.
• Individuals aged 18 and over are considered adults and provide their own consent.

We process personal data on the legal bases of consent, contractual necessity, and legal obligation, in accordance with Articles 6 and 7 of the GDPR and the LOPDGDD.

• Data Sharing Between Family Members: When services delivered by this Agency cover a family unit, you understand that personal data shared by one family member may be accessible by other family members. You agree to maintain the confidentiality of personal information and not disclose it.
  
  
• Third‑Party Service Providers
  “Third parties” refers to professional service providers engaged to deliver your contracted service(s). We will never sell or give your information to third parties; we will use it only to deliver the agreed service(s) that are sub‑contracted or where you have approved a referral or introduction. These providers may include commercial partners such as Legal, Translation, Insurance, or Accounting/Tax professionals. The Client consents to the transfer of their personal data to these providers, who will process the data in compliance with applicable data protection laws and regulations and are fully accountable for ensuring the lawful and secure processing of any personal data they handle.
  
  
• Transfers Required by Law
  We may also share personal data with Government authorities, public notaries, or other official bodies when required by law or when necessary to complete the contracted service(s).
  
  
• Tools and Platforms
  Software tools used by this Agency (such as scheduling, communication or e‑signature platforms) are not considered third‑party service providers, but they may process personal data as part of normal service delivery.Most of our tools and platforms process data within the European Union.
  
  Calendly: The only exception is Calendly, which may process scheduling‑related data in the United States. These transfers are protected through the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs). Calendly may also generate AI‑assisted meeting notes (such as summaries or action points). You will always be informed before any recording or AI note‑taking begins, and you may decline this either before the meeting or at the moment Calendly announces itself.
  
  We do not use automated decision‑making or profiling.
  
  
• Transparency for Contracted Clients
  Contracted clients may request a breakdown of the third‑party service providers involved in delivering their service(s), and we will provide this information upon request. This information is provided for transparency only and does not form part of the service selection or contracting process.

• Contact Details, for example: your name, address, email, contact details, national identity numbers
• Personal Details, for example: date of birth, gender, passport/identity/residency data, parents names, marital status, citizenship, financial information, criminal records history, employment details and history, client contracts, driving information, children’s personal details, relocation plans and timelines
• Information about the services you have contracted

• Mailing List: The Agency will email you with news and updates related to residency and visas, changes in the law, our services and our partners services, no more than one email will be sent per month.
• Renewal Reminder Service: When a residency or visa service has been completed you will be offered to opt-in to this free service. We will contact you by email and/or phone about 60-90 days before expiry. While we strive to provide timely reminders, we cannot guarantee that we will always be able to contact you. It remains your responsibility to ensure that your residency, visa or any other permit is renewed on time.

• We will create a secure folder for you and this Agency to share personal information and documents.
• The secure folder is protected by authenticated two factor security, this means the identity of the user is known. To access or upload documents or information requires the client to use the unique secure folder link and separately a one-time security code.
• When work is completed for the service(s) you accepted, the secure folder link will be deleted so it is no longer accessible to the client.

• Never share secure folder links or one-time password codes with others
• If you use a shared device or computer do not select the option to remember the one-time password for the secure folder link. This means you will be prompted for the one-time security code every time you want to access the secure folder. This is especially important if you are using a publicly accessible computer.
• Avoid sending us personal information and documents by email - instead use the secure folder we provide you or send the document / image securely via WhatsApp. WhatsApp uses end to end encryption to protect your privacy.
• Be alert to online fraud and “phishing”, where criminals try to trick you into giving personal information by pretending to be a trusted organisation.  Only trust emails sent from our official @helpathandspain.com address. If anything looks odd, check with us before replying.

• 1st May 2024: Version published on website.
• 19th February 2025: The Data Processing Agreement was updated to provide additional details on how we use and share your personal information, the types of information we collect and retain and when we will send you marketing. We also included a new clause on data breach notifications. We reduced the length of time we keep your personal information from 7 to 5 years.
• 9th July 2026: Renamed this section from Data Processing Agreement to Privacy Policy - Processing of Personal Data.   Included a new introduction section for context.  Restructured how personal data is processed, including the use of tools such as Calendly for scheduling and optional AI‑assisted meeting notes.  Separated out How you can keep your information secure from the Protecting Your Personal Information section for clarity.