Privacy policy
Last updated: 14 September 2026
We explain what personal data we process, what for, for how long and who we share it with, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: YOU NOMAD, S.L.
- Tax ID (NIF/CIF): B24909160
- Address: Paseo de la Dirección, 169, piso 11, puerta 1112, 28029 Madrid (España)
- Data protection contact: privacidad@younomad.es
- Data Protection Officer: [TODO: name the DPO and their contact, or state that appointment is not required]
2. Data we process
Depending on your relationship with us, we may process:
- Identification and contact data: first name, surname, email address, telephone, preferred language.
- Account data: encrypted credentials, or your Google account identifier if you sign in with it.
- Case data: type of procedure, status, communications with your case manager or lawyer, appointments.
- Documents you upload: passport, contracts, proof of income, insurance, certificates and, where the procedure requires it, your criminal record certificate.
- Billing data: amount, date and payment reference. We do not store your card: Stripe processes it.
- Technical data: IP address, device type and access logs, for security purposes.
Data relating to criminal convictions and offences (article 10 GDPR) is processed only where the requested procedure requires it, with access restricted to the professional assigned to your case and to strictly necessary staff.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your user account. | Performance of a contract (art. 6.1.b GDPR). |
| Provide the case-handling service you contracted and communicate with you about it. | Performance of a contract (art. 6.1.b). |
| File your documentation with the authorities, including criminal record data where the procedure requires it. | Performance of the contract and, for article 10 GDPR data, compliance with a legal obligation within the administrative procedure. Your explicit consent is also collected when you upload it. |
| Take payment and issue an invoice. | Performance of the contract and legal obligation (art. 6.1.c). |
| Send you operational case alerts (document pending, status change, new message). | Performance of the contract. |
| Send you marketing communications about our services. | Consent (art. 6.1.a), withdrawable at any time from the unsubscribe link. |
| Prevent fraud and keep the platform secure. | Legitimate interest (art. 6.1.f). |
| Measure how the public site is navigated in order to improve it. Not applied inside your private area. | Consent (art. 6.1.a), given or refused in the cookie notice and changeable at any time. |
| Handle your rights requests and complaints. | Legal obligation (art. 6.1.c). |
4. Retention periods
- Account data: while your account is active and, after closure, for the limitation period of any potential liability.
- Case file and documents provided: during the procedure and, afterwards, for the statutory period applicable to the professional involved.
- Billing data: 6 years (article 30 of the Spanish Commercial Code) and the applicable tax periods.
- Access and security logs: 12 months.
- Data processed on the basis of your consent: until you withdraw it.
Once those periods elapse, data is deleted or blocked in accordance with article 32 of the LOPDGDD.
5. Recipients
Your data is shared with the firms, lawyers or registered case managers handling your file, who act as processors under a contract in accordance with article 28 GDPR, and with the competent public authorities where filing the procedure requires it.
We also use the following providers as processors:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and content delivery | USA / EU |
| Neon Inc. | Database | EU |
| Vercel Blob | Storage for the documents you upload | EU |
| Stripe Payments Europe, Ltd. | Payment processing | EU |
| Resend | Transactional email delivery | USA / EU |
| Google Ireland Ltd. | Sign in with Google (if you use it) | EU |
| PostHog | Analytics on the public site, only if you accept measurement cookies | EU |
Where a provider processes data outside the European Economic Area, the transfer relies on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated decisions, by writing to privacidad@younomad.es stating which right you are exercising. We may ask you to prove your identity.
If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (aepd.es).
7. Security
We apply appropriate technical and organisational measures: encryption in transit, role-based access control, an audit log of actions taken on case files, and storage of documents in restricted-access repositories. No measure removes risk entirely; should a breach occur that poses a high risk to your rights, we will notify you in accordance with article 34 GDPR.
8. Minors
The Site is not directed at children under 14. Where a procedure concerns minors — in a family reunification, for example — their data is provided by their legal representative.
9. Changes to this policy
We may update this policy to reflect legal or service changes. If a change is substantial we will tell you by email or through a prominent notice in the application. See also the Cookie policy.