Privacy policy

1. Data controller

ALDEVORA GESTIÓN EMPRESARIAL, S.L.
NIF: B-88867726
Calle San Antonio, 3 Bajo - 30530 Cieza (Murcia), España
Tel.: +34 601 688 159
Email: admin@gestionatuspapeles.es

Registered in the Murcia Commercial Registry, Section 8, Sheet MU-120592, 1st entry. GestionaTusPapeles.es is a brand of this company.

2. What data we process

• Identification and contact data: first name, surname, NIE, passport, nationality, date of birth, phone, email and address.
• Your case data: procedure, the answers you give us, status, fees and official case number.
• Documents you submit through the app (as PDF): passport, contracts, certificates, reports and any other documents your application requires.
• Technical app data: a random device identifier, the platform (Android / iOS), the language you choose and the date of your last access. If you turn on notifications, also your phone's notification code.

The app does not use advertising or third-party analytics, and it does not track you across other apps or websites.

3. Particularly sensitive data

Some immigration procedures require documents containing specially protected data: criminal record certificates, medical reports, proof of status as a victim of gender-based or sexual violence, or data about family members, including minor children.

We only process them when your procedure requires it, if you give us your explicit consent in the engagement letter, and solely to prepare and submit your application. Access is limited to the person handling your case and reinforced security measures apply. You can withdraw that consent at any time, although we will then be unable to continue with the part of the procedure that needs those data.

If you provide data about family members, you must inform them of this processing.

4. Purposes and legal basis

• Managing and submitting your immigration application and keeping you informed of its status: performance of the service contract (Art. 6.1.b GDPR).
• Criminal records, health data, victim status and data about minors: your explicit consent, given by signing the engagement letter (Art. 9.2.a GDPR) and the mandate you grant us for your procedure (Art. 10 GDPR).
• Keeping your identity and residence documents for your next renewal: our legitimate interest in providing that service without asking for them again (Art. 6.1.f GDPR); you may object.
• Linking your phone with a QR or access code and keeping your session secure: performance of the contract (Art. 6.1.b GDPR).
• Answering your enquiries before you hire us: your consent and pre-contractual steps (Art. 6.1.a and 6.1.b GDPR).
• Complying with legal obligations (tax, accounting and record-keeping): legal obligation (Art. 6.1.c GDPR).
• Notifying you on your phone of updates on your application: your consent, given when you turn on notifications; you can withdraw it at any time in your phone settings (Art. 6.1.a GDPR).
• Letting you know when the application window for a procedure opens, if you leave us your details for that on the website: your consent (Art. 6.1.a GDPR).
• Camera use: only when you activate it to scan the access QR code or your documents. You can withdraw the permission at any time in your phone settings.

5. Who we share it with

• The competent authorities (Immigration Offices, Secretary of State for Migration and other bodies) when we submit your application on your behalf.
• If a registered lawyer, administrative agent (gestor administrativo) or labour-law adviser (graduado social) is needed to submit your case file, we will share only the essential data with them, as provided in your engagement letter.
• Providers of technical services acting under a data processing agreement: Euronodes (app server, European Union), DonDominio (website and email, Spain) and Lleida.net (electronic signature of the engagement letter, Spain). We do not sell your data or share it for commercial purposes.
• The Instituto Cervantes, if you need to be registered for the nationality exams (DELE and CCSE).
• Payments are processed, depending on the method you use, by Stripe (Stripe Payments Europe, Ireland) or by BBVA through Redsys (Spain), which act as independent controllers to handle the payment and prevent fraud. We never see your full card details.
• If you turn on app notifications, Expo (which provides our notification service), Google (Firebase, on Android) and Apple (on iPhone) receive your phone's notification code and a text containing no details of your application, and may process them in the USA under the EU-US Data Privacy Framework.

Your documents and case data stay within the European Economic Area. If you choose to write to us on WhatsApp, Meta processes those messages in the USA under the EU-US Data Privacy Framework; always use the app to send documents.

6. How long we keep it

• Documents for your procedure: up to 1 year after the final decision on your case file, to handle any appeals. They are then securely deleted. Criminal record certificates are deleted as soon as your case file is decided, because they expire within a few months and cannot be reused for another procedure.
• Identity and residence documents (passport, TIE and birth certificate): up to 5 years from the decision on your last procedure, so we can prepare your next renewal (usually after 4 years) without asking for them again. You can object at any time by writing to admin@gestionatuspapeles.es; they are then deleted one year after the decision. Criminal records and health data are never kept for this purpose.
• Invoicing data: 6 years, as required by law.
• Enquiries that do not lead to a contract: deleted after one year.
• Details you leave so we can tell you when an application window opens: deleted one year after we notify you.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to admin@gestionatuspapeles.es with your full name. We will reply within one month at the latest.

If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es · +34 901 100 099).

8. Security

All communication between the app and our servers is encrypted (HTTPS). Your phone’s access is stored in the device’s secure storage; our servers only keep an encrypted fingerprint of it. Documents are not public: only authorised staff with a username and password can view them. We make daily backups on servers in the European Union.

9. Deleting your account

You can delete your account from the app (My account → Delete account permanently) or by following the instructions on the “Delete my account” page. Access is revoked immediately on all your devices. Your documents are blocked and deleted when the retention period in section 6 ends; if that period has already ended, they are deleted straight away.

10. Minors

The app is not intended for minors. If your application requires documents about dependent children (for example, for family reunification or to prove their school enrolment), you provide them as their parent or legal guardian, with your explicit consent.

11. Changes to this policy

If we change this policy, we will publish the new version on this page with the update date.