Privacy Policy

Who is responsible for your data

The data controller is [to complete: your full name or company name], [to complete: NIF/NIE or company number], [to complete: postal address]. Contact: hello@howtoliveinspain.com.

We follow the EU General Data Protection Regulation (GDPR) and Spain’s data protection law (LOPDGDD).

What we collect and why

Your account

When you create an account we collect your first name, email address and password. Your password is stored encrypted (hashed), so we can’t see it. We use this data to run your account. Legal basis: providing the service you asked for (GDPR article 6.1.b). We keep it until you delete your account.

Your progress, documents and photo

We store the checklist steps you tick, the documents you upload and attach to steps, and your profile photo, if you add one. Only you can open your files: they are stored privately, and each account can only reach its own folder. Legal basis: providing the service (6.1.b). We keep them until you delete them or your account.

Documents such as passports and residence cards contain personal data. Upload only what you need, and avoid uploading medical records unless a step requires them.

Newsletter

If you tick the newsletter box, or switch it on in your account, we use your email address and first name to send you our newsletter, and we record the date you agreed. Legal basis: your consent (6.1.a). You can unsubscribe at any time from any email or from your account.

Messages you send us

When you email us or use the contact form, we use your name, email and message to reply. Legal basis: our legitimate interest in answering you (6.1.f). We keep messages for up to 12 months after the conversation ends.

Purchases

Our digital products are sold through Gumroad and Etsy. They process your payment details; we never see your card. We receive your name, email and order details to deliver the product and answer questions. Legal basis: the contract (6.1.b) and our tax obligations (6.1.c). We keep order records for as long as tax and accounting law requires, generally up to six years.

Visit statistics

Our website host, Framer, counts visits without cookies and without identifying you. It hashes IP addresses with a key that changes every day, so visitors can’t be recognised over time. Legal basis: our legitimate interest in knowing which pages are useful (6.1.f).

Who we share data with

We don’t sell your data. We share it only with providers that help us run the site, under contracts that require them to protect it:

• Supabase: accounts, database and private file storage.

• Framer: website hosting and anonymous visit statistics.

• [to complete: your email provider, for example Brevo or MailerLite]: account emails and the newsletter.

• Gumroad and Etsy: sales of our digital products. They act as independent controllers under their own privacy policies.

When you click a link to a partner company, that company may record that you came from us. We don’t send them your name or email.

Transfers outside the EU

Some of our providers are based in the United States. Where data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

How we protect your data

• All traffic to the site is encrypted (HTTPS).

• Database rules let each account read and change only its own data.

• Uploaded files are stored privately and open through links that expire.

Your rights

You can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. You can withdraw consent at any time. You can do most of this yourself in your account: edit your details, remove documents or delete your account. For anything else, email hello@howtoliveinspain.com and we’ll reply within one month.

If you think we haven’t handled your data properly, you can complain to Spain’s data protection authority, the Agencia Española de Protección de Datos (aepd.es).

Children

Accounts are for people aged 14 or over, in line with Spanish law. If you believe a younger child has created an account, email us and we’ll delete it.

Changes

We’ll update this policy when our services or providers change, and show the new date at the top. If a change is significant, we’ll tell account holders by email.