Privacy PolicyPolítica de Privacidad

2. Categories of Data Processed

2.1 Registration and Account Data

• Email address
• Password (stored as a cryptographic hash)
• Preferred language and account settings
• Account creation date and login logs

2.2 Profile Data

• First name and surname
• Date of birth
• Nationality
• Address in Spain and in the country of origin
• Telephone number (including the Spanish number provided for the provision of services)
• Passport and NIE details (numbers, issue and expiry dates, issuing authority)
• Place of work and occupation

2.3 Documentation Uploaded for the Provision of Services

Documentation necessary for the provision of the ordered services, which may include, depending on the order: passport, NIE, residence permit approval decision, municipal residence registration documents (empadronamiento), invoices and source documents for tax filings, lease agreements (for modelo 115), personnel and payroll documents (for modelo 111), requests from public authorities, and any other documents necessary for the performance of the engagement.

If, in the course of previously ordered services, Reglapp received documents relating to immigration procedures (including criminal record certificates or documents of family members, including minors), such documents continue to be stored and protected in accordance with sections 5 and 13 of this Policy until the expiry of the applicable retention periods.

2.4 AI Assistant Session Data

• Content of messages sent through the AI chat
• Session metadata (date, time, session identifier)
• Results of the informational assessment generated by the AI

2.5 Payment and Billing Data

• Legal or full name, NIF/NIE, fiscal address
• Services ordered, amounts, IVA, transaction date
• Payment processor transaction identifiers (full card details are not stored by Reglapp; they are processed by a PCI-DSS-certified payment provider)
• Data of invoices issued by the User through the Platform, including the data of the User's counterparties — for the generation and transmission of invoicing records in VERI*FACTU mode

2.6 Client File Data

• Notes, communications, and observations generated by the assigned professional
• Documents prepared in the course of providing the service (including modelo 036 and confirmation of alta in RETA)
• Case status and communications with public authorities

2.7 Technical and Usage Data

• IP address, device type, browser, operating system
• Pages visited, time of interaction with the platform
• Cookie identifiers, depending on the User's settings
• Technical logs for security and debugging

2.8 Identification and Verification Data (KYC)

• Photographs of both sides of the NIE, passport scan
• Photograph (selfie) holding the passport
• Video identification data and results, including biometric data processed during verification (section 3.2)
• Identity verification and sanctions screening results

2.9 Bank Details and Payment Mandates

• Spanish bank account number (IBAN)
• Certificate of bank account ownership
• SEPA mandate and the history of debits under it

2.10 Qualified Electronic Certificate

The User's electronic certificate, issued by the certification authority, is stored and used by Reglapp exclusively within the scope of the User's written authorization (Terms and Conditions, §8) — for the preparation and filing of applications and reports on the User's behalf.

3. Special Categories of Data (Art. 9 GDPR)

3.1 Immigration Status

Information about the User's immigration status in Spain (including residence permit decisions) may be regarded as a special category of data under the interpretation of Art. 9 GDPR. The legal basis for the processing is the explicit consent of the data subject (Art. 9.2.a GDPR), obtained separately at the time of registration or when ordering a service.

3.2 Biometric Data

During identity verification (KYC) through the provider Sumsub and during video identification for the issuance of the electronic certificate by the certification authority, biometric data may be processed (matching of the facial image against the document). The legal basis is the User's explicit consent (Art. 9.2.a GDPR), requested separately before verification begins. Refusal to give consent makes it impossible to provide services requiring identification.

3.3 Data Obtained in the Course of Previously Provided Services

Special categories of data and criminal record data obtained in the course of previously ordered immigration services continue to be processed exclusively for the purposes of storage and compliance with legal obligations, in accordance with Art. 9.2 GDPR and Art. 10 LOPDGDD, until the expiry of the periods in section 5.

The User may object at any time to the processing of the categories in section 3; the consequence will be the impossibility of continuing to provide the services that require such data.

4. Purposes of Processing and Legal Bases

• Creation and maintenance of the user account: §2.1 — performance of a contract (Art. 6.1.b)
• Provision of the ordered services (autónomo registration, tax filings, ongoing support): §2.2, §2.3, §2.6 — performance of a contract (Art. 6.1.b)
• Identity verification (KYC) and sanctions screening: §2.8 — performance of a contract (Art. 6.1.b) and compliance with legal obligations (Art. 6.1.c); biometric data — explicit consent (Art. 9.2.a)
• Transfer of data to the certification authority for the issuance of the electronic certificate: §2.2, §2.8 — performance of a contract (Art. 6.1.b) and consent
• Storage and use of the electronic certificate under the User's authorization: §2.10 — performance of a contract (Art. 6.1.b)
• Direct debit of social security contributions and SEPA debits: §2.9 — performance of a contract (Art. 6.1.b)
• Generation and transmission of invoicing records to AEAT (VERI*FACTU): §2.5 — compliance with a legal obligation (Art. 6.1.c)
• Processing of special categories: §3 — explicit consent (Art. 9.2.a) and/or Art. 10 LOPDGDD
• AI chat sessions: §2.4 — performance of a contract (Art. 6.1.b) + legitimate interest in improving the product (Art. 6.1.f)
• Invoicing and Reglapp's tax obligations: §2.5 — compliance with a legal obligation (Art. 6.1.c — Código de Comercio Art. 30, Ley General Tributaria)
• Communication with public authorities within the scope of the service: §2.2, §2.3, §2.6 — compliance with a legal obligation (Art. 6.1.c)
• Technical security and fraud prevention: §2.7 — legitimate interest (Art. 6.1.f)
• Commercial communications to existing clients about Reglapp's own products: §2.1, §2.5 — legitimate interest (Art. 6.1.f) — Art. 21.2 LSSI-CE
• Personalized marketing and transfers to commercial partners: §2.1, §2.7 — explicit and separate consent (Art. 6.1.a)
• Cookies and similar technologies: §2.7 — consent (Art. 22.2 LSSI-CE)
• Aggregated measurement of advertising effectiveness: §2.7 — legitimate interest (Art. 6.1.f); anonymous, aggregated server-side counting of clicks on advertising links, without profiling and without the use of IP addresses

5. Retention Periods

• Account data: for as long as the account remains active + 1 year after closure, unless a longer period is required by law.
• Client file and professional documentation: 5 years from the end of the service — in line with the professional civil liability periods and the general limitation period (Art. 1964 of the Spanish Civil Code).
• KYC data and verification results: 5 years from the end of the relationship, unless a longer retention period is required by applicable law.
• Payment data and invoices: 6 years (Art. 30 Código de Comercio); for tax limitation purposes — 4 years (Ley General Tributaria, Art. 66).
• VERI*FACTU invoicing records: for the periods established by tax legislation.
• SEPA mandates: 14 months after the last debit.
• Electronic certificate: for the period of validity of the certificate, or until the authorization is revoked or the contract is terminated — whichever occurs first.
• AI chat session content: 30 days after the end of the session, unless the User expressly requests longer storage or the content is included in the file.
• Marketing consents: for the duration of the consent + 3 years after withdrawal for evidentiary purposes.
• Technical logs and security data: 90 days.

Upon expiry of the retention periods, the data is securely deleted or anonymized.

6. Recipients and Categories of Recipients

6.1 Engaged Licensed Professionals

Licensed gestores administrativos and other professionals engaged by Reglapp under contract for the provision of services. They act on the basis of a Data Processing Agreement (DPA) under Art. 28 GDPR and receive the file data necessary for the provision of the service.

6.2 Technical Infrastructure Providers

• Hetzner Online GmbH (Germany) — hosting of data and servers in EU data centers.

6.3 Identity Verification Provider (KYC)

• Sum and Substance Ltd (Sumsub, United Kingdom) — identity verification and sanctions screening on Reglapp's behalf (processor). Transfers to the United Kingdom are covered by the European Commission's adequacy decision.

6.4 Certification Authorities (Issuance of Electronic Certificates)

• Uanataca — qualified trust service provider (Spain), issuance of qualified electronic certificates. For the issuance of the certificate, the certification authority processes the User's identification data as an independent controller in accordance with its own privacy policy.
• Reglapp may engage other accredited certification authorities, informing the User before the order is placed.

6.5 VERI*FACTU Technology Provider

• Bilbabit S.L. (Verifacti, Spain) — certified component for the generation and transmission of invoicing records to AEAT.

6.6 Artificial Intelligence Providers

• OpenAI, L.L.C. (USA) — processing of AI chat messages by language models; data sent via the API is not used for model training in accordance with OpenAI's current policy for API services.
• Google LLC (USA) — processing of AI chat messages by Gemini models.

6.7 Payment Provider

• Stripe Payments Europe, Limited (Ireland) — processing of card payments and SEPA direct debits. Full card details are processed directly by Stripe (PCI-DSS Level 1).

6.8 Analytics and Advertising

• PostHog Inc. (EU instance) — product analytics.
• Meta Platforms Ireland Limited (Meta Pixel) — advertising attribution, only with consent given via the cookie banner.
• TikTok Technology Limited (TikTok Pixel) — advertising attribution, only with consent.
• Google Ireland Limited (Google Ads) — advertising attribution, only with consent.

6.9 Commercial Partners (Marketing)

Subject to the User's explicit and separate consent, Reglapp may transfer contact details and a usage profile to selected categories of partners (tax and financial advisory, banking and insurance products, relocation services, telecommunications, housing). Reglapp does not transfer to partners file data, uploaded documents, or special category data. Consent may be withdrawn at any time in the account settings or at privacy@reglapp.com.

6.10 Public Authorities

AEAT (tax agency), TGSS (social security treasury), UGE, and other competent authorities — to the extent necessary for the provision of the ordered services and compliance with legal obligations.

6.11 Reglapp's Own Advisors

Reglapp's legal, tax, and accounting advisors, bound by confidentiality obligations.

7. International Data Transfers

Part of the processing may involve transfers outside the European Economic Area:

• Sum and Substance Ltd (United Kingdom) — the European Commission's adequacy decision for the United Kingdom.
• OpenAI L.L.C. (USA), Google LLC (USA), Meta Platforms, Inc. (USA, subject to consent), TikTok/ByteDance (USA/Ireland, subject to consent), Stripe, Inc. (USA, parent company of Stripe Payments Europe) — on the basis of the Standard Contractual Clauses (SCC, Decision (EU) 2021/914) and/or the EU–U.S. Data Privacy Framework where the provider holds certification.

The User may request a copy of the applicable safeguards at privacy@reglapp.com.

Recommendation: since AI chat conversations may be processed in the USA, do not share excessive confidential data through the chat; for sensitive matters, contact the assigned professional through the platform's secure environment.

8. Automated Decisions and Artificial Intelligence

• The AI chat is of a purely informational nature; its responses do not constitute legal, tax, or professional advice.
• Identity verification (KYC) may include automated stages (matching of the document and the facial image, screening against sanctions lists). A negative result of the automated check is not final: the User has the right to request human review of the decision, to express their point of view, and to contest the decision (Art. 22 GDPR) by contacting privacy@reglapp.com.
• Reglapp does not make decisions producing legal or similarly significant effects based solely on automated processing: all binding professional actions are reviewed by a human.
• In accordance with Art. 50 of Regulation (EU) 2024/1689 (AI Act), the User is expressly informed that they are interacting with an AI system.

9. User Rights

Under the GDPR and the LOPDGDD, the User has the rights of: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20), objection (Art. 21), the right not to be subject to solely automated decisions (Art. 22), and withdrawal of consent (Art. 7.3) — at any time and without retroactive effect on processing already carried out.

How to exercise these rights: send a request to privacy@reglapp.com stating the right being exercised and attaching a document proving the applicant's identity. The response time is up to one month; in complex cases, it may be extended by a further two months (Art. 12.3 GDPR).

The right to lodge a complaint with the supervisory authority — the Spanish Data Protection Agency (AEPD):

• Website: https://www.aepd.es
• Electronic office: https://sedeagpd.gob.es
• Postal address: C/ Jorge Juan, 6, 28001 Madrid

Before lodging a complaint, it is recommended to contact privacy@reglapp.com to seek a direct resolution.

10. Withdrawal of Consent

Where the processing is based on consent, the User may withdraw it at any time without affecting the lawfulness of the prior processing. Withdrawal of consent in relation to data essential for the provision of the service (special categories, biometrics for identification, transfer of data to the certification authority) may make it impossible to continue the service; Reglapp informs the User of the consequences before giving effect to the withdrawal.

11. Marketing and Commercial Communications

11.1 Communications About Reglapp's Own Products

Reglapp may send existing clients communications about its own products similar to those previously ordered, on the basis of legitimate interest (Art. 21.2 LSSI-CE). Unsubscribe via the link in each message or at privacy@reglapp.com.

11.2 Personalized Marketing and Partners

Only with explicit and separate consent (section 6.9). Withdrawal of consent does not affect the ability to use Reglapp's core services.

12. Cookies

The website uses first-party and third-party cookies in accordance with Art. 22.2 LSSI-CE. Strictly necessary cookies are set automatically; the rest only with consent given via the cookie management panel. Details are set out in the Cookie Policy (/cookies).

13. Security Measures

Reglapp has implemented technical and organizational measures appropriate to the risk of the processing (Art. 32 GDPR), including:

• encryption in transit (TLS 1.2+) and encryption at rest for sensitive data;
• storage of electronic certificates in a secure, encrypted environment, with access restricted to a limited number of authorized employees and logging of every use;
• exchange of documents and certificates with partners only through secure, agreed channels;
• cryptographic hashing of passwords;
• access control based on the "need-to-know" principle;
• storage of data in infrastructure located in the European Union (Germany);
• regular backups and recovery procedures;
• a record of processing activities (RAT) and internal incident response procedures;
• regular staff training.

In the event of a security breach posing a high risk to the User's rights and freedoms, Reglapp will notify the AEPD within 72 hours (Art. 33 GDPR) and, where necessary, the affected User without undue delay (Art. 34 GDPR).

14. Changes to This Policy

Reglapp may amend this Policy to adapt it to legislation or to changes in processing practices. The User is notified of material changes in advance by email or by a prominent notice on the platform. If a change affects processing based on consent, Reglapp will request new consent.

15. Languages

This Policy is published in Spanish, English, and Russian. In the event of any discrepancy, the Spanish version shall prevail.