Legal

Privacy policy

Last reviewed: 24/10/2026. This is an English translation; in case of discrepancy the Spanish version prevails.

Hola Papeles is not a law firm and does not give legal advice. We offer a document-management and preparation service. We therefore do not process your data to give you legal advice or to represent you before the authorities or the courts.

We apply Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

Controller

Juan Carlos Fernández Tapias Garcia Courel, self-employed (autónomo, natural person), tax ID (NIF) 51464655Q, Calle Ayala 27, 1º derecha, 28001 Madrid (Spain). Privacy contact: info@holapapeles.com.

Data protection officer

We have not appointed a data protection officer: our activity is not among the cases where it is mandatory (art. 37 GDPR and art. 34 LOPDGDD). For any privacy question, write to info@holapapeles.com.

What data we process and why

• Purchase (name, email, phone, nationality and province): to manage your order. Legal basis: performance of the contract.
• Procedure documents (passport, forms, receipts): to prepare your file. Legal basis: performance of the contract.
• Payment: processed by Stripe. We do not receive your full card details. We never send your documents to Stripe.
• Order record and consents (order number, procedure, amount, the boxes you ticked about starting early and their text version): to prove the information and consents required by consumer law. Legal basis: legal obligation.
• Withdrawals: to handle your withdrawal and refund and send you an acknowledgment. Legal basis: legal obligation.
• Contact form: to answer your enquiry. Legal basis: your consent.
• Invoicing and legal obligations: legal basis, legal obligation.

We do not request or process criminal record certificates or other criminal-offence data. If your procedure needs them, you deal with the authority directly. We only process health data when a procedure requires it (for example, proof of health insurance for the EU registration certificate or the EU family member card), with your explicit consent (art. 9(2)(a) GDPR), which you give in a separate, unticked box at checkout, only for that purpose, deleting it when the procedure ends. You can withdraw that consent at any time; if you do, we cannot prepare the part of the file that needs that document. See art. 10 GDPR and art. 10.3 LOPDGDD.

Procedures in our catalogue that may need such data: according to the official lists linked on each page, none of the six procedures requires you to give us a criminal record certificate (for the renewal, the authority checks records itself). The EU registration certificate (EX-18) and the EU family member card (EX-19) may require proof of health insurance.

Do you have to give us your data?

Yes, to buy. The checkout data and the documents we ask for are necessary to enter into and perform the contract. If you do not provide them, we cannot provide the service.

What we never ask for

Cl@ve passwords, digital certificates, PINs or verification codes.

Automated decisions

We do not make automated decisions or create profiles. The “Which procedure do I need?” assistant only points you to a page and does not save your answers.

Recipients and processors

We do not share your data with the authorities. You submit the application yourself. For procedures under RD 1155/2024, a person you choose can also submit it with valid authorisation (notarial or apud acta power of attorney, art. 197.4.a). The EU registration certificate and the EU family member card must be applied for in person (art. 12.1 RD 240/2007). We only use these providers. The data processing agreement (art. 28 GDPR) is, in each case, the provider’s standard terms:

International transfers

Stripe may transfer payment data to Stripe, Inc. in the United States, and Google may process the emails you send us in the United States. Safeguards: the EU-US Data Privacy Framework (European Commission adequacy decision of 10/07/2023) and the European Commission’s standard contractual clauses, under each provider’s standard terms. The website server and database are in Spain. For now we have no client area with document upload and no automatic emails; before enabling them we will name the provider here.

Waitlist

If you join the waitlist, we process your email (and, optionally, your name and the procedure you are interested in) to tell you when we open. Legal basis: your consent (art. 6(1)(a) GDPR), given in an unticked box and confirmed by email (double opt-in). You can withdraw it at any time with the link in every email, without affecting the lawfulness of prior processing (art. 7(3) GDPR). We do not send third-party advertising and we do not share your email.

Retention

We keep data only as long as needed for each purpose and, after that, only what the law requires, blocked and with restricted access (art. 32 LOPDGDD):

• Procedure documents (passport, forms, receipts): while the service lasts; deleted when it ends or if you withdraw. Basis: performance of the contract.
• Health data, if a procedure requires it: deleted when that procedure ends.
• Order data, consents, communications and withdrawals: while the contract lasts and then blocked for the limitation period for legal claims (5 years, art. 1964 Civil Code), only to deal with possible claims. Basis: legal obligation under consumer law and defence of claims.
• Invoices and accounting records: the period required by tax and commercial law (4 years, art. 66 General Tax Law; 6 years, art. 30 Commercial Code). Basis: legal obligation.
• Waitlist: until you unsubscribe or 12 months at most; unconfirmed sign-ups are deleted after 7 days.
• Contact form: up to 1 year after the last message, unless it leads to a contract.
• Webhook technical logs (payment event IDs): 90 days.

Your rights

Access, rectification, erasure, objection, restriction and portability. Where we process data based on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing (art. 7(3) GDPR). Write to info@holapapeles.com. You can also complain to the Spanish Data Protection Agency (AEPD).

Security

We apply technical and organisational measures appropriate to the risk (art. 32 GDPR): encrypted connection (HTTPS), a server in the EU with restricted access, and deletion of documents when the service ends. The website has no document upload area: we receive documents by email.