Privacy Policy

~7 min read · Published 7 August 2026 Print / PDF

This policy describes how we, Ruta Residencia (data controller Aleksandr Nazarov), process the personal data of people who request a consultation, submit an application form, or use the dashboard on rutaresidencia.com. If you are already a client, this policy supplements the “Personal data protection” section of the service agreement rather than replacing it.

Version dated October 23, 2026.

Contents

• Who processes your data
• What data we collect
• Legal basis for processing
• Data of minors
• How we obtain data
• What we use data for
• Who data is shared with
• Storage and security
• Retention periods
• Your rights
• Cookies
• Changes to this policy
• Contact and complaints

Who processes your data

Data controller: Aleksandr Nazarov, autónomo, Gijón, Asturias, Spain. NIE: Y9160793E. Registered business address: Calle San Paulino 21, 33204 Gijón. Trading name: Ruta Residencia (rutaresidencia.com). Contact for data matters: [email protected].

What data we collect

Depending on the stage you are at (submitted an application form, registered a dashboard account, or already a client), we process:

• Identity data: first and last name, date of birth, nationality, passport or other ID document number and copy, NIE/TIE (if already issued), address, email, phone number.
• Employment and income data: type of employment, employer or clients (for cuenta propia), income statements, bank statements, tax returns, to the extent required by the specific procedure.
• Family composition data: information about a spouse, partner, or children, where the application covers a family, including documents proving the relationship.
• Immigration data: visa and residence permit history, entry and exit dates, status of ongoing procedures.
• Health data (special category): only where a specific procedure directly requires it (for example, a medical certificate confirming the absence of diseases with international relevance, for certain visa types). We process this data on the basis of your explicit consent, given by voluntarily providing the document, and use it solely for that procedure.
• Technical site data: IP address, browser and device type, and, when you use the dashboard, technical data needed for sign-in and session handling. Site visit statistics are kept without cookies and without identifying individual visitors (see the Cookies section).

We do not collect data unrelated to the consultation or procedure in question.

Legal basis for processing

Processing relies on one or more of the following legal bases under GDPR (art. 6):

• performance of a contract - where processing is necessary to enter into or perform an agreement with you (art. 6(1)(b));
• consent - for specific purposes where the law requires it, such as processing health data (art. 6(1)(a) and art. 9(2)(a) for special categories of data);
• legal obligation - where we are required by law to process data, for example when dealing with public authorities on your case (art. 6(1)(c));
• legitimate interest - in limited cases, such as protecting against fraudulent enquiries, provided this does not override your rights and interests (art. 6(1)(f)).

You may withdraw consent at any time where processing is based on it; this does not affect the lawfulness of processing carried out before withdrawal.

Data of minors

Under Spanish Law 3/2018 (LOPDGDD, art. 7), a person over 14 may give their own consent to the processing of their data; for children under 14, consent is given by a parent or legal guardian.

In practice, this does not affect how immigration procedures work: an application for a child of any age is filed by a parent or legal guardian acting on the child’s behalf under parental authority (patria potestad), who provides the child’s documents and is responsible for their accuracy.

How we obtain data

• through forms on the website (application, contact form);
• through the dashboard, where you upload documents yourself;
• through email correspondence, meetings, and calls.

What we use data for

• to advise you and respond to your enquiry;
• to prepare and file an application with the competent authority and pursue your case;
• to correspond with consulates, UGE-CE, provincial Extranjería offices, and other authorities on your case;
• to fulfil legal obligations (for example, tax record-keeping for our activity as autónomo);
• to respond to your questions about an already-filed case.

We do not use your data for advertising mailings and do not share it for third parties’ marketing purposes. If a newsletter on legal developments is introduced in the future, subscribing to it will require a separate, explicit consent and will not be covered by this policy.

Who data is shared with

Data is shared with third parties only to the extent needed to provide the service:

• the competent Spanish authorities and, where applicable, consular authorities, to review your case;
• sworn translators, where document translation is required;
• collaborating abogados (abogados colegiados), where court representation or other action reserved to them is needed (see the service agreement);
• technical providers that operate the website and dashboard: Cloudflare, Inc. (website hosting and cookie-free visit statistics, processed on the Cloudflare network in the EU and in other countries, with transfers outside the EEA based on the EU standard contractual clauses incorporated in the Cloudflare data processing addendum and on Cloudflare certification under the EU-US Data Privacy Framework), Supabase (database, authentication, and dashboard file storage) and Resend (system email delivery, processed on servers in the EU region, Ireland). All three providers process data under our instructions and do not use it for their own purposes.

We do not sell or rent out your data. If a specific transfer of data outside the European Economic Area requires additional safeguards (for example, the EU’s standard contractual clauses), we will put these in place before making that transfer.

Storage and security

Dashboard documents are stored on Supabase infrastructure with access controls: only your account and we, as the data controller, can see your documents, enforced through row-level security policies tied to your authentication. The connection to the website and dashboard is encrypted (HTTPS).

The dashboard database and files are hosted in the EU region (Frankfurt, Germany). A backup of the database and files is made once a day. Backups are kept in encrypted Cloudflare R2 storage under EU jurisdiction and are deleted automatically after 30 days.

The dashboard is not indexed by search engines.

Retention periods

We keep data no longer than needed for the purposes it was collected for, guided by the following:

• Case documents (correspondence, filed documents, procedure history) - for the duration of the service and a further 5 years after the case concludes. This period matches the general limitation period for personal actions under Spanish law (art. 1964 of the Spanish Civil Code, as amended by Law 42/2015) - during this period either of us may bring a claim relating to the service provided, and the documents need to remain available for that.
• Invoices and payment-related data - 6 years, as required by the Spanish Commercial Code (Código de Comercio, art. 30) for a sole trader’s accounting records.
• Health data, where collected, is deleted as soon as it is no longer needed for the specific procedure, and is not kept beyond that.
• Technical site data (contact-form enquiries that do not lead to an agreement) - up to 12 months, if you do not become a client.

Once the relevant period expires, data is deleted unless a longer retention period is required by mandatory Spanish law (for example, if a dispute is opened against us or you requiring documents to be kept longer than usual).

Your rights

Under GDPR and LOPDGDD you have the right to:

• access - find out what data of yours we process;
• rectification - request correction of inaccurate data;
• erasure - request deletion of data where there is no legal basis to keep it;
• restriction of processing - request that processing be temporarily restricted in certain cases;
• object - object to processing based on legitimate interest;
• portability - receive your data in an electronic format;
• withdraw consent - at any time, where processing is based on consent.

To exercise any of these rights, write to [email protected]. To confirm the request genuinely comes from you, we may ask for a copy of an identity document.

Cookies

The website uses only technically necessary cookies, without which dashboard sign-in (authentication, session) would not work. These cookies are not used for advertising or cross-site tracking. Visit statistics are collected with Cloudflare Web Analytics: no cookies, nothing written to your device, and no identification of individual visitors, so consent under article 22.2 of Law 34/2002 (LSSI) is not required for it. If analytics or marketing cookies are added to the site in the future, this policy will be updated and a consent banner allowing you to decline non-essential cookies will be added to the site.

Changes to this policy

We may update this policy, for example when the site’s services or the applicable law changes. The date of the current version is shown at the top of this document. For material changes affecting existing clients, we will notify you by email.

Contact and complaints

For any question about how your data is processed, write to [email protected]. If you believe your rights have been violated, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, aepd.es) or with the supervisory authority of your country of residence within the EU.

Author Aleksandr Nazarov