Privacy Policy | movetosevilla.com

Last updated: July 24, 2026

1. Introduction

This Privacy Policy outlines how movetosevilla.com (“we”, “our”, or “us”) collects, uses, and protects your personal data when you visit our website or use our services. We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR) and Spanish data protection law (Ley Orgánica 3/2018).

2. Who We Are

movetosevilla.com is a Spanish visa and immigration consultancy run by a native Sevillian. We are the data controller responsible for your personal information.

You can contact us regarding your data and this privacy policy through our contact form or WhatsApp.

3. Data We Collect

We collect the following types of information:

Contact Information: When you submit a contact form, we collect your name, email address, and any information you provide in your message. If you contact me on WhatsApp instead, I also see the phone number you message from.
Consultation Information: When you request a consultation, we collect information about the type of visa you're interested in and your planned timeframe for moving to Spain.
Technical Information: We automatically collect certain technical information when you visit our website, such as your IP address, browser type, device information, and pages visited.
Cookie Information: We use cookies and similar technologies to enhance your browsing experience and analyze website usage. For more details, please see our Cookie Policy.
Advertising and Measurement Identifiers: If you reach our website by clicking a Google advertisement, Google appends a click identifier (gclid, gbraid, or wbraid) to the address. We store that identifier in your browser's local storage for up to 90 days and attach it to any enquiry you send, so we can tell which advertisement produced it. We also receive analytics and advertising identifiers through Google Analytics 4, including Google Signals data for visitors who are signed in to a Google account and have enabled personalised advertising.
Hashed Contact Details: When you submit an enquiry, your email address is converted in your browser into an irreversible SHA-256 hash and sent to Google alongside the conversion event. This is Google's “enhanced conversions” feature: it lets Google match your enquiry to the advertisement you clicked, and lets us build advertising audiences (Customer Match). Google receives the hash, never the plain-text address, but a hash of an email address is still personal data under the GDPR and is treated as such in this policy.

4. How We Use Your Data

We use your personal data for the following purposes:

To provide visa and immigration consultation services
To respond to your inquiries and communicate with you
To improve our website and services
To comply with legal obligations
To send service-related communications

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contractual Necessity: Processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract.
Legitimate Interests: Processing is necessary for our legitimate interests, such as improving our services and website, provided your interests and fundamental rights do not override those interests.
Consent: You have given us consent to process your personal data for specific purposes, such as sending marketing communications.
Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.

6. Data Storage and Security

We implement appropriate security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. We store your data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Client data related to visa applications is kept for the duration of our service relationship and for a period of 5 years afterward to comply with legal requirements and to support potential follow-up services.

7. Data Sharing

We may share your personal data with the following categories of recipients:

Service Providers: Third-party service providers who support our business operations, such as email services, web hosting, and customer relationship management systems.
Professional Advisors: Lawyers, accountants, auditors, and insurers who provide consultancy, legal, insurance, and accounting services.
Authorities: Government bodies, regulators, and other authorities when required by applicable laws and regulations.
Google: We use Google Analytics 4 and Google Ads. Google receives your usage data, advertising identifiers, and the click identifier described in section 3. Where you submit an enquiry, Google also receives the irreversible SHA-256 hash of your email address, which is used to (a) attribute your enquiry to the advertisement you clicked (“enhanced conversions for leads”) and (b) build and match advertising audiences (“Customer Match”). We have Google Signals and advertising personalisation switched on, which means Google may combine this data with the signed-in Google account of visitors who have enabled personalised advertising.
Microsoft: We use Microsoft Clarity for session recordings and heatmaps. Microsoft receives usage and device data. Text entered into forms is masked and is not captured.
Cloudflare: We use Cloudflare Turnstile to protect our forms from automated abuse. Cloudflare receives technical signals about your browser in order to distinguish humans from bots.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Google and Microsoft act as independent controllers for some of the advertising and measurement purposes described above; their own privacy notices govern that processing, and are linked from our Cookie Policy.

8. International Transfers

We primarily process personal data within the European Economic Area (EEA). If we need to transfer your personal data outside the EEA, we will ensure that appropriate safeguards are in place to protect your data, such as standard contractual clauses approved by the European Commission.

Some of the providers described in section 7 are based in, or transfer data to, the United States. Specifically, Google Analytics, Google Ads, and Microsoft Clarity involve transfers of personal data to Google LLC and Microsoft Corporation in the United States. These transfers rely on the providers' certification under the EU–U.S. Data Privacy Framework, supplemented by the European Commission's standard contractual clauses. You can request further information about these safeguards using the contact details in section 11.

9. Your Rights

Under data protection laws, you have the following rights:

Right to Access: The right to request a copy of the personal data we hold about you.
Right to Rectification: The right to request correction of any inaccurate personal data we hold about you.
Right to Erasure: The right to request deletion of your personal data in certain circumstances.
Right to Restrict Processing: The right to request restriction of processing of your personal data in certain circumstances.
Right to Data Portability: The right to receive your personal data in a structured, commonly used format and to transmit it to another controller.
Right to Object: The right to object to the processing of your personal data in certain circumstances, particularly for direct marketing purposes.
Right to Withdraw Consent: The right to withdraw your consent at any time where we rely on consent to process your personal data.

You can exercise these rights by contacting us. We will respond to your request within one month, as required by law.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or the supervisory authority in your country of residence.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated Privacy Policy on our website and update the “Last updated” date at the top of this policy. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us.