Privacy Policy

Draft for your review. This is a GDPR-structured template. Before publishing, confirm the bracketed details with your legal adviser — the items marked […] are the only things that must be completed, and they're listed again at the foot of this page.

Last updated: [DATE]

1. Who we are

This website, spanishafterlife.com, is operated by [LEGAL ENTITY NAME], the data controller responsible for your personal data ("we", "us"). Our registered address is [REGISTERED ADDRESS, including the Spanish establishment]. You can reach us about privacy at [PRIVACY CONTACT EMAIL].

[If you have appointed a Data Protection Officer, name them and give their contact here. If not, delete this sentence.]

2. The data we collect

• Information you give us. Your email address when you subscribe; your name, email, location, and message when you complete an enquiry or consultation form; and anything you choose to tell us in correspondence.
• Information collected automatically. Standard technical data such as IP address, approximate location, browser type, and pages visited, where analytics are enabled.

3. How we use it, and our legal basis

• To send you our newsletter and guides — on the basis of your consent, which you give by ticking the box at signup and may withdraw at any time.
• To respond to your enquiry and provide our services — on the basis of taking steps at your request prior to a contract, and our legitimate interest in answering you.
• To understand and improve the site — where analytics cookies are used, on the basis of your consent.

4. Cookies and analytics

We use only the cookies necessary for the site to function unless you consent to more. If we enable analytics (for example, Google Analytics), we will request your consent first via a cookie banner, and you can decline without losing access to the site. [Confirm which analytics, if any, you use, and keep this in step with your cookie banner.]

5. Who we share it with

We do not sell your personal data. We share it only with service providers ("processors") who help us run the business, under contract and only as needed:

• [EMAIL / NEWSLETTER PROVIDER — e.g. the platform that stores your subscription and sends our emails]
• [FORM PROVIDER — the service that delivers form submissions to us]
• Our website host and content delivery provider (Cloudflare).
• [ANALYTICS PROVIDER, if any.]
• Our vetted legal, tax, and property partners — only where you ask us to progress your move, and only with what is necessary.

Some of these providers may process data outside the EEA (for example, in the United States). Where they do, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. [Confirm with each provider.]

6. How long we keep it

We keep newsletter data until you unsubscribe, and enquiry data for as long as needed to respond and for a reasonable period afterwards, then delete or anonymise it. [Set and state your specific retention periods.]

7. Your rights

Under the GDPR you have the right to access your data; to have it corrected or erased; to restrict or object to its processing; to data portability; and to withdraw consent at any time without affecting prior processing. To exercise any of these, email us at [PRIVACY CONTACT EMAIL] and we will respond within one month.

You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es, or with your local supervisory authority.

8. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised.

What I need from you to finalise this: the legal entity name and registered address; a privacy contact email; whether a DPO is appointed; the exact email/newsletter, form, and analytics providers you use; and your chosen data-retention periods. Have a lawyer confirm before you publish.