Privacy Policy

Nomadly respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact our team, use our client dashboard or engage our immigration consultancy and case management services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679, the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, and other applicable data protection legislation.

The person responsible for the processing of your personal data is:

Depending on how you interact with Nomadly and the services you request, we may collect the following categories of personal information:

• Name and surname
• Email address and telephone number
• Country of residence, nationality and relocation information
• Passport, identity and immigration information
• Information relating to your employment, professional activity, income or financial means when required for your application
• Information concerning accompanying family members or dependants
• Visa, residency and immigration application information
• Documents uploaded through the client dashboard
• Information provided through questionnaires, forms, consultations or eligibility assessments
• Communications exchanged with Nomadly by email, through the dashboard or during meetings
• Billing, transaction and payment-related information
• Technical information necessary for the operation and security of our website and client dashboard

Payment card details are processed by our payment provider. Nomadly does not directly store complete payment card numbers or card security codes.

Some immigration procedures may require documents containing sensitive or particularly confidential information. We only request and process such information when it is relevant and necessary for the service requested.

We may collect personal information when you:

• Complete a contact, eligibility or onboarding form
• Schedule or attend a consultation
• Purchase or request one of our services
• Create or activate a client dashboard account
• Upload documents or information to your dashboard
• Contact us by email or through another authorised communication channel
• Make a payment through our payment provider
• Provide information during the preparation or management of your immigration process

We may also receive information from a family member, representative or professional acting on your behalf, provided that they are authorised to share that information with us.

We use personal information for the following purposes:

• To assess initial eligibility for our services
• To respond to enquiries and consultation requests
• To create and manage your client account
• To provide immigration consultancy and administrative case management services
• To review, organise and prepare documentation relating to your application
• To communicate with you about your case, documents, payments and next steps
• To process payments and maintain transaction records
• To manage customer support and resolve service-related issues
• To protect our website, dashboard, systems and users against misuse or unauthorised access
• To comply with accounting, tax, regulatory and other legal obligations
• To establish, exercise or defend legal claims where necessary
• To improve the operation, security and quality of our services

We will not sell your personal data.

We process personal data on one or more of the following legal grounds:

• Performance of a contract: when processing is necessary to provide the services you have requested or to take steps before entering into a service agreement.
• Consent: when you voluntarily provide information, request contact, authorise a particular use of your information or provide information relating to another person.
• Compliance with legal obligations: when processing is required for accounting, tax, regulatory or other legal purposes.
• Legitimate interests: when processing is necessary to operate, protect and improve our website, client dashboard, services and business, provided that your rights and interests do not override those interests.
• Legal claims: when information must be retained or processed to establish, exercise or defend a legal claim.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

We use trusted service providers to operate our website, client dashboard, forms, databases, communications and payment systems.

These providers may process personal data on our behalf only to the extent necessary to perform their services. Depending on how you interact with Nomadly, these providers may include:

• Website, application and client dashboard providers
• Database, hosting and cloud infrastructure providers
• Online form and appointment management providers
• Email and business communication providers
• Payment processing providers, including Stripe
• Professional advisers, accountants or technical support providers where necessary

Where appropriate, service providers act under contractual and data protection obligations.

We may also disclose information where required by law, by a competent public authority or for the establishment, exercise or defence of legal claims.

We do not share your immigration documents with external commercial partners for their own marketing purposes.

Some of our technology and service providers may process or store personal data outside Spain or the European Economic Area.

Where an international transfer takes place, we take reasonable steps to ensure that appropriate safeguards are used in accordance with applicable data protection law. These safeguards may include adequacy decisions adopted by the European Commission, approved contractual protections or other legally recognised transfer mechanisms.

Because our clients may be located outside the European Economic Area, communications and documents may also be accessed from the country in which the client is located.

We retain personal data only for as long as it is reasonably necessary for the purposes described in this Privacy Policy.

Documents and information used for the active management of an immigration case are retained while the service relationship remains active. Once the service has been completed or terminated, case documentation will be deleted from our active systems when it is no longer required, normally within a maximum period of 10 months.

Certain limited information may be retained for longer where necessary to:

• Comply with accounting, tax or other legal obligations
• Maintain records of payments and services provided
• Respond to complaints or regulatory requests
• Establish, exercise or defend legal claims
• Prevent fraud, misuse or security incidents

Information retained solely for legal or claim-related purposes may be restricted or blocked from ordinary use until the applicable retention period expires.

Once personal data is no longer required, it will be securely deleted or anonymised where appropriate.

Subject to the conditions established by applicable data protection law, you may exercise the following rights:

• Access: request confirmation of whether we process your personal data and obtain a copy of it.
• Rectification: request the correction of inaccurate or incomplete information.
• Erasure: request the deletion of personal data when there is no lawful reason for us to continue processing it.
• Restriction: request that the use of your information be temporarily limited in certain circumstances.
• Objection: object to processing based on legitimate interests in certain circumstances.
• Portability: request certain information in a structured, commonly used and machine-readable format where legally applicable.
• Withdrawal of consent: withdraw consent where consent is the legal basis for processing.

To exercise any of these rights, contact us at: Please provide sufficient information for us to identify you and understand your request. Where reasonably necessary, we may request proof of identity to protect your information against unauthorised disclosure.

We will respond within the period established by applicable data protection law.

You also have the right to lodge a complaint with the Spanish Data Protection Agency, known as the Agencia Española de Protección de Datos or AEPD, if you believe that your personal data has been processed unlawfully.

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.

These measures include access controls, authenticated client accounts, restricted administrative access, secure technology providers and procedures designed to limit access to personal data to those who need it for legitimate business purposes.

Clients are responsible for keeping their login credentials confidential and should contact us promptly if they believe that their account or personal information may have been compromised.

Although we take reasonable measures to protect personal information, no electronic transmission or storage system can be guaranteed to be completely secure.

Our website may use cookies and similar technologies to operate correctly, remember preferences, understand website usage and improve the user experience.

Detailed information about the cookies we use, their purposes and how you can manage your preferences is available in our Cookie Policy .

Our website, client dashboard or communications may contain links to websites, platforms or services operated by third parties.

Nomadly is not responsible for the privacy practices, security or content of third-party websites. We recommend reviewing the privacy policy of any external website or service before providing personal information.

Our services are intended to be contracted by adults.

Immigration applications may require information and documents relating to a client's spouse, partner, children or other dependants. The person providing this information confirms that they are authorised to do so.

Information relating to a minor must be provided by, or with the authorisation of, the minor's parent or legal guardian and will only be processed to the extent necessary to provide the requested service.

We may update this Privacy Policy from time to time to reflect changes to our services, technology, providers or legal obligations.

The latest version will always be published on this page. The date shown at the top of the policy indicates when it was last updated.

For questions about this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, contact: