Privacy policy

Who is responsible for your data

The data controller is Hola Money SL, CIF B26671347, registered at Calle Granada 7, 04820 Vélez-Rubio, Almería, España. You can reach us at [email protected], and our data protection contact at [email protected].

We are a private company preparing paperwork on your instructions. We are not the Policía Nacional, not Extranjería, and not acting on their behalf.

What we collect

Before you sign in: your name, email, phone, an indication of what your card says and when it expires, and anything you type into the notes field.

Once you start an application: images of your TIE, your passport and, where relevant, your padrón and evidence of a passport renewal; the details we read from them; and the answers you give to the questions the EX-23 requires — including your parents' first names, place and country of birth, and marital status, because the official form asks for them.

If you accept analytics cookies, we also collect usage data about how you moved through this site. If you reject them, we do not.

Why we are allowed to hold it

For preparing and submitting your renewal: performance of a contract with you, or steps taken at your request before entering one (Art. 6(1)(b) GDPR).

For analytics: your consent, freely given and just as freely withdrawn (Art. 6(1)(a) GDPR).

For our invoicing and accounting records: our legal obligations under Spanish tax and commercial law (Art. 6(1)(c) GDPR).

Your identity documents

Images of your TIE, passport and padrón are held in encrypted private storage. They are readable only by you and by the member of our team handling your application, and access is enforced by the database rather than by the website — knowing a file's address is not the same as being allowed to open it.

They are used to prepare your EX-23 and to check that the details match. They are not sold, not used for advertising, and not used to train any model.

Automated reading of your documents

To save you typing them, images of your TIE, passport and padrón are read automatically. Part of that reading is done by an artificial intelligence service: the image is sent to our AI processor, which returns the text it can see, and the image is then discarded by them.

We only use AI providers contracted on zero-retention terms. That means, in writing: they do not keep a copy of your document after the request, and they do not use it to train or improve any model. Our systems are configured to refuse to send anything at all if those terms cannot be guaranteed for a particular request — a request that cannot be routed to a zero-retention provider fails, and a person handles your document instead.

We route through OpenRouter, which selects a model provider operating under those terms. Tell us and we will confirm in writing which provider handled your application.

Some of those providers are outside the EEA. Where that is the case we rely on Standard Contractual Clauses, and we can tell you which apply to your case on request.

This is not automated decision-making. Nothing about your application is decided by a machine: every detail read from your documents is shown to you to confirm before it is used, anything the software is unsure of is flagged rather than assumed, and a person reviews anything that does not reconcile. You have the right not to be subject to a decision based solely on automated processing, and here there is no such decision to object to.

You can decline the automated reading and type your details in instead. It is slower, we will not charge you differently, and it changes nothing about the outcome.

Who else sees your data

The Policía Nacional and the Tesoro Público, because that is where a renewal application and a tasa payment go.

Our hosting, email, payment and appointment-booking providers, as data processors under written contract and only for the purposes described here.

Public authorities where we are legally required to disclose. We do not sell personal data and do not share it for anyone else's advertising.

How long we keep it

Identity document images: deleted once your renewal is complete and the period for querying it has passed.

Application records and the paperwork we generated: for the period in which a claim could still be brought.

Invoicing records: for the period Spanish tax law requires.

Analytics data: 14 months, or until you withdraw consent, whichever comes first.

Enquiries that never became applications: 12 months.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you can withdraw it at any time.

Write to [email protected]. We answer within one month. If we get it wrong you can complain to the Agencia Española de Protección de Datos (www.aepd.es), and we would rather you told us first so we can fix it.