Privacy statement

1. Who we are

Costa Assist helps people moving to Spain with their NIE, residencia, car import, paperwork and more. We are responsible for processing your personal data as described in this privacy statement.

Company

Costa Assist (VOF, Dutch general partnership)

Address

Insulindestraat 63A01, 3038 JE Rotterdam, the Netherlands

Chamber of Commerce (KvK)

97346314

Email

info@costaassist.com

2. What data we process

• Contact details: name, email address, phone number and address.
• Data needed for your request or assignment, such as your date of birth, nationality, a copy of your passport or ID card, your NIE, details of family members, your marital status and your work or income situation. Sometimes documents such as bank statements or a rental or purchase contract are also needed.
• For car import and BPM refunds: your licence plate, your car's details, the registration certificate, the COC document and photos of your car.
• Health data only when a procedure requires it, such as a medical certificate when exchanging your driving licence. We only process it with your explicit consent and only for that application.
• When you log in to the client portal: when you log in and with what type of device and browser, to keep the portal secure.
• What you fill in on the forms on our website and in the chat.

Which data we need depends on the procedure. Without that data we cannot submit the application for you.

3. What we use your data for

• Answering your question or quote request. This is needed to enter into an agreement with you.
• Carrying out your assignment: starting procedures and applications and keeping you informed through the client portal. This is needed to perform the agreement.
• Issuing invoices and keeping our accounts. This is a legal obligation.
• Keeping the website and client portal secure and improving them. This is our legitimate interest.
• Sending you information about our services, such as a newsletter. We do not do this yet. If we start, we will only do it with your consent. You can withdraw your consent at any time.

We do not make decisions about you that are made solely by a computer.

4. Who we share data with

We never sell your data. We only share it when it is needed for your assignment or required by law. To carry out your assignment, this may include: Spanish government bodies (such as the police or extranjería, the town hall, the DGT, Hacienda and Seguridad Social), a gestoría, notary, garage or inspection station (ITV), translator or insurer. We only share what is needed and tell you in advance who receives it.

These service providers process data on our behalf, for the website, the client portal and our email:

Supabase

database and storage for the client portal, with servers in Ireland (EU)

Netlify

hosting of the website and client portal

Resend

sending emails from the website and portal

Google Workspace

our email

You use these services directly. Their own privacy statement also applies:

Calendly

booking an appointment with us; the calendar is on our contact page

WhatsApp (Meta)

when you contact us via WhatsApp

Google Fonts

the website's font; Google receives your IP address

RDW

looking up a Dutch licence plate; the RDW (Dutch vehicle authority) receives the licence plate and your IP address

Some of these parties are based in the United States. Data only leaves the EU with appropriate safeguards, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. Ask us if you want to know which safeguard applies to which party.

5. How long we keep data

Client and project data

up to 5 years after your last assignment is completed, after which we delete it

Quote requests and questions

up to 5 years after your request, after which we delete them

Documents and photos in the client portal

deleted automatically 2 months after your project is completed (if you send something after completion, 2 months after the upload)

Chat conversations on the website

90 days, after which they are deleted automatically

Invoices

7 years, as required by law

If you ask us to delete your data sooner, we will, except for what we are legally required to keep.

6. How we protect your data

We take appropriate technical and organisational measures against misuse, loss, unauthorised access and unwanted changes. The connection to our website and client portal is encrypted. Your documents are stored in the client portal behind a personal login, and only you and we can see them.

Do you think your data is not properly protected, or that there is misuse? Please contact us right away at info@costaassist.com.

7. Cookies

Our website does not use tracking or advertising cookies or analytics services. We only store what is needed for the site to work, such as your login and your language choice in your browser. If you scan the QR code on our business card or window sticker, we count it without personal data: only the language and the page. Our contact page shows the Calendly calendar; Calendly may set its own cookies there.

8. Your rights

Under the GDPR you have these rights:

• Access: know what data we hold about you and what we do with it.
• Rectification: have incorrect data corrected.
• Erasure: have your data deleted, except for what we are legally required to keep.
• Restriction: have the processing of your data restricted.
• Objection: object to the use of your data for certain purposes.
• Portability: receive a copy of your data in a common file format.
• Withdrawing consent: if we do something based on your consent, you can withdraw it at any time. What we did with your consent before that remains lawful.

Send your request to info@costaassist.com. We will respond within one month. To make sure the request comes from you, we may ask you to verify your identity.

9. Complaints

Not happy with how we handle your data? Please let us know first, so we can find a solution together. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Autoriteit Persoonsgegevens

10. Changes

We may update this privacy statement, for example when our services change. The date at the top shows when it was last updated.