Privacy Policy | Next Move Spain

Next Move Spain ("we", "us", "our") operates the website and platform at nextmovespain.com (the "Service"). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).

This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over your data.

1. Data Controller

Next Move Spain is the data controller for the personal data processed through this Service. For any privacy-related enquiries, contact us at privacy@nextmovespain.com.

2. Personal Data We Collect

2.1 Data you provide directly

Account data: name, email address, and password when you register.
Profile data: visa type, country of origin, target city, move date, family size, employment status, and budget — provided during onboarding or when using our tools.
AI assistant conversations: the questions and messages you submit to our AI-powered relocation assistant.
Documents: files you upload (e.g. passport copies, certificates) for document tracking and checklist features. These are stored securely and only linked to your account.
Communication data: if you contact us via email, we retain the content of your messages.

2.2 Data collected automatically

Usage data: IP address, browser type, device information, pages visited, time on page, and referral URLs.
Cookies and similar technologies: see our Cookie Policy for details.

2.3 Payment data

When you purchase a Premium subscription, payment processing is handled by Stripe Payments Europe, Ltd. We do not store your full card details — Stripe tokenises and securely processes all payment information. We receive only the last four digits of your card, card brand, billing country, and subscription status. Stripe processes data in accordance with PCI-DSS standards.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

Contractual necessity (Art. 6(1)(b) GDPR): to create your account, provide the Service, and fulfil your subscription.
Consent (Art. 6(1)(a) GDPR): for non-essential cookies, analytics tracking, and AI processing of your inputs where applicable.
Legitimate interests (Art. 6(1)(f) GDPR): for platform security, fraud prevention, and service improvement, provided your rights do not override these interests.
Legal obligation (Art. 6(1)(c) GDPR): to comply with tax, accounting, and other legal obligations.

4. How We Use Your Data

To create and manage your user account.
To generate personalised relocation plans, document checklists, timeline tasks, and location recommendations using AI.
To process subscription payments and manage your Premium access.
To send service-related communications (e.g. account verification, security alerts).
To analyse usage patterns and improve our features and content.
To detect, prevent, and respond to fraud, security issues, or technical problems.

5. AI Processing

We use artificial intelligence (AI) and large language model (LLM) services to power features such as the relocation assistant, plan generation, document checklists, and location matching. When you submit information to these features, it is processed by our AI provider to generate responses. We do not use your personal data to train AI models. Your AI conversation history is linked to your account and may be used to improve your personalised experience.

6. Data Sharing and Recipients

We do not sell your personal data. We share data only with the following categories of recipients:

Stripe: payment processing and subscription management.
AI/LLM providers: to generate AI-powered responses (only the data necessary for the request is transmitted).
Analytics providers: aggregated and pseudonymised usage data for platform improvement.
Cloud infrastructure providers: hosting, storage, and database services.
Legal authorities: where required by law or to protect our rights and safety.

Some processors may be located outside the EU/EEA. In such cases, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

Account data: for the lifetime of your account. Deleted upon account closure.
AI conversations and generated content: linked to your account and removed when you delete the content or close your account.
Uploaded documents: retained until you delete them or close your account.
Payment records: retained as required by tax and accounting laws (typically 4–6 years).
Usage and log data: retained for up to 24 months unless a longer retention period is required by law.

8. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15): request a copy of your personal data.
Right to rectification (Art. 16): correct inaccurate or incomplete data.
Right to erasure (Art. 17): request deletion of your data ("right to be forgotten").
Right to restriction (Art. 18): limit how we process your data.
Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent (Art. 7): withdraw consent for processing that relies on it, at any time.
Right to lodge a complaint (Art. 77): with the Spanish Data Protection Agency (AEPD) — www.aepd.es.

To exercise any of these rights, contact us at privacy@nextmovespain.com. We will respond within one month, as required by the GDPR.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

12. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@nextmovespain.com.