Privacy Policy

At Movello we handle some of the most personal information a person can share: passports, family details, financial records, and documents such as criminal-record and medical certificates. This Privacy Policy explains, clearly and completely, what we do with that information, why, on what legal basis, who receives it, how long we keep it, and how you can control it.

It is written to comply with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"), and Law 34/2002 on Information Society Services ("LSSI").

Summary — the essentials

In accordance with Article 11 of the LOPDGDD, this summary gives you the basic information first. The full details follow below.

1. Who is responsible for your data

The controller of your personal data is:

MOVELLO, S.L.
NIF: B05681655
Registered office: Carrer de Floridablanca, 68, 08015 Barcelona, Spain
Registered in the Commercial Registry of Barcelona, Section 8, sheet B-664341, 1st entry, dated 30 September 2026 (BORME no. 194, 7 October 2026, page 46853)
Email: [email protected]

Data Protection Officer. We have appointed a Data Protection Officer under Article 37 of the GDPR and Article 34 of the LOPDGDD, whom you may contact about any matter relating to your data at [email protected] or at the postal address above, marked "For the attention of the Data Protection Officer".

1.1 Independent lawyers

The lawyers who review cases and provide legal services through the platform are independent professionals. For the legal services they provide to you they act as independent controllers, subject to their own professional duty of confidentiality and to the rules of their Bar Association. The lawyer handling your case will give you their own data-protection information when you engage them.

1.2 Employers and agencies

If your application is sponsored or managed by an employer, a relocation agency or another organisation, that organisation is a separate controller of the data it holds about you. When an organisation uses Movello to manage cases for its own staff or clients, the role each party plays is set out in our agreement with that organisation, and you will be told who that organisation is before any of your data is shared with it.

2. What data we collect

What we collect depends on how you use Movello. We collect only what is needed for the purpose concerned, and we tell you, at the point of collection, which information is required and which is optional.

2.1 When you browse the Website or use the eligibility check

• Contact details you give us: name, email address, telephone number, country of residence.

• Eligibility answers: your nationality, current location and immigration status, the purpose of your move, and indicative information about your income and work situation.

• Technical data: IP address, device and browser type, pages visited and interaction data — subject to your cookie choices (see our Cookie Policy).

2.2 When you open an account and start a case

• Identity data: full name, date and place of birth, sex as recorded on your travel document, nationality, passport or identity-document data and copy, photograph where an authority requires it, and your foreign-national identity number (NIE) if you have one.

• Contact and address data, including your addresses over the period an application requires.

• Immigration history: your current and previous residence permits, visas, entries to and stays in Spain and other countries, and the countries where you have lived over the period the authority requires (usually the last five years).

• Family data: details of a spouse or partner, children and other dependants included in your application — see section 2.4 on minors.

• Work and financial data: employment or self-employment information, contracts, client relationships, income, bank statements and other evidence of financial means required by the programme you apply for.

• Education and qualifications: degrees, certificates and professional credentials where the programme requires them.

• Documents you upload, and the information they contain.

• Case data: your case status, the requirements identified for your application, deadlines, the lawyer's review notes and decisions, submission records and the authority's resolution.

• Communications with us and with your lawyer through the platform.

• Billing data: invoices, amounts, payment status. Card or bank details are processed directly by our payment provider; we do not store full card numbers.

• Account and security data: login credentials (stored in protected form), access logs and actions performed in your account.

2.3 Special categories of data and criminal-record data

Some immigration procedures legally require documents that contain especially sensitive information. We process them only when the procedure you have chosen requires them, only for that procedure, and with reinforced protection.

• Health data (Article 9 GDPR): the medical certificate required by certain Spanish residence procedures, and information about your health insurance. We process health data only with your explicit consent (Article 9(2)(a) GDPR), which we ask for separately, before you upload the document. You may refuse or withdraw it, but we will then be unable to prepare an application that legally requires that document.

• Criminal-record data (Article 10 GDPR and Article 10 LOPDGDD): the criminal-record certificates that Spanish immigration law requires applicants to provide. We process these certificates solely to check that the document requested by the authority is present, complete and correctly legalised or translated, and to submit it to the competent authority at your request, as required by Organic Law 4/2000, Royal Decree 1155/2024 and Law 14/2013. The content of the certificate is reviewed by your lawyer, not by Movello, and we do not use it for any other purpose. [⚠ See the cover note: the legal basis for this processing must be confirmed by your lawyer and DPO before publication.]

• We do not ask for and do not intend to process data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data used to identify a person, or data about sex life or sexual orientation. If a document you upload incidentally contains such information, we process it only as part of that document and for the same purpose.

• Some grounds for a residence permit relate to personal circumstances of particular sensitivity — for example, protection given to victims of gender-based violence. Where such a ground applies, we collect only the document the authority requires and do not record the underlying circumstances anywhere else.

2.4 Minors

Movello accounts are for adults aged 18 or over. Information about children is provided by their parent or legal guardian as part of a family application, and is processed only for that application. Under Article 7 of the LOPDGDD, a minor under 14 cannot consent to the processing of their data; consent is given by the person holding parental authority or guardianship, who must ensure they are entitled to act for the child.

2.5 Data about other people

If you give us information about another person — a family member, an employer contact, a referee — you confirm that you are entitled to share it, that you have informed that person, and that the information is accurate. Where we collect data about a person other than you, we inform them in accordance with Article 14 of the GDPR.

2.6 When you contact us or represent an organisation

If you are a representative or employee of an employer, agency or partner, we process your name, job title, professional contact details, the organisation you represent and our communications.

3. Why we use your data, and on what legal basis

Legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for that assessment, and you can object to this processing at any time (see section 8).

Is providing data mandatory? Information marked as required is needed to provide the service or to prepare an application that complies with the law. If you do not provide it, we may be unable to provide the service, or the authority may refuse your application. Optional information is clearly marked.

4. Use of artificial intelligence and automated processing

We use AI-assisted tools to make case preparation faster and more reliable — for example, to read the information on an uploaded document, check that it matches what the application requires, flag missing or inconsistent information, and help organise your file.

• These tools assist people; they do not decide. No decision that produces legal effects for you, or significantly affects you, is taken solely by automated means within the meaning of Article 22 of the GDPR. Every case is reviewed by a qualified person, and every application is reviewed by your lawyer before it is submitted.

• Eligibility indications are orientation only. The eligibility check estimates which programmes may suit you; it is not a determination of your eligibility. Only the competent authority decides.

• Transparency. Under Article 50 of Regulation (EU) 2024/1689 (Artificial Intelligence Act), we tell you whenever you are interacting directly with an AI system, and we label AI-generated content where the Act requires it. You can find more detail in our AI Transparency statement.

• Your data and AI providers. Where an AI tool is supplied by a third-party provider, that provider acts as our processor under a contract that prohibits it from using your data to train its own models and requires it to delete the data in accordance with our instructions. [⚠ Confirm against each provider's terms.]

• You can ask for an explanation of how a particular result was reached, and for human review of any automated output that concerns you.

5. Who receives your data

We never sell your personal data, and we never share it for third-party advertising based on your case.

We share data only with:

1. The independent lawyer handling your case, for the purpose of providing legal services to you.

2. Public authorities to which you apply — for example the Spanish Ministry of Inclusion, Social Security and Migration (including its Large Companies and Strategic Groups Unit), the Government Delegations and Sub-delegations and their Immigration Offices, the National Police, Spanish consular offices, the Social Security system, and the competent authorities of the Generalitat de Catalunya where they decide your procedure — only to the extent your application requires, and in the case of electronic filing as your authorised representative.

3. Your employer, agency or sponsoring organisation, where you are part of a process it manages — only the information needed for its role in that process, as described to you before sharing begins. An organisation never receives information you have not been told it will receive.

4. Service providers acting on our behalf (processors), under contracts that comply with Article 28 of the GDPR. They act only on our instructions and may not use your data for their own purposes. The categories are:

An up-to-date list of the providers we use, with their location and transfer safeguards, is available on request at [email protected].

5. Professional advisers and auditors, under a duty of confidentiality, where necessary.

6. Courts, public authorities and law-enforcement bodies, where we are legally required to disclose data.

7. A buyer or successor, if Movello is involved in a merger, acquisition or transfer of assets, under equivalent confidentiality and protection. We will inform you beforehand.

6. International transfers

We store your case data and documents in the European Union. Some of our service providers are located outside the European Economic Area, or may access data from outside it to provide support.

We only allow such transfers when one of the safeguards in Chapter V of the GDPR applies:

• an adequacy decision of the European Commission — including, for certified US companies, the EU–US Data Privacy Framework; or

• Standard Contractual Clauses approved by the European Commission, together with any supplementary measures needed to ensure an essentially equivalent level of protection.

You can request a copy of the relevant safeguards at [email protected].

7. How long we keep your data

We keep data only for as long as necessary for the purpose for which it was collected, and then for the period during which legal liability may arise or the law requires us to keep it. During that later period, data is blocked under Article 32 of the LOPDGDD: kept separately, restricted, and used only to meet legal obligations or to deal with claims. It is then securely deleted.

8. Your rights

You have the following rights under Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD:

• Access — to know whether we process your data and obtain a copy.

• Rectification — to correct inaccurate or incomplete data.

• Erasure — to have your data deleted when, among other cases, it is no longer necessary, subject to the retention obligations above.

• Restriction — to have processing limited in certain circumstances.

• Objection — to object to processing based on our legitimate interests, and to direct marketing at any time.

• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider.

• Not to be subject to solely automated decisions with legal or similarly significant effects (see section 4).

• Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

How to exercise them. Write to [email protected], use the privacy settings in your account, or write to our postal address. We may ask you to confirm your identity if we cannot otherwise verify it. Exercising your rights is free of charge. We will respond within one month, which may be extended by two further months for complex or numerous requests; we will tell you if so.

Digital legacy. Under Article 3 of the LOPDGDD, the persons linked to a deceased person, or their heirs, may contact us to access, rectify or delete that person's data, unless the deceased person expressly prohibited it.

Complaints. If you consider that we have not handled your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es), or with the supervisory authority of the EU Member State where you live or work. We encourage you to contact us or our Data Protection Officer first so that we can try to resolve it.

9. How we protect your data

We apply technical and organisational measures appropriate to the sensitivity of the data we handle, in accordance with Article 32 of the GDPR, including:

• Access control enforced at database level, so that each person can see only the records their role and case require;

• Encryption of data in transit and at rest; documents held in private storage, never publicly accessible;

• Least-privilege access for our own staff, with access to sensitive documents limited, logged and reviewed;

• Audit trails recording who accessed or changed case data and when;

• Data minimisation: purpose-limited disclosure, so that each recipient receives only what its role needs;

• Processor contracts that impose equivalent obligations on our providers;

• Incident response procedures. If a personal-data breach is likely to result in a high risk to you, we will inform you without undue delay, and we notify the AEPD within the time limits set by Article 33 of the GDPR.

No system is completely secure. If you suspect your account has been compromised, contact us immediately at [email protected].

10. Marketing communications

We send marketing communications only if you have consented or, where you are already a client, about similar Movello services as permitted by Article 21.2 of the LSSI. Every message includes a simple, free way to unsubscribe. Withdrawing consent to marketing does not affect service messages about your case.

11. Changes to this policy

We may update this policy to reflect changes in our services or in the law. We will publish the updated version with its date, and if the changes are significant we will notify you by email or through the platform before they take effect.

12. Language

This policy is published in English. Versions in Spanish and Catalan are available on request at [email protected] [or at: links]. You have the right to be attended in either official language of Catalonia.

13. Contact

MOVELLO, S.L.U. — Carrer de Floridablanca, 68, 08015 Barcelona, Spain
Privacy: [email protected] · Data Protection Officer: [email protected]