Política de privacidad

Last updated: September 9, 2026

PRIVACY POLICY & DATA PROTECTION NOTICE

1. DATA CONTROLLER 

The entity responsible for the collection, processing, and protection of your personal data is:

  • Company Name: TripsAndTravelling S.L. Multi Service

  • Tax Identification Number (NIF): B88323878

  • Registered Address: Madrid (28009), Spain

  • Commercial Brand: Visandpassport.com  (Visa and Passport website)

  • Contact Email: info@visandpassport.com

For any query regarding the processing of your personal information or to exercise your rights, you may contact our Compliance Team directly at the email provided above.

2. CATEGORIES OF DATA PROCESSED 

Due to the legal, administrative, visa, residency, and driver’s license exchange management services provided through our platform, we collect and process the following categories of data:

  1. Basic Identification and Contact Data: Full legal name, date of birth, place of birth, nationality, marital status, national ID numbers (DNI, NIE, Passport, Driver’s License), physical residential address, email address, and phone number.

  2. Special and Highly Sensitive Categories of Official Data (Art. 9 & 10 GDPR): Documentation and civil certificates required for administrative and legal filings, including but not limited to:

    • Criminal record certificates / Background checks.

    • Civil status records (Birth, Marriage, or Divorce certificates).

    • Academic titles, educational degrees, and employment qualifications.

    • Proof of financial capability, property titles, asset ownership, and employment status.

    • Official biometric/passport-style photographs.

  3. Transaction and Billing Data: Payment details, billing address, tax identification numbers, and order histories (processed via certified PCI-DSS compliant payment gateways).

  4. Technical and Device Information: IP addresses, browser specifications, operating system details, and secure interaction logs.

3. LEGAL BASIS AND PURPOSES OF PROCESSING

We process your data strictly under the following lawful legal bases outlined in Regulation (EU) 2016/679 (GDPR):

  • Execution of a Contract (Art. 6.1.b GDPR): To verify, prepare, translate, format, and execute legal, administrative, visa, residency, and driver’s license exchange procedures requested by the client.

  • Explicit Consent for Special Data Categories (Art. 9.2.a GDPR): The processing of official sensitive records (such as criminal records or civil certificates) is carried out strictly upon the explicit consent granted by the user upon submitting the secure intake forms.

  • Compliance with Legal Obligations (Art. 6.1.c GDPR): To issue legal invoices, account for commercial transactions, and fulfill anti-money laundering (AML) and tax regulations under Spanish and European laws.

  • Legitimate Interest (Art. 6.1.f GDPR): To maintain system integrity, prevent fraudulent transactions, guarantee platform security, and manage technical client communications.

4. ADVANCED SECURITY MEASURES AND ENCRYPTION 

We enforce military-grade physical, technical, and organizational security standards to protect your confidential files against unauthorized access, loss, alteration, or disclosure:

  • Encryption in Transit: All communications, form submissions, and document uploads made through Visandpassport.com are encrypted using Transport Layer Security (TLS 1.3 / SSL) protocols.

  • Encryption at Rest: Sensitive documents and personal records stored in our secure cloud storage architecture are protected using Advanced Encryption Standard (AES-256) encryption.

  • Access Control & Anonymization: Access to uploaded official documentation is strictly restricted under the principle of least privilege to authorized operational personnel bound by formal non-disclosure and confidentiality agreements (NDAs).

  • Zero Local Storage Policy: No physical or unencrypted copies of customer documentation are stored on unverified local devices.

5. SUBPROCESSORS AND INTERNATIONAL DATA TRANSFERS

To provide our digital services smoothly, securely, and automatically, we utilize trusted cloud-based service providers (Subprocessors) operating under strict Data Processing Agreements (DPAs) compliant with Article 28 of the GDPR.

  • Categories of Recipients: High-security cloud infrastructure providers, automated workflow integration tools, encrypted database systems, e-commerce platform backends, and certified payment processors.

  • Official Bodies and Legal Entities: Official documentation will only be submitted to competent public authorities, diplomatic missions, consulates, immigration offices, or sworn translators when strictly required to fulfill the requested legal procedure.

  • International Data Transfers: Any data processing performed outside the European Economic Area (EEA) is protected under approved safeguard mechanisms, including Standard Contractual Clauses (SCCs) issued by the European Commission or EU-U.S. Data Privacy Framework certifications.

We do not sell, rent, monetize, or trade your personal data or uploaded official documents under any circumstances.

6. DATA RETENTION AND AUTOMATIC DELETION

We adhere strictly to the principle of storage limitation (Art. 5.1.e GDPR):

  • Uploaded Official Documents (PDFs, Images, Records): All submitted civil, criminal, educational, and property records will be permanently and irreversibly deleted from our operational intake queues and cloud processing systems within thirty (30) calendar days following the completion and final delivery of the contracted service.

  • Billing and Commercial Records: Invoices, tax records, and proof of payment are legally retained for five (5) years to comply with Spanish tax laws (Ley General Tributaria).

  • Communication Logs: General inquiries and support records are retained for a maximum of three (3) years to address potential legal claims or obligations.

7. YOUR LEGAL RIGHTS 

Under Articles 15 through 22 of the GDPR, you retain full ownership and control over your personal information. You may exercise the following rights at any time:

  • Right of Access: Request confirmation and copies of the personal data we hold about you.

  • Right to Rectification: Request the correction of inaccurate or incomplete information.

  • Right to Erasure ("Right to be Forgotten"): Request the immediate deletion of your personal files when they are no longer necessary for the purpose they were collected.

  • Right to Restriction of Processing: Request that we temporarily suspend the processing of your data under specific statutory conditions.

  • Right to Data Portability: Request your personal data in a structured, commonly used, and machine-readable format.

  • Right to Object and Withdraw Consent: Withdraw your consent for data processing at any moment without affecting the lawfulness of processing based on consent prior to withdrawal.

To exercise any of these rights, please submit a written request to info@visandpassport.com indicating your name, requested action, and attaching a valid proof of identity (DNI, NIE, or Passport).

8. SUPERVISORY AUTHORITY 

If you consider that the processing of your personal data violates applicable European or Spanish data protection regulations, you have the absolute right to lodge a complaint with the competent supervisory authority:

  • Agencia Española de Protección de Datos (AEPD)

  • Address: C/ Jorge Juan, 6, 28001 – Madrid, Spain

  • Website: https://www.aepd.es

9. UPDATES TO THIS POLICY / MODIFICACIONES DE LA POLÍTICA DE PRIVACIDAD

We reserve the right to update or modify this Privacy Policy as necessary to reflect operational, legal, or regulatory changes. Any modifications will be posted directly on this page with an updated "Last Updated" date. Continued use of our services implies acknowledgment of the updated terms.