Privacy policy

1. Who we are

The Expat Suite (trading as The Expat Saas) · Email: privacy@thexpatsuite.online

This policy explains how we handle personal data on our websites (thexpatsuite.online and portal.thexpatsuite.online) and in The Expat Suite platform, as required by the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).

2. Two roles, depending on whose client you are

When you contact us, request a consultation or a quotation, or hire our own relocation services, we decide how your data is used: we are the controller.

Relocation agencies and law firms also use The Expat Suite to manage their own clients. If you are a client of one of those firms, that firm is the controller of your data and we process it only on its behalf and on its instructions, under a data processing agreement (GDPR art. 28). Questions or requests about that data are best sent to your firm; if you send them to us, we pass them on.

3. What we collect

• Contact details: name, email address, phone number and preferred language.
• What you tell us about your move: destination, dates, family members, housing preferences and the answers you give in our forms.
• Documents and details for your case: identity and travel documents, civil status, employment, financial and housing documents, and the details needed to fill in official forms.
• Messages between you and your relocation manager, and notes on your case.
• Billing details: invoices and payment records (card payments are handled by Stripe; we never see your full card number).
• Account and security data: sign-in times, IP address and browser, used to protect accounts against unauthorised access.

4. Why we use it, and on what legal basis

• To answer your enquiry and prepare a proposal: steps you asked for before a contract (art. 6.1.b).
• To provide the relocation services or the software you hired: performance of the contract (art. 6.1.b).
• To issue invoices and keep accounting records: legal obligation (art. 6.1.c).
• To protect accounts and keep the platform secure, for example by limiting repeated failed sign-ins: our legitimate interest (art. 6.1.f).
• To send you news about our services, only if you ticked the box for it: your consent (art. 6.1.a), which you can withdraw at any time.

5. Artificial intelligence

When a document is uploaded, an AI service may read it to pre-fill details such as names and dates. A person always reviews the result before anything is decided; no decision about you is made by automated means alone. The AI provider processes documents under contract and does not use them to train its models.

6. Who receives it

We do not sell personal data. We share it only with the service providers that run the platform, under contract, and with authorities when the law requires it or when you ask us to file something on your behalf.

• Railway Corporation: application hosting, database and file storage.
• Vercel Inc.: hosting of the websites.
• Resend: sending transactional email.
• Stripe Payments Europe: card payments.
• Anthropic, PBC: reading uploaded documents to pre-fill details.
• Google (Firebase Cloud Messaging): mobile notifications.

Some of these providers are in the United States. Those transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. How long we keep it

• Enquiries that do not become a client: as long as needed to answer them and follow up.
• Client files: while your case is open and afterwards for the period the firm handling it keeps closed files (six years by default, the period Spanish commercial law sets for business records), after which the file is reviewed for deletion.
• Invoices and payment records: the period tax and commercial law require (up to six years).
• Marketing consent: until you withdraw it.

8. Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Clients can download everything held about them and ask for deletion directly from their profile in the client portal. You can also write to us at the address above.

We answer within one month. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

9. Cookies and similar technologies

We do not use analytics, advertising or tracking cookies. When you sign in, your session is kept in your browser's local storage so you stay signed in; it is strictly necessary for the service and is removed when you sign out.

10. Security

Data is encrypted in transit. Each firm's data is kept separate at database level, access is limited by role, sign-ins are monitored for unusual activity, and access to client files is recorded.

11. Changes to this policy

We will update this page if the way we handle data changes, and tell clients of any significant change. Last updated: 4 November 2026.