Privacy

1. Who processes your data

Portals under third-party brands

If you have arrived through the portal of a gestoría (administrative services firm) or an advisory firm (asesoría) with its own brand, the controller of the processing of your data remains Iberfácil, which is the one providing you with the service. The organisation that gives the portal its name processes your data on behalf of Iberfácil, as processor, and only for what the service requires. On that portal you are always told who the controller is.

2. Where your data comes from

• From you: forms, documents you upload, what you tell us by telephone, email, chat or WhatsApp, what you provide at an Iberfácil Point.
• From your Iberfácil Point, if you have arrived through one.
• From official sources, when the service requires it: Agencia Tributaria (Spanish Tax Agency, AEAT) —NIF validation—, public registers, electronic offices (sedes electrónicas), courts.
• From third parties related to your matter, when they form part of the case file (for example, the documentation provided by a counterparty).
• From the platform itself: technical access and usage logs.

If you provide us with data of other people (a family member, an employee, a counterparty), you must have the right to do so and inform them that you have given it to us.

3. What data we process

• Identification data: first name, surnames, NIF/NIE (foreigner identification number)/passport, address, telephone, email.
• About your matter: facts, documents, case file references, written submissions, decisions, communications with courts and public bodies.
• Financial: billing data, means of payment, amounts, unpaid debts.
• Signature data: document fingerprint, time of signing, number to which the code was sent, operator's delivery receipt, IP address and device, chronology of the interaction.
• Usage data: access logs, IP address, browser and device, pages visited, session identifiers in the app.
• Conversation data: chat messages, emails and WhatsApp messages.
• Special categories and criminal-offence data, only when the contracted service requires it: see article 5.

4. Why we process your data and on what legal basis

5. Specially protected data and criminal-offence data

Some services require the processing of data that the law protects to a greater degree:

• Health: incapacities, accidents, certain employment proceedings.
• Sex life, sexual orientation, ethnic origin, ideology, trade-union membership: workplace and sexual harassment case files, discrimination, gender-based violence, immigration matters (extranjería).
• Criminal offences and convictions (art. 10 GDPR): criminal complaints and everything arising from them.

These data:

• Are processed only if the service you have contracted needs them.
• Special categories are processed under art. 9.2.f of the GDPR (establishment, exercise or defence of legal claims) and, where applicable, with your explicit consent. Data on criminal offences and convictions are also subject to the regime of art. 10 of the GDPR and of art. 10 of Ley Orgánica 3/2018 (Spanish Organic Law on Personal Data Protection and Guarantee of Digital Rights, LOPDGDD), and are processed only to the extent required by the contracted service, on the legal basis in article 4 that corresponds to that service.
• Have more restricted access within the platform and reinforced access auditing.
• In criminal complaint case files, access is logged and the case file is excluded from general analytics processing.

6. Verification of your identity and your tax data

6.1 Query to the Agencia Tributaria

To make sure that a NIF and a name correspond to each other, Iberfácil queries the identification data verification service of the Agencia Tributaria.

• What is sent: only the NIF and the name. Nothing else.
• What is received: whether the AEAT identifies that combination, and the name normalised according to its records.
• When it is queried: when you are registered as a customer, when a professional or Point is registered in the network, before issuing an invoice, and in periodic reviews of the data already registered.
• It is not queried “just in case”: only when there is a relationship that justifies it, and who queried it and why is recorded.

6.2 Identity verification

Depending on the service, you may be asked for: only validation of your NIF, your identity document, or a video identification. The level required depends on the procedure and you are told in advance.

6.3 Access with an electronic certificate

If you access with your digital certificate, the issuer, the serial number, the fingerprint of the certificate and the result of the revocation check are recorded. Your certificate is not stored: it is used only for the secure connection.

As a consequence, Iberfácil cannot monitor whether your certificate is revoked between one session and another. It checks it every time you use it.

7. Artificial intelligence

Iberfácil uses artificial intelligence assistants, presented under the name ANA, to prepare documents, classify the documentation you upload, suggest which documents are missing, write drafts, handle enquiries and assist with the internal management of case files.

7.1 With whom your data is processed

7.2 What the AI sees and what it does not

• The assistants access only the case file they are working on, and only what that role needs. The filter is applied before the query leaves, not after.
• When an engagement is offered to a collaborating professional, the AI prepares a report without your identification data: your name, NIF, telephone, email and exact address never enter that processing. It is not that it is asked to omit them: they are not passed to it.
• The assistant that writes content for the public website does not access case files.
• No biometric voice recognition is used. Nobody is identified by their voice.

7.3 There is always a person

No document, quotation, written submission or communication with effects for you goes out without an identified person having reviewed and approved it. That name is recorded. When a message has been prepared by ANA and reviewed by a person, the message itself says so.

7.4 How long the trail is kept

A technical log is kept of each AI intervention (what it read, with what instructions, what it decided, who approved it). The content of that log is deleted after 12 months; the metadata and references are kept for up to 24 months.

8. Automated decisions and profiling

8.1 If you are a customer

• Enquiries are scored automatically to prioritise attention. That score does not decide whether or not you are accepted as a customer.
• No decision on the acceptance of your engagement, its price or its outcome is taken in an automated way. There is always a case manager who decides.

8.2 If you are a collaborating professional or a Point

This affects you directly and deserves to be read:

• The allocation of engagements relies on an automated scoring of candidates (specialty, territory, capacity, historical performance, cost, time since the last assignment). That score influences which work you receive and which you do not.
• Your work is subject to supervision, also automated. The system raises findings when it detects an issue.
• A deterministic and verifiable finding (an overdue deadline, an expired insurance policy, a professional registration that is not in force) can block an action or suspend you from the allocation. You are notified immediately and a person can reverse it.
• An AI never blocks you because of a difference of professional judgement. On that, it raises an alert; a person decides.
• You have the right to: have it explained to you why you received or did not receive an engagement (the breakdown of the score is kept), to request human review of any automated decision that affects you, to express your point of view and to challenge it.

9. Communication channels

9.1 Email, SMS and private area

Ordinary channels. The emails you send to our mailboxes are added to your case file.

9.2 WhatsApp

• Used only if you have authorised it. That consent is recorded.
• You can unsubscribe by writing STOP in the channel itself. You will continue to receive communications by other means.
• The service is provided over the WhatsApp Business platform of Meta, which acts as a provider.
• WhatsApp is not a channel that provides legally reliable proof of communications (canal fehaciente). It serves to notify you that there is something; what has effect is the signed document and, where applicable, the electronic notification.

9.3 Telephone calls

We do not currently record or transcribe calls. If at any time we do, these rules will apply, and this policy will be updated before we begin:

• You will be told at the start of the call, before anything else, and your consent will be collected.
• If you do not want it to be recorded, you will still be attended to in the same way. It will not be a condition for receiving the service.
• The audio will be kept for 30 days and then deleted, unless it is added to the case file as evidence, in which case it will be subject to the retention of the case file with the reason recorded.
• What will be kept long term is the transcript and the outcome of the call, with the retention of the case file.

9.4 AI assistants

When whoever is attending to you is an AI assistant, you are told in the first message and permanently throughout the conversation. If you ask whether you are being attended to by a person, the answer is truthful and immediate. You can ask to speak to a person at any time, without identifying yourself and without being asked why.

10. Who receives your data

If you want to know which specific entity provides each of these services, write to us at gestion@iberfacil.es and we will tell you.

11. International transfers

• Processing with artificial intelligence takes place within the European Union, without international transfers.
• For the other providers, where there is a transfer outside the European Economic Area it will be made with one of the safeguards of Chapter V of the GDPR (adequacy decision or standard contractual clauses), and will be detailed here.

12. How long we keep your data

What happens to the verifier when the content of a document is deleted. The printed code does not expire, but the content of documents has a retention period. When the original file is no longer available, the verifier may respond “No encontramos ese documento” [“We could not find that document”], just as for a code that does not exist, or, for some types of document, show the verification record without offering the download of the original. The exercise of the right to erasure does not modify the verifier: neither the verification record nor the signature data that underpin it (the full names of the signatories —which the verifier shows masked—, the evidence package and the verification code) is deleted or anonymised for that reason. If you exercise the right to erasure, an assessment is made of what can be deleted —where applicable, the content of the document—, but the verification record and those signature data are kept for as long as they are necessary to prove what was signed and for the establishment, exercise or defence of legal claims (art. 17.3.e of the GDPR; articles 4 and 13 of this policy), for the period indicated in the table above. If that is your case, you are told why.

Once the periods have expired, the data is deleted or anonymised, or blocked where the law requires it to be kept in order to address liabilities. The verification record and the signature data that underpin it are kept in accordance with the row “Documents verifiable by secure verification code (CSV)” and the previous paragraph.

13. Your rights

You can exercise, at any time and free of charge:

• Access: find out what data of yours we process and obtain a copy.
• Rectification: correct what is wrong or incomplete.
• Erasure: ask for it to be deleted, when it is no longer necessary and there is no legal obligation to keep it.
• Restriction: ask for its use to be frozen while a disagreement is resolved.
• Objection: object to processing based on legitimate interest, on grounds relating to your particular situation.
• Portability: receive your data in a machine-readable format and, if possible, have it transmitted to another controller.
• Withdraw consent in the processing based on it (WhatsApp, commercial communications, public directory), without affecting what was done before.
• Human review of automated decisions that affect you (article 8).
• Not to be the subject of commercial communications: an unsubscribe option in every mailing, taking effect immediately.

How: from your private area or by writing to dpd@partners.iberfacil.es. The response period is one month from receipt; it may be extended by a further two months if the complexity or the number of requests so justifies, with information on the extension and the reasons for it provided within the first month. Additional information can only be requested to identify you where there are reasonable doubts about your identity.

If you are not satisfied, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency, AEPD; www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

Some rights may be limited where there is a legal obligation to retain or where the data is necessary for the defence of claims. If that is your case, you are told why. For example, the exercise of the right to erasure does not modify the public verifier: the verification record of the document, with the signatories' names masked and the fingerprint, is not deleted for that reason (articles 12 and 15).

14. Security

• Encrypted storage of documents, outside the public folders of the server. Access from the private area and the public query by CSV are different routes; the scope of the latter is explained in section 15.
• Segmented team access: each person has access to what their role requires. The public query by CSV is described in section 15.
• Two-factor authentication for access to the panel.
• The electronic certificates held in custody live in an isolated vault to which the web server has no read access, with its own encryption per certificate and a chained log of each signing operation.
• Encrypted backups, replicated outside the server and with restoration tested periodically.
• Security breach procedure with notification within 72 hours.
• Confidentiality agreements with staff, collaborators and processors.

15. Public document verifier

Anyone who has the secure verification code (código seguro de verificación, CSV) printed on a document can check it on the public verifier, which lives on the domain of the brand that issued the document, at the path /csv (for example, iberfacil.es/csv), and for which Iberfácil assumes a continuity commitment at iberfacil.es/csv (Electronic Signature Policy, article 6.5). The verifier shows the verification record of the document —the data that each type of document decides to show— and the fingerprint of the original. The signatories' names appear masked: the full first name and the rest as initials (for example, “María G. L.”). There are exceptions, among them: in signatures made in a representative capacity, the represented company is shown in full; in manually sealed documents, the organisation is shown; in feasibility studies, the public name of the team member who signs is shown; and some types of document show no names. Except for the cancellation notice, it never adds data that is not in the document, nor information from the case file. The masking affects the names in the verification record; it does not amount to anonymisation of the downloadable original or of the stored data.

The only status notice is “ANULADO” [“CANCELLED”], with date and reason, only for manually sealed documents. The verifier does not report expiry, supersession, withdrawal, cessation of the brand or content not retained. The original can be downloaded while it is available. Depending on the type of document, if the original is missing or its fingerprint does not match, the verifier returns a 404 error “No encontramos ese documento” [“We could not find that document”], just as for a code that does not exist, and generates an internal alert; in other types, if the original is missing, the verification record remains visible and the download returns a 404 error. The exercise of the right to erasure does not modify the verifier in the current system: it does not, in itself, remove the verification record or prevent a download that is still available (sections 12 and 13).

Queries to the verifier may be logged (code queried, time, IP address and result) as evidence of access. That log is not public.

16. Changes to this policy

This policy is published with a version number and a date. When it changes substantially, you are notified.

Every version is archived. When you accept this policy on the platform, which version and in which language was shown to you is recorded, together with an unalterable copy of the exact text you saw. You can download that copy from your private area.

This policy fully replaces the one published on 30 March 2025.

In the event of any discrepancy between the Spanish version and any translation, the Spanish version prevails.