Privacy Policy

We may collect contact details, route-review answers, application documents you choose to share, communication records, consent records, and technical website data.

Information is used to respond to inquiries, prepare services, maintain records, protect the website, and comply with obligations. GDPR bases may include consent, contract steps, legitimate interests, and legal obligations.

You may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where applicable.

When a student submits an education enquiry, we record the fields entered, provider or programme selected, consent timestamp, source path, duplicate-risk link, delivery and status history. Enquiry records are assigned a 730-day retention date unless they must be erased earlier, retained for a legal claim, or preserved under another lawful obligation. Marketing consent is optional and separate from the enquiry.

Enquiry details are available only to authorised ApplyToSpain staff and authorised members of the selected provider where the provider has an active enquiry entitlement. Infrastructure and service providers may process data on our instructions, including hosting, database, identity, payment, email, security, and analytics vendors. International transfers, where applicable, must use an adequacy decision or appropriate safeguards.

We process verified work email, name, job title, claim evidence, membership, revision, moderation, billing, and audit records to authenticate representatives, review authority, operate the account, prevent abuse, and perform contracts.

You may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where applicable by contacting hello@applytospain.com. You may also complain to the Spanish Data Protection Agency (AEPD). Withdrawing marketing consent does not stop a requested enquiry from being handled.