Privacy Policy

Last updated: 28 August 2026 · Version: v1.0

This Privacy Policy applies to EasyBeckhamLawSpain as part of the Easy Legal Spain group of digital legal services, operated by Expat Abogados (Juan Bertomeu Vallés, ICALI #4643, since 1991). Single data controller for all products in the group.

EasyBeckhamLawSpain is operated by Juan Antonio Bertomeu Vallés, a Spanish lawyer registered with the Bar Association of Alicante (ICALI member #4643) since 1991, and a Tax Authority Collaborator (AEAT Colaborador Social since 2017). This Privacy Policy explains how we collect, use, and protect your personal data when you use our service to apply for the Spanish special expatriate tax regime (Article 93 of the Spanish Personal Income Tax Law, commonly known as the "Beckham Law") — the eligibility check, the Modelo 149 application, and the annual Modelo 151 tax returns.

Our approach in one sentence: you give us only what we need, our human lawyer reviews everything personally before signing and submitting to the Spanish Tax Authority (AEAT), and all data stays in the European Union.

1. Who we are (Data Controller)

Current entity: Juan Antonio Bertomeu Vallés, NIF 28988016N, freelance lawyer (ICALI #4643)
Future entity: Expat Abogados y Asesores Fiscales S.L.P. (Spanish Professional Services Limited Liability Company — incorporation in progress)
Office addresses: Calle Doctor Calatayud 39, 03724 Moraira (Alicante), Spain · Calle Ramón y Cajal 5E, 03700 Dénia (Alicante), Spain
General contact: legal@expatabogados.com
Phone / WhatsApp: +34 614 08 68 07
Parent brand: Expat Abogados (law firm)

2. Who handles your privacy

We have not appointed a Data Protection Officer, and we are not required to: our size and activity do not meet any of the cases where the GDPR makes one compulsory. Your privacy questions and your rights are handled directly by the firm at legal@expatabogados.com, or by post at the office addresses above.

3. What personal data we collect

We collect only the minimum data necessary to check your eligibility and to prepare and file your Modelo 149 application and Modelo 151 returns. Specifically:

Contact data: name and email address when you contact us or ask us to review your situation.
Eligibility data: the answers you give in our eligibility check — employment situation, dates of arrival and of starting work in Spain, and whether you have been a Spanish tax resident in recent years. We use them to tell you honestly whether the regime fits your case, including telling you when it does not.
Identity data (when you contract): passport or NIE, full name, date of birth, nationality, address in Spain.
Employment and immigration data (when you contract): employer identity, employment contract details, job start date, date of arrival in Spain, Spanish social security number and registration date. These are the facts AEAT requires for the Modelo 149 application.
Tax data (for annual Modelo 151 returns): employment income and, where applicable, other income the regime requires to be declared.
Documents you upload: passport/NIE, employment contract, social security registration (alta), and other supporting documents you choose to share.
Payment data: we use Stripe to process the payment of our service. Card details go directly to Stripe and are not stored by us — we only receive a transaction identifier and the last 4 digits of the card.
Communication data: emails, support messages, WhatsApp messages (if you choose to contact us via WhatsApp).
Cookie / web analytics data: as detailed in our Cookie Policy.

We do NOT collect:health data, religious beliefs, political opinions, biometric data, race or ethnicity, sexual orientation, or any other special categories defined in Article 9 GDPR. We do not engage in profiling within the meaning of Article 4(4) GDPR — we don't infer personal characteristics about you.

4. Why we collect your data (legal basis)

The legal grounds under Article 6 GDPR are:

Article 6(1)(b) — performance of a contract: checking your eligibility at your request, and preparing and submitting your Modelo 149 and Modelo 151 filings pursuant to the professional engagement you accept when contracting.
Article 6(1)(c) — legal obligation: compliance with Spanish tax law (Article 93 LIRPF, Articles 113–120 of the Spanish PIT Regulations), ICALI deontological obligations, and AEAT Tax Authority Collaborator regulations.
Article 6(1)(f) — legitimate interest: using internal productivity tools to process documents you upload, so our lawyer can review filings faster and more accurately. Your interests prevail: you can always opt out by providing the information directly instead of uploading documents, and our lawyer cross-checks every filing against your original documents before signing.
Article 6(1)(a) — consent: only for non-essential cookies (analytics, marketing) and optional marketing communications. Consent is freely given and revocable at any time.

5. Automated decisions

The eligibility check on this website applies the published legal conditions of Article 93 LIRPF to the answers you give — it is an information tool, not a decision about you. There is no automated decision-making with legal or significant effects on you (Article 22 GDPR). Every application and every return we file is reviewed and signed by a qualified, licensed Spanish lawyer (Juan Bertomeu Vallés, ICALI #4643) who cross-checks our findings against your original documents before electronic signature and submission to AEAT.

You have the right to receive meaningful information about the logic of any automated processing we apply (Article 13(2)(f) GDPR): contact legal@expatabogados.com.

6. Who we share your data with

The Spanish Tax Authority (AEAT) — when we file your Modelo 149 or Modelo 151 on your behalf. This is required to deliver our service.
Trusted service providers (processors) bound by Data Processing Agreements (Article 28 GDPR) — the same infrastructure as the rest of the Easy Legal Spain group: Supabase Inc. (database, authentication, document storage — EU region: Frankfurt), Vercel Inc. (hosting, EU edge preferred), document-processing technology providers (EU infrastructure, no training on your data), Stripe Payments Europe Ltd. (payments, Ireland), Resend.com Inc. (transactional email, EU residency), Google Cloud Platform (encryption key management, europe-west1), Google Workspace (corporate email), Sentry GmbH (error monitoring, Germany), PostHog Inc. (product analytics, EU region), Brevo SAS (email marketing after opt-in, EU processing), Attio Plc (CRM, UK — Adequacy Decision), n8n GmbH (workflow orchestration, Germany), Holded (accounting, Spain).
Legal authorities — only when required by Spanish or EU law (court order, AEPD inspection, etc.).

We do not sell your data. We do not share your data with advertisers, data brokers, or marketing platforms without your explicit consent.

6.1. Meta Custom Audiences — Separate explicit consent

We may share your hashed email and phone number (SHA-256, irreversible) with Meta Platforms Inc. (USA, under the EU-U.S. Data Privacy Framework) for personalised advertising on Facebook and Instagram via Custom Audiences — only if you have given separate explicit consent for this purpose (not bundled with the email marketing opt-in). For the upload and matching phase, Expat Abogados and Meta act as joint controllers (Article 26 GDPR); the arrangement is available on request. You may withdraw this consent at any time (removal processed within 48 hours) via legal@expatabogados.com or the cookie settings link in the footer.

6.2. Email communications — Two distinct types

Operational service emails (no opt-in required): payment receipts, case status updates, deadline warnings (for example, the 6-month Modelo 149 application window or the annual Modelo 151 deadline), and renewal notices for the same product you contracted. Legal basis: Article 6(1)(b) GDPR + Article 21.2 LSSI-CE. Each renewal email includes one-click unsubscribe.

Educational emails (opt-in required): topic-specific guides and legal updates, maximum 1–2 emails per month per topic, one-click unsubscribe per topic or globally. Legal basis: Article 6(1)(a) GDPR.

7. International data transfers

We prioritize processors with EU data residency. Where a processor has parent operations outside the EU (e.g., USA), the transfer is covered by EU Standard Contractual Clauses (Commission Decision 2021/914), the EU-US Data Privacy Framework where applicable, or contractual EU residency commitments. Your filing data, documents, and identity information are processed in EU infrastructure (Frankfurt, Spain, Ireland, Germany) and do not leave the EU.

8. How long we keep your data

Account data: while you have an active account + 4 years after last use
Modelo 149/151 filings and supporting documents: 6 years from each filing (4 years tax prescription + 2 years safety margin — Spanish General Tax Law Art. 66). Note that the regime itself can span up to six tax years.
Eligibility check answers (no purchase): 12 months, then deleted or anonymised
Customer support communications: 2 years from last interaction
Marketing email subscriptions: until you unsubscribe, or 4 years of inactivity
Essential cookies: max 13 months · analytics/marketing cookies: per your consent, max 24 months
Consent records: 6 years (legal proof of compliance)

9. How we protect your data

Encryption in transit (TLS 1.3) and at rest
Row Level Security (RLS) on all database tables containing personal data
Two-factor authentication for all staff accounts
Role-based access: you can only access your own data; staff access only assigned cases
Immutable audit logs for consent and review actions
Encrypted automatic backups with point-in-time recovery
Documented incident response plan (72-hour notification to AEPD if required)

10. Your rights under GDPR

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17 — subject to legal tax retention obligations; we will tell you precisely what we can and cannot delete), restriction (Art. 18), objection (Art. 21), portability (Art. 20), and withdrawal of any consent-based processing. You can lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

To exercise any right, email legal@expatabogados.com with your passport/NIE + identity verification + the right you wish to exercise. We will respond within 1 month (extendable by 2 months for complex requests, with notification).

11. Cookies

See our Cookie Policy for detailed information on the cookies we use and how to manage your preferences.

12. Children

EasyBeckhamLawSpain is intended for adults relocating to Spain for work. We do not knowingly collect data from anyone under 18.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users. The effective date is shown at the top of this page.

14. Governing law and competent jurisdiction

This Privacy Policy is governed by Spanish law (GDPR + LOPDGDD — Organic Law 3/2018). Disputes are subject to the competent courts of Alicante, Spain — subject to any consumer law provisions that may apply if you are a consumer resident in another EU member state.

Questions about your privacy? Contact legal@expatabogados.com · Juan Antonio Bertomeu Vallés · Calle Doctor Calatayud 39, 03724 Moraira (Alicante), Spain.