1. Data Controller
Expanova S.L. ("KORE", "we", "us") is the data controller responsible for your personal data. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and Spanish data protection law (LOPDGDD).
2. Data We Collect
We collect the following categories of personal data:
- Identity data: Full name, date of birth, nationality, passport number, passport expiry date
- Contact data: Email address, phone number, current address
- Immigration data: Visa type, employment details, financial information, sponsor information, education details
- Documents: Passport copies, photos, proof of income, bank statements, health insurance, criminal record checks, accommodation proof, employment contracts
- Payment data: Payment method details (processed by Stripe; we do not store card numbers)
- Usage data: Login activity, pages visited, booking history, inquiry messages
3. Legal Basis for Processing
We process your data based on the following legal grounds under GDPR Article 6:
- Contract performance (Art. 6(1)(b)): Processing necessary to provide our visa application, Captain booking, and housing services
- Legal obligation (Art. 6(1)(c)): Compliance with Spanish immigration and financial regulations
- Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, service improvement
- Consent (Art. 6(1)(a)): Marketing communications (you may withdraw consent at any time)
4. Purpose of Data Processing
Your personal data is processed for:
- Processing and managing your visa application(s)
- Storing and organizing immigration documents securely
- Facilitating Captain consultation bookings
- Enabling housing inquiries and landlord communication
- Processing payments through Stripe
- Sending application status updates and notifications
- Providing customer support
- Improving our platform and services
5. Document Storage
Documents uploaded to KORE for visa applications are stored securely using encrypted storage. Documents are retained for the active duration of your application and for up to 5 years after application completion, in compliance with Spanish regulatory requirements. You may request early deletion of documents after your application is finalized (see Section 8).
6. Data Sharing
We share your personal data only with:
- Stripe: Payment processing (PCI-DSS compliant)
- Resend: Transactional email delivery
- Captains: Relevant booking information for your scheduled sessions
- Landlords: Contact details shared only when you initiate a housing inquiry
- Spanish authorities: Only when required by law or upon your explicit request for visa processing
We do not sell your personal data to third parties.
7. International Data Transfers
Your data is primarily stored within the EU. Where data is transferred outside the EEA (e.g., to service providers), we ensure adequate safeguards through Standard Contractual Clauses (SCCs) or adequacy decisions as required by GDPR Chapter V.
8. Your Rights (GDPR Articles 15–22)
Under GDPR, you have the following rights:
- Right of access (Art. 15): Request a copy of your personal data
- Right to rectification (Art. 16): Correct inaccurate or incomplete data
- Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
- Right to restriction (Art. 18): Restrict processing in certain circumstances
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interests
- Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing
To exercise any of these rights, contact us at privacy@expanova.io. We will respond within 30 days.
9. Data Retention
- Account data: retained while your account is active, and for 2 years after deletion
- Application documents: 5 years after application completion
- Payment records: 7 years (Spanish tax requirements)
- Booking and review data: 3 years after creation
- Usage logs: 12 months
10. Security
We implement appropriate technical and organizational measures to protect your personal data, including encryption at rest and in transit, access controls, regular security assessments, and secure payment processing through Stripe.
11. Cookies
KORE uses essential cookies for authentication and language preferences. We do not use tracking or advertising cookies. Your language preference is stored in localStorage under the key "kore-language".
12. Supervisory Authority
You have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the platform. The date at the top of this page indicates when this policy was last revised.
14. Contact
For questions about this Privacy Policy or your personal data, contact our Data Protection Officer at privacy@expanova.io