Privacy policy

Who is responsible for your data

The data controller for this website and for your booking is Hola Money SL, CIF B26671347, registered at Calle Granada 7, 04820 Vélez-Rubio, Almería, España. You can reach us at [email protected], and our data protection contact at [email protected].

The certificate itself is issued by Firmaprofesional, S.A., a qualified trust service provider. For the issuing process and the retention of your identification evidence, Firmaprofesional, S.A. is the controller. We tell you which of us holds what below.

What we collect on this website

If you book a call, we collect your name, email address, phone number, the type of identity document you intend to show, your language preference, your preferred call window, and anything you type into the notes field.

We deliberately do not collect your NIE or NIF number on this website, and we never ask you to upload an image of your identity document here. That happens during the identification call, with the issuer, over a channel built for it.

If you accept analytics cookies, we also collect usage data about how you moved through this page. If you reject them, we do not.

Once you sign in and start an application

The section above describes this marketing website, where we deliberately collect neither your NIE nor any image of your documents. An application is different, and once you have signed in and started one we do collect images of your identity document — because that is what the process requires.

To save you typing them, those images are read automatically, in part by an artificial intelligence service. We only use AI providers contracted on zero-retention terms: in writing, they do not keep a copy of your document after the request and do not use it to train or improve any model. Our systems refuse to send anything at all if those terms cannot be guaranteed for a request — it fails, and a person reads the document instead.

We route through OpenRouter, which selects a model provider operating under those terms; tell us and we will confirm in writing which one handled your application. Where a provider is outside the EEA we rely on Standard Contractual Clauses.

This is not automated decision-making. Every detail read from your documents is shown to you to confirm before it is used, and anything the software is unsure of is flagged for a person rather than assumed. You can also decline the automated reading and type your details in yourself, at no extra cost.

Why we are allowed to hold it

For your booking and the service itself: performance of a contract with you, or steps taken at your request before entering one (Art. 6(1)(b) GDPR).

For analytics: your consent, freely given and just as freely withdrawn (Art. 6(1)(a) GDPR).

For our invoicing and accounting records: our legal obligations under Spanish tax and commercial law (Art. 6(1)(c) GDPR).

The video recording

Remote identification by video is permitted under Orden ETD/465/2021, and that same regulation requires the issuer to record and retain evidence of the identification. The recording is held by Firmaprofesional, S.A. for 20 years as part of the certificate's evidentiary record.

It is not used for marketing, not used to train anything, and not sold. Access is limited to the issuer's identification and compliance staff and to any supervisory body legally entitled to ask for it.

Who else sees your data

The issuing trust service provider, Firmaprofesional, S.A., because they cannot issue a certificate to a person they have not identified.

Our email, hosting and analytics providers, as data processors under written contract and only for the purposes described here.

Public authorities, where we are legally required to disclose. We do not sell personal data, and we do not share it for anyone else's advertising.

How long we keep it

Booking and support records: for the life of your certificate plus the period during which a claim could still be brought.

Invoicing records: for the period Spanish tax law requires.

Identification recordings: 20 years, held by Firmaprofesional, S.A..

Analytics data: 14 months, or until you withdraw consent, whichever comes first.

Enquiries that never became bookings: 12 months.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time without affecting what we did lawfully beforehand.

Write to [email protected]. We answer within one month. Where a request concerns the certificate itself rather than this website, we are contractually required to pass it to Gong Time, S.L. and to Firmaprofesional, S.A. within one working day, and we will tell you when we have. If we get it wrong, you can complain to the Agencia Española de Protección de Datos (www.aepd.es), and we would rather you told us first so we can fix it.

Transfers outside the EEA

Our core providers are in the EEA. Where a processor is not, we rely on an adequacy decision or on Standard Contractual Clauses, and we can tell you which applies to which provider on request.