Legal · Your data

Privacy Policy

How GESTIA collects, uses, protects and deletes personal data when you use our mobile application and website.

ON THIS PAGE

Privacy in brief. GESTIA helps adults prepare Spanish administrative documents. We do not sell customer data, display third-party advertisements in the app, or use form answers or PDF contents for advertising targeting. We use limited service providers to operate the app, website, notifications, email and in-app purchases.

1. Who is responsible for your data?

GESTIA is an independent document-preparation and informational service operated by the following data controller:

Controller: Mariana Shytikova (self-employed professional / autónoma)
Service: GESTIA
Address: Calle Cabo de Gata 18, Casa 89, 03189 Orihuela, Alicante, Spain
Privacy contact: [email protected]
Website: gestia.me

GESTIA is not affiliated with, endorsed by or acting on behalf of the Spanish government or any public authority.

2.Scope and age

This policy covers the GESTIA mobile application, the public website at gestia.me and related support communications. GESTIA is intended for adults aged 18 and over and is not directed to children.

3. Personal data we process

Account and preferences

Name, email address, password credentials in protected form, selected application language, citizenship, account identifiers and preferences.

Procedures and document preparation

Information you enter in guided forms, drafts, answers, selections, generated PDF files, protected previews and document-related activity. Depending on the procedure, this may include identity, contact, address, nationality, immigration, family or other information needed for the form. Some information may be sensitive in context.

Purchases and access

Order identifiers, purchase status, store transaction references, purchased entitlements or credits, and records necessary to grant access and maintain accounts. We do not receive your full payment-card number from Apple or Google.

Technical and support information

Device and app information, technical logs, error and security events, push notification tokens, support messages and communications with us. Website visits may involve IP addresses, browser information, cookie identifiers and analytics events, subject to applicable consent choices.

We do not ask you to upload information that is unnecessary for the procedure you choose.

4. Why we process data and our legal bases

  • Provide the GESTIA service (contract): register and authenticate accounts, remember language preferences, show relevant procedures, save drafts, generate documents, manage purchases and provide access to unlocked PDFs.
  • Meet legal obligations: retain required accounting, tax and transaction records and respond to legally binding requests.
  • Protect the service (legitimate interests): prevent misuse, troubleshoot failures, maintain security and handle support requests, balanced against your rights.
  • Optional communications (consent or another lawful basis where applicable): send promotional notifications about GESTIA offers and new features when permitted. You may opt out of promotional notifications.
  • Website measurement and advertising campaign attribution (consent where required): operate optional analytics and marketing tags on the public website according to your cookie choices.

Where a form requires particularly sensitive personal information, we assess and apply the additional protections and legal conditions required by applicable data-protection law. Providing the information needed to prepare a requested form is optional, but without it the form may be incomplete.

5. Your forms and generated documents

GESTIA uses the information you provide to populate corresponding official-source Spanish PDF forms. GESTIA is not a government submission portal, and preparing a PDF does not submit it to an authority.

Your drafts and generated documents are kept in private service storage for your account. Protected previews are used before an applicable purchase or unlock. Access to the original document is controlled by the app’s authentication and entitlement systems.

We do not use the content of your answers, immigration details or generated PDFs to create advertising audiences or to target advertisements.

6. Push notifications and messages

If you enable notifications, we use a device push token and your selected language to deliver GESTIA notifications through Firebase Cloud Messaging and the relevant mobile platform notification infrastructure.

We may use your citizenship, when relevant, to identify GESTIA procedure updates that could be useful to you-for example, the availability of a new document workflow relevant to a nationality group. We may also send optional promotions for GESTIA’s own services, such as a document offer, subject to applicable marketing rules and your notification preferences.

You can disable push notifications in your device settings. Promotional messages must also be subject to a separate, easy opt-out mechanism in GESTIA. We do not use the contents of your forms or PDFs to select marketing recipients.

Service emails, including account recovery and support correspondence, are handled through Proton Mail. We do not send third-party product advertising by email.

7. In-app purchases

Eligible digital purchases in the iOS and Android apps are processed through Apple In-App Purchase or Google Play Billing, respectively. The store handles the payment transaction under its own privacy terms. GESTIA receives the limited transaction and entitlement information needed to validate the purchase, provide access and meet legal obligations.

GESTIA’s document-preparation charges are separate from any official Spanish government fees (tasas), which may be described for informational purposes only.

8. Providers that help us operate GESTIA

We use service providers for specific operational purposes. This is not a sale of customer data or permission for providers to advertise their own products to our users.

  • Hetzner (Germany): infrastructure, hosting and backups for the service and website.
  • Proton Mail: service email and support communications.
  • Google Firebase Cloud Messaging and mobile platform push services: delivery of app notifications and processing of push tokens.
  • Apple and Google: in-app purchase processing, purchase verification and relevant platform services.
  • Website analytics and marketing technology: Google Analytics 4, Google Tag Manager and Meta Pixel where enabled on the website and subject to applicable consent requirements. Google Search Console may be used for aggregate search performance reporting.
  • Website asset services: external resources such as Google Fonts, Gravatar and jsDelivr may receive technical connection data when requested by a visitor’s browser.

Providers process only the information relevant to their roles, subject to applicable contractual and legal protections. We do not provide customer form contents or PDFs to advertising platforms for targeting.

9. Website analytics, advertising and cookies

The public GESTIA website may use cookies and similar technologies for essential functionality, visitor measurement and evaluation of campaigns promoting GESTIA. Advertising GESTIA on external platforms does not mean that third-party advertisements appear inside the GESTIA app or on the GESTIA website.

We use a cookie consent tool (SureCookie) to offer choices for non-essential technologies. Where consent is required, analytics and marketing tags should not activate until the visitor has made the relevant choice. Visitors may withdraw or change consent through the website’s cookie settings.

Details about individual cookies, providers and their lifetimes are provided in the Cookie Policy.

10. International data transfers

GESTIA’s primary hosting infrastructure is located in Falkenstein, Germany. Some external providers, including global platform, email, analytics and notification services, may process limited data outside the European Economic Area. Where required, we rely on an applicable adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses, together with relevant supplementary measures.

11. How long we keep data

  • Account, drafts, answers and documents: retained while your account remains active, unless you delete the data earlier or the service closes, subject to applicable legal obligations.
  • Account deletion: associated account data, drafts, form answers, generated PDFs, previews and push tokens are removed from active systems through the deletion process, except data we must legally retain.
  • Backups: server backups are retained for up to seven days before rotation. Deleted accounts must not be reactivated if a backup is restored; deletion controls are reapplied as necessary.
  • Accounting and transaction records: generally retained for six years under Spanish commercial recordkeeping rules, or longer where another applicable legal obligation or active legal claim requires it. Retained records are restricted to the necessary information.
  • Support and technical logs: retained only for as long as reasonably necessary for their purpose, security and legal obligations.

12. Delete your account

You can initiate account deletion in the GESTIA app through Profile → Delete Account and follow the confirmation steps. Deletion removes your account and associated app data from active systems, subject to limited legally required retention of financial records and temporary backup rotation described above.

If you cannot access the app, you can request account deletion using the instructions on our Account Deletion page or contact [email protected]. We may verify that you control the account before acting on a request.

Deleting an account is different from uninstalling the app. Uninstalling the app alone does not delete the account or stored documents.

13. How we protect your information

We apply technical and organisational measures designed to protect personal data, including authenticated access, private document storage, access controls, protected document previews, secure handling of credentials and server-side checks before an unlocked PDF is released. No internet service can guarantee absolute security.

14. Your privacy rights

Under applicable data-protection law, including the GDPR, you may have the right to request access, correction, deletion, restriction, portability or objection to certain processing, and to withdraw consent where processing is based on consent. Withdrawal does not affect processing lawfully performed before withdrawal.

To exercise your rights, contact [email protected]. We may ask for proportionate verification before disclosing or changing account information. You may also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or another competent supervisory authority.

For practical instructions, see Data & Privacy Requests.

15. Changes to this policy and contact

We may update this Privacy Policy to reflect changes in the service, legal requirements or data-processing practices. We will update the effective date and provide additional notice where required by law.

For questions about privacy, data protection or this policy, email [email protected].

Important: GESTIA is an independent service. It is not a Spanish government authority, does not submit documents on your behalf as a government portal, and does not provide legal advice.