Skip to content

We're a private service, not a government office

We speak español, English, català, français, 中文

Menu

Privacy policy

First, a summary in a table. Then, the details of each point, under article 13 of the General Data Protection Regulation (GDPR). The form and messages never ask for documents, document numbers, health information or criminal records.

Translation for information only. If there is any discrepancy, the Spanish version prevails.

Summary

Question Short answer
Who is the controller Diego Benítez Candia, NIF 60912324K, Ptge. Mulassa 12, planta SST, puerta 1, 08032 Barcelona. Email: exactitudfiscal@gmail.com
What for To reply to a request, prepare a quote, manage the work hired and, only with a separate tick box, send news
On what basis The data subject’s request and the contract (GDPR, art. 6.1.b), legal obligations (art. 6.1.c), consent for news (art. 6.1.a) and legitimate interest in website security (art. 6.1.f)
Who else processes them Cloudflare (hosting and form), on our behalf. Google (Gmail) provides the email. WhatsApp Ireland Limited, part of the Meta group, provides the messaging. Nobody receives them for advertising
Outside the European Economic Area (EEA) There may be transfers to the United States and other countries, with GDPR safeguards
For how long As long as needed for each purpose and, after that, blocked while liability can still be claimed
Rights Access, rectification, erasure, objection, restriction and portability. You can also complain to the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency)
Automated decisions None. A member of the team handles each case

1. Data controller

  • Controller: Diego Benítez Candia
  • Tax ID number (NIF): 60912324K
  • Address: Ptge. Mulassa 12, planta SST, puerta 1, 08032 Barcelona
  • Email: exactitudfiscal@gmail.com
  • Phone and WhatsApp: +34 623 82 89 38

Un Papel Menos is a private service. It is not the authorities: the data sent through this website do not reach any public body.

2. What data are processed and where they come from

Contact form.

  • Required data: what is needed (from a closed list), the name to call the person by, and a phone number, a WhatsApp number or an email address.
  • A separate, unticked box for anyone who wants to receive news.
  • Optional data, in a second part that can be skipped: the procedure the person thinks they need, their municipality, their preferred language and a short message.
  • It is also optional to say whether the person, or someone in their family, has Spanish nationality or the nationality of another country in the European Union (EU), the EEA or Switzerland. This is asked with a closed list, because it changes the procedure.
  • When the form is sent, the date, the page of the website it was sent from, its language and a reference to locate the request are also stored.

WhatsApp, phone, email and video call. The contact number or address and the profile name. Also whatever the person tells us about their situation.

If a procedure is hired. Identity, contact and billing details. Also those required by the procedure: for example, about residence, family, work, financial means or housing.

Other people’s data. Sometimes it is necessary to talk about family members or about whoever is offering an employment contract. Anyone who gives us those details must inform those people. This website is not aimed at minors. A procedure for a minor is hired by their legal representative (Organic Law 3/2018, art. 7).

3. What is never requested through the website or by message

The form, WhatsApp and email never ask for:

  • the NIE (foreigner identity number), the passport or other document numbers;
  • copies or photos of documents;
  • criminal records;
  • health information.

Nor does it ask about anyone’s immigration status: the form asks what is needed. If a procedure requires documents, they are provided through a secure channel indicated in each case. Never on WhatsApp or by email. The website does not allow files to be uploaded.

4. What the data are used for and on what basis

Purpose Legal basis
Replying to a request and saying which procedure applies and what it costs Pre-contractual steps at the data subject’s request (GDPR, art. 6.1.b)
Carrying out the case review and the quote Pre-contractual steps (GDPR, art. 6.1.b)
Managing the work hired: preparing and following the application file, giving updates and charging for it Performance of the contract (GDPR, art. 6.1.b)
Issuing invoices and meeting tax and accounting obligations Legal obligation (GDPR, art. 6.1.c)
Handling complaints, claims and requests to exercise rights Legal obligation (GDPR, art. 6.1.c; TRLGDCU, art. 21)
Sending news about immigration procedures Consent, with a separate, unticked box (GDPR, art. 6.1.a; LSSI, art. 21)
Keeping the website secure and protecting it from abuse Legitimate interest in website security (GDPR, art. 6.1.f)

No consent is requested to reply to a request. Next to the send button, the form summarises this information and links to this page.

To reply, a name and a way to get in touch are needed. Without them, the request cannot be handled. Receiving news is optional and does not affect anything else (Organic Law 3/2018, art. 6.3). Consent to receive news can be withdrawn at any time, as easily as it was given. Each message explains how to unsubscribe (LSSI, art. 22.1).

5. Who else processes the data

Un Papel Menos uses these providers for the website, email and messaging. Cloudflare processes data on behalf of Un Papel Menos (GDPR, art. 28). The email is a Gmail account, a service of Google Ireland Limited. WhatsApp Ireland Limited provides the messaging service and also processes data on its own account, under its own policy.

Provider What for Where and with what safeguards
Cloudflare, Inc. Website hosting, protection against attacks and receiving the form United States and its global network. Safeguards: EU-US Data Privacy Framework and standard contractual clauses, included in its data processing agreement
Google Ireland Limited (Gmail) Email Ireland, with transfers to Google LLC in the United States. Safeguards: EU-US Data Privacy Framework and standard contractual clauses
WhatsApp Ireland Limited (Meta group) WhatsApp messaging Ireland, with transfers to other group companies in the United States and other countries. Safeguards: EU-US Data Privacy Framework and standard contractual clauses

About WhatsApp. Anyone who writes on WhatsApp is using a service of WhatsApp Ireland Limited. That company also processes their data under its own privacy policy. On WhatsApp, only the situation and dates are discussed. Documents must not be sent through that channel.

Authorities and others. When a procedure that has been hired requires it, the necessary data reach the authority that decides on it. For example, the Oficina de Extranjería (government immigration office), the Policía Nacional (Spain’s national police), the Generalitat (Government of Catalonia) or the town hall. Data are also disclosed to the Agencia Tributaria (Spanish Tax Agency) or to judges and courts when the law requires it. If a person decides to contact a lawyer or an organisation, their data are not passed on without their permission.

The data are not sold or shared for advertising.

6. Transfers outside the European Economic Area

Some providers may process data outside the EEA. In those cases, the GDPR safeguards are used:

  • EU-US Data Privacy Framework, for certified US companies (Implementing Decision (EU) 2023/1795, GDPR art. 45).
  • Standard contractual clauses approved by the European Commission (GDPR, art. 46).

Information about these safeguards can be requested at exactitudfiscal@gmail.com.

7. How long they are kept

  • Requests that do not lead to a contract: as long as needed to reply. After that, they are deleted.
  • Quotes not accepted: a copy for 6 months from when the quote is not accepted, as required by the Consumer Code of Catalonia (art. 251-3.4).
  • Work hired: while the work lasts. After that, they are blocked for the periods during which liability can be claimed and those set by tax and commercial law (Organic Law 3/2018, art. 32).
  • News: until the person unsubscribes.
  • WhatsApp conversations and emails: on the same basis as the request or the work they belong to.

Blocking means keeping the data separately, without using them, only to respond to judges, courts or authorities. After that period, they are destroyed.

8. Rights and how to exercise them

Anyone can ask for:

  • access: to know which of their data are processed;
  • rectification: to correct inaccurate data;
  • erasure: to delete their data when they are no longer needed;
  • objection to certain uses, such as news;
  • restriction: for the data to be kept without being used while a question is resolved;
  • portability: to receive their data in a commonly used format.

They can also withdraw their consent at any time (GDPR, arts. 7.3 and 15 to 22).

How. Simply write to exactitudfiscal@gmail.com with the subject “Protección de datos” (Data protection), saying which right you want to exercise. If there are doubts about identity, the minimum information needed to confirm it will be requested. Copies of documents are never requested by email or WhatsApp.

Time limit. The reply arrives within one month at most. In complex cases, this period can be extended by two more months, with prior notice (GDPR, art. 12.3).

Complaint. If you are not satisfied with the reply, you can complain to the Agencia Española de Protección de Datos (AEPD). Its address is C/ Jorge Juan 6, 28001 Madrid. You can also complain through its online office.

9. Automated decisions and artificial intelligence

No automated decisions are made and no profiles are created (GDPR, art. 22). A member of the team handles each case.

The Which procedure do I need? tool runs in the browser and is general guidance only: it does not make any decision.

The texts on the website are written with the help of artificial intelligence and say so. If artificial intelligence tools are ever used with client data, it will be with a provider under a data processing agreement. This policy will be updated before that happens.

10. Security

  • The website is encrypted (HTTPS) and does not allow files to be uploaded.
  • Only the team handling each case has access to the data.
  • The documents for a procedure are provided through a secure channel with protected access, never on WhatsApp or by email.

11. Cookies

This website does not use analytics or advertising cookies. The details are in the cookie policy.

12. Changes to this policy

If this policy changes, the new version is published with its date. If the change affects how data already collected are used, the people affected will be informed.

Legislation and sources

Written with the help of AI and reviewed by the Un Papel Menos team on 14 October 2026.

Last updated: .