1. Data Controller
| Controller | Gestoría Online Gala |
|---|---|
| Tax ID (CIF) | [PENDING — see Legal Notice] |
| Address | C/Sacedón 8, 19200, Azuqueca de Henares (Guadalajara) |
| Contact email | info@gestoriagala.com |
| Phone | 642 29 88 22 / 949 26 32 62 |
2. What data we process
- Identification and contact details: name, surnames, ID/NIE, address, phone, email.
- Account data: login credentials (your password is stored encrypted by Firebase Authentication; the Agency never sees it in plain text), session history.
- Case-related data: information specific to each procedure (for example, data about a vehicle, an employment relationship, a company, etc.), depending on the form you complete.
- Attached documentation: photographs or scans of documents you provide to process your case (ID card, permits, certificates, receipts, etc.).
- Payment data: when you pay online, your card is processed directly by Redsys (the banking payment gateway); the Agency never receives or stores your full card number.
- Messages: the content of the messages exchanged between you and your assigned case manager within your case file.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Manage your client account and give you access to "My Account" | Performance of the mandate agreement (Art. 6.1.b) |
| Process the assignment you give us (the specific procedure) | Performance of the mandate agreement (Art. 6.1.b) |
| Comply with tax, accounting, and document-retention obligations | Compliance with a legal obligation (Art. 6.1.c) — Spain's General Tax Law, Commercial Code |
| Commercial communications (newsletter, offers) | Explicit consent, always optional (Art. 6.1.a) — see Commercial Communications |
| Platform security and fraud prevention | Legitimate interest (Art. 6.1.f) |
4. How long we keep your data
We apply the principle of data minimization: we keep each piece of data only for as long as necessary for the purpose that justifies it.
- Case file data (specific procedure: case data, attached documentation, associated messaging): kept while the case is active and, once closed, for 5 years from the closing date. After that period, the case file data is automatically deleted (see below, "Automatic deletion of case files").
- Client profile data (name, ID, contact details): kept while you keep your account active, and serve as a reference for future procedures so you don't have to enter them again. They are not deleted along with a specific case file — they are only deleted if you request the closure of your account (see "Your rights" below).
- Consent records (what you accepted when creating the account and when): kept as proof of consent, in accordance with the principle of proactive accountability under Art. 5.2 GDPR, unless you exercise your right to erasure over your account.
Automatic deletion of case files (5 years)
Once 5 years have passed since a case file's closing date, an automatic process permanently deletes the data belonging to THAT case file (case data, associated documents in our storage, and linked messaging). Your client profile is not affected: it continues to exist so you can keep working with us, and so that, if in any specific instance tax or commercial regulations still required keeping some minimal piece of data, that data is kept through the appropriate channel (for example, in our own internal accounting), never in the case file that has already been deleted.
5. Who we share your data with
We do not sell or transfer your data to third parties for commercial purposes. We share data only with the providers strictly necessary to provide you with the service, all of them acting as data processors (Art. 28 GDPR) under contract:
| Provider | What we use it for | Where your data is |
|---|---|---|
| Google Firebase (Firestore, Authentication) | Case/client database and account access | Google Cloud/Firebase infrastructure (Google Ireland Ltd.), covered by the EU-U.S. Data Privacy Framework for any processing outside the EEA |
| Own storage (NAS, MinIO server) | Custody of the documentation you attach to your case | Physical server owned by the Agency, located on its own premises in Azuqueca de Henares (Spain) — not hosted on any third-party cloud |
| Redsys | Card payment processing | Spain (banking payment gateway) |
| Raiola Networks | Hosting of the public website | Spain/EU |
We do not share data with public bodies except when necessary for the procedure you have entrusted to us (for example, submitting your application to the DGT or Social Security) or when there is a legal obligation to do so.
Commercial/advertising use of your data: if you have given your consent, we use your email to send you advertising about our own services only — we never sell or transfer your data to other companies, advertisers, or advertising networks so they can send you theirs. Full details, including how to unsubscribe in one click, are available in Commercial Communications and Advertising Use of Your Data.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability at any time, free of charge, by writing to info@gestoriagala.com or by post to our address. You can also:
- Delete your account directly from "My Account" → "Delete my account", without needing to write to us (that same screen explains exactly what happens to your case files when you do so).
- Withdraw your consent to commercial communications at any time, without affecting the rest of your relationship with us (see Commercial Communications).
If you believe we have not properly handled your request, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
The documentation you attach is transmitted encrypted (HTTPS/TLS) and automatically scanned with antivirus software (ClamAV) before becoming visible; infected files are deleted and never reach our team. Access to documents always requires authentication and is limited to you and to Agency staff authorized for your case.