Privacy notice and GDPR commitments

BCN Student (the “controller”) determines how and why your personal data is processed. Contact for all data-protection matters, including exercising the rights below: [email protected].

Your email address, to sign you in. The answers you enter for each application: names, passport number, NIE if you have one, gender, birth details, nationality, marital status, parents’ given names, your Spanish address, phone number and email, your date of entry into Spain, and which documents you say you have. When you pay for an application, your name, billing address and, for a business, tax ID, which Stripe collects for the invoice.

You type your details in yourself. If you choose, you can instead photograph the photo page of your passport: with your explicit agreement, the photo is read on our own server (nothing is sent to any third party), its machine-readable lines are used to suggest your details, and the photo is not stored or logged. Only the values you confirm are saved. Nothing else is uploaded.

Legal basis: performance of a contract with you (GDPR Art. 6(1)(b)). We collect this data because Spanish residency forms require it — not because we want it. We do not collect health data, biometric data or any special-category data under Art. 9.

Your answers are encrypted at rest with AES-256-GCM, each application under its own key and bound to that application. Those keys are themselves encrypted under a master key kept separately from the database and its backups — so a copy of the database or of a backup decrypts nothing on its own, and one compromised record never exposes another. Your email address is encrypted too; a separate keyed hash lets us find your account when you sign in without storing the address readably.

All traffic is served over TLS 1.3 only, with HTTP Strict Transport Security. Payment card details are handled entirely by Stripe and never reach our servers.

An honest limitation: this is strong encryption at rest, but it is not end-to-end encryption. Our software decrypts your answers to fill in your forms, and the keys live on the same server. No screen shows your answers to a person as part of the service, and the operator’s dashboard only counts applications. Any service telling you it holds your passport under end-to-end encryption while also filling in your paperwork is describing something that cannot be true.

An application that has not been touched for 30 days is permanently deleted, automatically. This runs as a scheduled job, not a manual promise, and the deletion is irreversible. You can also delete one application, or your whole account, yourself at any time from your dashboard, and the deletion is immediate.

An account with no applications is deleted two years after you last signed in. An account whose sign-in link was never used is deleted after a week.

One thing survives deletion, and only this: invoice data. Spanish commercial and tax law (Código de Comercio Art. 30; Ley General Tributaria) requires invoice records to be kept for several years, and that obligation overrides erasure requests for those specific records under GDPR Art. 17(3)(b). An invoice holds the payer’s name, billing address and, for a business, its tax ID — stored encrypted — plus the amounts. It never includes your passport number or your answers.

Stripe (payment processing, Ireland/USA under the EU-US Data Privacy Framework); Resend (delivery of our emails, such as your sign-in links); and the EU-based provider of our server — each under a data processing agreement. We do not sell your data, we do not share it with advertisers, and we do not transfer it outside the EEA except as stated here.

Public authorities receive only what you submit to them yourself, in your own name.

You may request access to your data, correction of inaccuracies, erasure, restriction of processing, portability in a machine-readable format, and you may object to processing. From your dashboard you can download everything we hold about you as a file, and erase it. Where processing rests on consent, you may withdraw it at any time.

We respond within one month. If you are unsatisfied, you may complain to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, or at aepd.es.

If a breach occurs that is likely to result in a risk to your rights, we notify the AEPD within 72 hours and inform you directly without undue delay. We will tell you what was accessed, not a vague reassurance.

This site sets no advertising cookies and runs no third-party trackers. It measures visits with a self-hosted analytics tool that sets no cookies and does not identify you. The cookies it does set are: bcn_user, which keeps you signed in for up to 30 days; bcn_app, which keeps the application you are working on open for up to 7 days; and, during checkout, cookies Stripe sets for fraud prevention.

Two more first-party cookies are set only if you follow a guide link or download our guide: bcn_src, which records the school link you came through, and bcn_guide, an anonymous download identifier. Each lasts 30 days, contains no name, email or other detail about you, and is used only to count how many guide readers go on to start an application.