Privacy policy

Last updated: 4 September 2026

1. Data controller

The controller of the personal data collected through this website and through our client portal (migrant.overys.com and app.overys.com, brand Overys Migrant Mobility) is Jose Antonio Rodes López, lawyer, with Spanish tax number (NIF) 48343036A and professional address at Av. Maisonnave, 46 – 4D, 03003 Alicante (Spain).

For any question about your data you can write to privacy@overys.com.

2. What data we process

The data you give us in the forms on this site (for example, your name and email address when you request a guide or a resource).
The data you give us when you engage or enquire about our immigration and international mobility advisory services (identification and contact details and those needed for your case file).
Technical and browsing data collected through cookies, according to your choice in the consent banner.

3. What for and on what legal basis

Providing our services and managing your case file, application or commercial transaction (performance of a contract or pre-contractual steps).
Sending you the resource you requested and a short series of related informative emails, if you have consented by ticking the corresponding box (consent, which you may withdraw at any time using the unsubscribe link in each email or by writing to privacy@overys.com).
Answering your enquiries (legitimate interest in attending to those who contact us).
Complying with legal obligations, including the professional conduct rules of the legal profession and tax obligations.

4. Recipients

We do not sell your data. To provide the service we rely on providers acting as data processors under the contracts required by the GDPR: email platform (Brevo, EU), automation and management tools, and the hosting of this website and of our client portal. Should any provider process data outside the European Economic Area, the appropriate safeguards provided for in the GDPR (such as standard contractual clauses) would apply.

Your data may be disclosed to the competent public authorities only where necessary to process your case file or by legal obligation.

5. How long we keep your data

For as long as the professional relationship lasts or, in the case of informative communications, for as long as you do not withdraw your consent. After that we keep the data blocked for the applicable limitation periods and then delete it.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to privacy@overys.com, stating the right you are exercising and providing a detail that allows us to identify you. You may also lodge a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es).

7. Confidentiality and security

We apply appropriate technical and organisational measures to protect your data. In addition, the information linked to your case file is covered by the professional secrecy of the legal profession.

8. Accepting quotes and contracts in the client portal

When you accept a quote and its terms in our client portal, we keep a record of that acceptance so that we can evidence when and on what terms the contract was concluded.

What we record: the date and time of the acceptance, the IP address from which it is accepted, the version and language of the document accepted (quote and General Terms) and the declarations you ticked before accepting.
What for: to evidence the conclusion and the content of the contract —who accepted, when, from where and exactly which document— and to be able to defend our position if it is ever disputed. We do not use this data for any other purpose: we do not build profiles, we do not geolocate you and we do not use it for marketing.
On what legal basis: the formation and the performance of the contract you entrust to us (Art. 6(1)(b) GDPR) and our legitimate interest in being able to prove the contracting and to defend ourselves against claims (Art. 6(1)(f) GDPR). We do not need your consent: the record is part of the formation of the contract itself, just as the date and the signature are in a paper contract.
How long we keep it: for as long as the engagement lasts and until the actions arising from the contract become time-barred (five years from its termination, Art. 1964.2 of the Spanish Civil Code). After that we delete or anonymise it.
Who it is disclosed to: no one. It would only be produced before a court or before the competent authority or body if it were necessary to evidence the contracting or to defend ourselves in proceedings.

As this processing relies in part on our legitimate interest, you may object to it on the terms of section 6. If you object, we may continue to keep the record for as long as it remains necessary to evidence the contract or to defend ourselves against a claim.

9. The migration test: the questionnaires before you engage us

Before engaging us for anything, you can tell us about your situation in a short questionnaire so that we can prepare your guidance. You can complete it on our website (app.overys.com), in a PDF that we send you and you return to us over WhatsApp, or by answering the questions over the phone or at a meeting while a member of our team writes them down. The questions are the same in all three cases.

What we ask you: where you are and with what administrative status; your nationality; what you live on and who pays you; since when; whether your work can be done remotely; your education or your experience; who is coming with you; an income bracket; how urgent your situation is; what worries you most; and, if you wish, a free comment. And a single means of contact, phone or email, whichever you prefer — not both.
What we do not ask you for: no document number and no copy of any document; no photograph; no exact income figure, only the bracket; no health data and no criminal record. Nor do you need to create an account or a password to complete it.
What for: to understand your situation and prepare guidance for you —which routes fit what you tell us and what would have to be evidenced in your case—, which is given to you by a member of our team, not an automated system. The questionnaire prepares that answer; it does not replace it and it does not decide anything on its own.
On what legal basis: the pre-contractual steps that you yourself request from us by completing it (Art. 6(1)(b) GDPR). That is: we process it because you have asked us to advise you.
Aggregate use, only if you consent to it: there is a separate tick box, not pre-ticked and not necessary in order to complete the test — “you may use my answers, without my name or my contact details, together with those of other people, to understand which questions are the most frequent and to write about them”. If you do not tick it we look after you in exactly the same way; you are simply left out of that count. You can withdraw that consent whenever you like by writing to privacy@overys.com (Art. 6(1)(a) GDPR).
Who helps us process it: the hosting of app.overys.com if you complete it on the website, and WhatsApp itself as the means of transport if you return the PDF to us that way (see section 10). If you answer over the phone or in person, no one. On the test page we do not use third-party analytics: no Google Analytics, no advertising pixels, and no fonts or scripts served from third-party servers.
How long we keep it: if the enquiry does not end in an engagement, 12 months from the last time we spoke, and after that we delete or anonymise it. If it does end in an engagement, it becomes part of your case file and follows the period in section 5.
If you complete it on someone else’s behalf: if you answer for a family member, you are providing us with their data. We will tell them so at the first contact we have with that person, and they will be able to exercise their rights just as you can (section 6).

10. Conversations with you, and their later use to write content

A large part of the relationship happens in conversation: WhatsApp, phone, email or a meeting. That is where you tell us about your case and send us documents, and that forms part of the advice and of your case file (sections 2 to 5). When the channel is WhatsApp Business, WhatsApp Ireland Limited acts as a processor on our behalf and the content of the messages travels end-to-end encrypted; the transfers outside the European Economic Area that this service entails are covered by the standard contractual clauses provided for in the GDPR.

We also want to use a set of those conversations in order to know what is being asked, in what words and at what moment, and so write guides and articles that answer what really worries people. We are telling you here before doing it, because it is a purpose other than the one for which you wrote to us (Art. 13(3) GDPR).

How we do it, which is what makes it possible: before anything is analysed, a program that runs on our own computers and with no internet connection replaces names, phone numbers, email addresses, links, document numbers, bank accounts, amounts and dates. We do not keep any table that would allow that replacement to be undone: it is irreversible by design. Afterwards, a member of our team reviews the result and expressly checks that no health data and no criminal records remain, which are left out of the analysis. Identifiable material does not leave our computers and is not sent to any third-party service.
What comes out of it: wordings and frequencies —how many people ask about something and in what words—, never cases. No published piece contains your case, your name or anything that would allow you to be recognised.
On what legal basis: as this is a different purpose, we have assessed it against the original one as Art. 6(4) GDPR requires: it is aimed at the same group of people we already advise, it produces no decision about you and the prior replacement of the identifying data is its safeguard. The only step that processes personal data is that replacement itself, and we base it on our legitimate interest in better informing those who consult us (Art. 6(1)(f) GDPR). Once it is done, the result is no longer personal data.
How long we keep it: the raw copy of the conversations that are processed is an intermediate step and is deleted as soon as the version without identifying data has been reviewed.

As this use relies on our legitimate interest, you may object by writing to us at privacy@overys.com, and we will exclude your conversations. Unlike section 8, here the objection has no exceptions: there is no evidential need limiting it. Objecting does not affect in any way the advice you receive.

11. The newsletter and our information emails

If you leave us your email on the website, we write to you now and then with what we learn handling international mobility cases. The same applies if you download one of our materials. It is voluntary, you do not need it to engage us, and you can stop receiving it whenever you like.

What we ask you for: your email, which is the only thing we really need; your name if you wish, just to greet you; and the language you prefer to read us in. Nothing else: not your immigration status, not documents, nothing from your case file.
What else we keep: which form you came from and when, the date you ticked the box, the date you confirmed, and whether you open our emails or click their links — so we stop writing to people who do not read us.
Who helps us: Brevo (Sendinblue SAS) sends the emails and keeps the list, and n8n connects the form to it. Nobody else receives this data: we neither sell it nor share it.
How long we keep it: for as long as you stay subscribed. If you unsubscribe, we keep only your email and the date you left, so we do not write to you again by mistake. And if you sign up but never confirm, we delete it after 30 days.

The basis for writing to you is your consent (Art. 6(1)(a) GDPR): the box on the form is not pre-ticked and, afterwards, we send you an email to confirm; until you click it we write you nothing else. You may withdraw it at any time from the unsubscribe link in every email we send, and withdrawing it does not affect what we did before.

Unsubscribing from the newsletter does not leave you without news of your case file: if you have engaged us for a procedure, those communications are part of the engagement and rely on the legal basis in section 3, not on this one.

12. Processing-time statistics

We publish on our website how long the procedures we handle really take: the days that pass, in the typical case (the median), between filing and decision, or between a nationality decision and the oath. That figure comes from the dates in our clients’ case files, including closed ones, and from nothing else: no names, no nationality, no city, no outcome of any individual case. No date ever leaves our system, and we only show a figure when at least five different case files support it, so nothing we publish can be linked to a person.

The basis is our legitimate interest (Art. 6(1)(f) GDPR) in informing with our own data and in measuring our service. You may object through the means described in the rights section of this policy, and your case file will no longer be counted in future statistics.

13. Cookies

This site uses cookies according to your choice in the consent banner, which you can change at any time. Non-essential cookies are only installed if you accept them.

14. Changes to this policy

We will publish any update to this policy here, stating its revision date.