GetMyNIE

Privacy Policy

Last updated: March 2026

1. Data Controller

GetMyNIE Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are registered in Cyprus and operate the platform at getmynie.com.

Contact: contact@getmynie.com

2. Data We Collect

We collect the following categories of personal data:

  • Account data: name, email address, password (hashed).
  • Identity documents: passport scans, photos, and any supporting documents you upload for your NIE application.
  • Personal information: nationality, date of birth, current address, and other details required by Spanish authorities.
  • Billing information: name, company name, VAT number, billing address. Payment card data is handled exclusively by Stripe and never stored on our systems.
  • Communications: messages exchanged with our team through the platform.
  • Technical data: session tokens, IP address, browser type, for security and service operation purposes.

3. Legal Basis for Processing

We do not use your personal data for marketing or advertising, and we do not sell or share it with third parties for their own purposes.

  • Contract performance (Art. 6(1)(b) GDPR): we process your data to deliver the NIE service you have purchased.
  • Legal obligation (Art. 6(1)(c) GDPR): we retain invoices and payment records to comply with EU VAT and accounting regulations.
  • Legitimate interest (Art. 6(1)(f) GDPR): we process technical data to maintain platform security and prevent fraud.

4. How We Use Your Data

  • To create and manage your account.
  • To prepare and submit your NIE application to the relevant Spanish authorities.
  • To communicate with you about your case status.
  • To process payments and issue VAT invoices.
  • To comply with our legal and regulatory obligations.

5. Third-Party Service Providers

We share your data with the following processors solely to deliver our service:

All processors are bound by Data Processing Agreements and are required to process your data only on our instructions.

  • Stripe — payment processing. Stripe is PCI-DSS certified and operates under its own privacy policy.
  • Resend — transactional email delivery (account notifications, status updates).
  • Neon — hosted PostgreSQL database where your data is stored, located in the EU (AWS eu-central-1).
  • Vercel — cloud platform hosting the application. Data is processed under a Data Processing Agreement.

6. International Transfers

Some of our service providers may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place — either an EU adequacy decision for the destination country, or Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention

  • Account and application data: retained for 5 years after the completion or cancellation of your case, after which it is deleted or anonymised.
  • Invoices and financial records: retained for 7 years as required by Cyprus accounting law and EU VAT regulations.
  • Uploaded identity documents: deleted within 90 days of case completion unless retention is required by law.

8. Your Rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectification of inaccurate or incomplete data.
  • Erasure ("right to be forgotten") where there is no overriding legal basis for continued processing.
  • Restriction of processing in certain circumstances.
  • Data portability — receive your data in a structured, machine-readable format.
  • Object to processing based on legitimate interests.

To exercise any of these rights, contact us at contact@getmynie.com. We will respond within 30 days.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for GetMyNIE is the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy). You may also contact the data protection authority in your country of residence.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified by email or by a prominent notice on the platform. The "last updated" date at the top of this page reflects the most recent revision.