PRIVACY POLICY
Last updated: 19 August 2026
1. WHO WE ARE
PUENTE INTERNATIONAL LTD ("Puente International", "we", "us", "our") is the controller of the personal data described in this policy.
Legal name: PUENTE INTERNATIONAL LTD
Company number: 17399680
Registered in: England and Wales
Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: info@puenteinternational.com
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and — where we offer services to individuals in the European Economic Area — Regulation (EU) 2016/679 (EU GDPR).
If you have any question about this policy or about how we handle your data, contact us at info@puenteinternational.com.
2. SCOPE OF THIS POLICY
This policy explains how we handle personal data when you:
— visit puenteinternational.com;
— submit an enquiry, booking or consultation request through our website, by email, or through messaging channels such as WhatsApp or Telegram;
— engage us to assist with a Spanish residency or relocation matter;
— correspond with us as a partner, supplier or professional contact.
3. WHAT PERSONAL DATA WE COLLECT
Data you give us when making an enquiry
— name and preferred form of address
— email address, telephone number, messaging handle
— country of residence and nationality
— a description of your situation and objectives
Data we collect when you become a client
Depending on the residency route, this may include:
— identity and travel document data (passport, national ID, current visa or residence status)
— contact and address details, in your home country and in Spain
— family data: spouse or partner, children, dependent ascendants, including data relating to minors
— academic and professional data (qualifications, CV, employment history)
— financial and employment data: income, employment contracts or client agreements, company documents, bank statements, tax records
— healthcare cover data (private medical insurance or public cover)
— data relating to the existence or absence of a criminal record
— documents issued to you by the Spanish authorities, including resolutions and residence cards
Data collected automatically
— IP address, approximate location derived from it, browser and device type
— pages viewed, time on page, referring source
— cookie identifiers — see our Cookie Policy
4. SPECIAL CATEGORIES AND CRIMINAL OFFENCE DATA
Two categories require particular care and we treat them accordingly.
Criminal record data. Spanish residency applications require a certificate of criminal record (or its absence). This is criminal offence data under Article 10 UK GDPR and EU GDPR. We process it only where you have given us your explicit consent to do so for the purpose of preparing and submitting your application, and we rely on the condition in Schedule 1, Part 3 of the Data Protection Act 2018. You may withdraw that consent at any time, although we will not be able to continue with your application if you do.
Data relating to children. Family applications involve data about minors. We process such data only where it is provided by a parent or legal guardian who holds authority to do so, and we apply the additional safeguards required by Article 8 UK GDPR and EU GDPR. We do not knowingly collect data directly from children through our website.
Health data. We collect proof of healthcare cover. Where a document reveals health information beyond the fact of cover, we ask you to redact it before sending; if we receive it, we process it only as strictly necessary to establish that the cover requirement is met, on the basis of your explicit consent.
5. WHY WE PROCESS YOUR DATA AND ON WHAT LEGAL BASIS
Responding to your enquiry and assessing whether we can assist — steps taken at your request prior to entering into a contract, Article 6(1)(b).
Providing our advisory and case-management services — performance of our contract with you, Article 6(1)(b).
Transmitting your file to the Spanish professional who will act as your representative — performance of our contract with you, Article 6(1)(b).
Keeping records for accounting, tax and company law purposes — compliance with a legal obligation, Article 6(1)(c).
Establishing, exercising or defending legal claims — our legitimate interests in protecting the business, Article 6(1)(f).
Improving our website and understanding how it is used — our legitimate interests in operating an effective website, Article 6(1)(f), and your consent for non-essential cookies.
Sending you information about our services where you have asked to receive it — your consent, Article 6(1)(a).
Criminal record data and health data — your explicit consent, together with the conditions described in section 4.
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we have concluded that they are not. You may ask us for details of that assessment.
6. WHO WE SHARE YOUR DATA WITH
Spanish immigration professionals
This is the most significant disclosure we make, and we want it to be clear.
To obtain Spanish residency you must be represented before the Spanish authorities by a professional qualified to act in Spain — a gestor administrativo or a lawyer registered with a Spanish bar. We work with such professionals under written agreements. When you instruct us, we transfer your file to the professional handling your matter, and you grant that professional a direct mandate of representation.
That professional acts as an independent controller of your data, not on our behalf. They determine how they process your data in the exercise of their own profession and under their own professional and legal obligations, including professional secrecy. They will provide you with their own privacy information. You may exercise your rights against either us or them.
We will tell you the identity of the professional assigned to your matter before your file is transferred.
Other recipients
— Website and hosting: Tilda Publishing, which hosts puenteinternational.com and processes form submissions
— Communications: our email provider, and — where you choose to contact us that way — WhatsApp and Telegram
— Analytics: where you consent, analytics providers as described in our Cookie Policy
— Professional advisers: our accountants, auditors and lawyers, bound by confidentiality
— Payment providers: banks and payment processors handling your payments
— Authorities: where we are required to disclose by law, court order or a competent authority
We do not sell your personal data, and we do not share it for advertising purposes.
7. INTERNATIONAL TRANSFERS
We are established in the United Kingdom. The professionals who represent you are established in Spain. Your data therefore moves between the UK and the EEA.
From the EEA to us in the UK. On 19 December 2025 the European Commission renewed its adequacy decision for the United Kingdom under the EU GDPR. Transfers from the EEA to the UK may therefore be made without additional safeguards. That decision runs until 27 December 2031 unless extended or withdrawn. If it ceases to apply, we and our Spanish partners will put in place Standard Contractual Clauses, and transfers will be suspended in the meantime.
From us in the UK to Spain. Spain is covered by UK adequacy regulations for EEA countries, so no additional safeguards are required.
Where any other recipient is located outside the UK or EEA, we rely on adequacy regulations or, where none apply, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You may request a copy of the safeguards in place.
8. HOW LONG WE KEEP YOUR DATA
Enquiries that do not become engagements — 12 months from last contact.
Client files and case documentation — 6 years from the end of our engagement.
Accounting and tax records — 6 years from the end of the relevant financial year, as required by UK law.
Marketing consents and records of consent — until consent is withdrawn, plus 2 years.
Website analytics data — as stated in our Cookie Policy.
We keep client files for six years because that is the period within which a claim may generally be brought against us under the Limitation Act 1980. During that period the data is restricted to what is necessary for that purpose. After the applicable period we delete the data securely or anonymise it.
9. YOUR RIGHTS
Under the UK GDPR and the EU GDPR you have the right to:
— be informed about how we use your data — this policy serves that purpose
— access the personal data we hold about you
— rectification of data that is inaccurate or incomplete
— erasure of your data, where one of the grounds in Article 17 applies
— restriction of processing in the circumstances set out in Article 18
— data portability for data you provided to us, where processing is based on consent or contract and carried out by automated means
— object to processing based on our legitimate interests, and to direct marketing at any time
— withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
We do not carry out automated decision-making producing legal effects, and we do not carry out profiling.
To exercise any of these rights, email info@puenteinternational.com. We will respond within one month. We may ask you to verify your identity. If your request relates to processing carried out by the Spanish professional acting for you, we will pass it to them within three working days and tell you that we have done so.
10. COMPLAINTS
If you are unhappy with how we have handled your data, please tell us first — we would rather resolve it directly.
You also have the right to complain to a supervisory authority:
United Kingdom — Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk
Spain — Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid. aepd.es
Elsewhere in the EEA — the supervisory authority of the country where you live or work.
11. SECURITY
We apply technical and organisational measures appropriate to the risk, including access limited to those who need it, multi-factor authentication on the systems holding your information, encryption of data in transit, logging of access, and backups with tested restoration procedures.
If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, we will notify you without undue delay.
Please note that email is not inherently secure. Where you send us sensitive documents, we will offer a secure channel.
12. COOKIES
Our use of cookies is described in our Cookie Policy.
13. CHANGES TO THIS POLICY
We may update this policy to reflect changes in our practices or in the law. The date at the top shows when it was last revised. Where changes are material, we will notify clients directly.
PUENTE INTERNATIONAL LTD is registered in England and Wales, company number 17399680.
