Privacy Policy
Last updated: February 21, 2026
1. Data Controller
The data controller responsible for your personal data is:
- Name: Nomadlex (Branislav Miladinovic, autónomo)
- NIF: Z1332902B
- CNAE: 6201 / 6312
- Address: Calle Bany dels Pavesos 7, 46001 Valencia, Spain
- Email: hello@nomadlex.io
As a small organization, we have not appointed a Data Protection Officer (DPO). For any privacy-related inquiries, please contact us at hello@nomadlex.io.
2. Data We Collect
Account Data
When you create an account, we collect your full name, email address, and optionally your nationality.
Eligibility Checker Data
When you use our Eligibility Information Tool, we collect nationality, monthly income range, employment type, education level, years of experience, health insurance status, criminal record status, countries of interest, and your email address.
Booking Data
When you book a consultation, we collect information related to the booking including the selected lawyer, country, price, and any notes you provide.
Technical Data
We use Plausible Analytics, which is a privacy-first, cookieless analytics service. It does not collect any personal data or use cookies.
3. Special Category Data (Nationality & Immigration)
Our service processes nationality and immigration-related data, which may constitute special category data under GDPR. We process this data based on your explicit consent (Article 9(2)(a) GDPR), which you provide when using our Eligibility Information Tool or creating an account with nationality information.
You may withdraw this consent at any time by contacting us at hello@nomadlex.io or deleting your account.
4. Lawful Basis for Processing
We process your personal data on the following legal bases:
- Contract performance (Art. 6(1)(b)): To provide our marketplace services, process bookings, and manage your account.
- Consent (Art. 6(1)(a)): For processing nationality and immigration-related data through the Eligibility Information Tool.
- Legitimate interest (Art. 6(1)(f)): For platform security, fraud prevention, and improving our services.
5. How We Use Your Data
- Provide and manage your account
- Run eligibility assessments through our rule-based Eligibility Information Tool
- Facilitate bookings between you and independent immigration lawyers
- Process payments through Stripe
- Send transactional emails (booking confirmations, etc.)
- Improve and maintain the platform
6. Third-Party Data Processors
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, storage | EU (Frankfurt) |
| Vercel | Web hosting, CDN | Global (Edge) |
| Stripe | Payment processing | US/EU |
| Cloudflare | DNS, CDN, email routing | Global (Edge) |
| Resend | Transactional email | US |
| Plausible | Privacy-first analytics (no personal data collected) | EU |
7. International Data Transfers
Your primary data is stored in the EU (Supabase, Frankfurt). Some of our processors operate globally. Where data is transferred outside the EEA, we ensure adequate protection through:
- EU adequacy decisions (where applicable)
- Standard Contractual Clauses (SCCs) approved by the European Commission
- EU-US Data Privacy Framework (for US-based processors that are certified)
8. Data Retention
- Account data: Retained until you request deletion of your account.
- Eligibility check data: Retained for 2 years from the date of the check, then automatically deleted.
- Booking data: Retained for the duration required by Spanish tax and commercial law (minimum 5 years).
- Payment data: Retained by Stripe in accordance with their data retention policy and applicable financial regulations.
9. Your Rights Under GDPR
Under the General Data Protection Regulation, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): Request deletion of your personal data.
- Right to portability: Receive your data in a structured, commonly used, machine-readable format.
- Right to object: Object to processing based on legitimate interests.
- Right to restrict processing: Request that we limit the processing of your data.
- Right to withdraw consent: Withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).
To exercise any of these rights, please email us at hello@nomadlex.io. We will respond within 30 days.
10. Right to Lodge a Complaint
If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Authority:
- Authority: Agencia Espanola de Proteccion de Datos (AEPD)
- Website: www.aepd.es
- Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any significant changes by posting a notice on our platform or sending you an email. The "last updated" date at the top of this page indicates when this policy was last revised.