a
Privacy Policy
Last updated: 4 October 2026.
This Privacy Policy explains how CABR Relocation Solutions for Expats, S.L. processes personal data relating to clients, prospective clients, website users and other individuals who interact with the company.
1. Data Controller
CABR Relocation Solutions for Expats, S.L.
Tax ID (CIF): B72573744
Registered office: Calle Cristóbal Bordiú 35, Entreplanta B, 28003 Madrid, Spain.
Email: info@relocationforexpats.es
Legal representative of the company: Roberto Solana Uriarte.
2. Data Protection Officer
CABR has appointed an external Data Protection Officer: APC Consulting, S.L. The DPO can be contacted at igarcia@consultoriaapc.es.
3. Personal data we may process
Depending on your relationship with CABR and the service requested, we may process identification and contact data, nationality and residence information, data required for immigration or administrative procedures, information relating to relocation and property services, data required for insurance mediation or management, billing and payment information, communication preferences and information voluntarily provided through forms, email, telephone calls or conversations with our virtual assistants.
We apply the data minimisation principle and seek to request only information that is necessary for each purpose. You should not send sensitive documents or special-category information unless it is required for a specific service and you have been given an appropriate channel.
4. Purposes and lawful bases
- Responding to enquiries and information requests: managing contacts made through the website, email, telephone, forms, messaging or virtual assistants. The lawful basis is taking pre-contractual steps at the data subject’s request and, where appropriate, CABR’s legitimate interest in managing professional communications.
- Providing contracted services: immigration and international mobility, administrative management, relocation, property search, insurance and other contracted services. The lawful basis is performance of a contract and pre-contractual steps requested by the client.
- Compliance with legal obligations: tax, accounting, corporate, administrative, anti-fraud and other obligations applicable to CABR.
- Marketing communications: where applicable, information about CABR’s own services. The lawful basis will be consent when required or legitimate interest in cases permitted by law. Consent may be withdrawn and marketing may be objected to at any time.
- Security, quality and service improvement: system maintenance, misuse prevention, traceability, quality control and process improvement on the basis of CABR’s legitimate interests, while respecting data subjects’ rights and freedoms.
- Cookies and analytics: non-essential cookies and equivalent technologies are used only where a valid legal basis exists, including consent where required. Preferences can be reviewed and changed through the Cookie Policy.
5. Artificial intelligence virtual assistant (Claire)
CABR uses an artificial intelligence virtual assistant to provide initial assistance, classify enquiries and collect the information needed for the appropriate team to follow up. The assistant identifies itself as an AI system and does not replace professional review by lawyers, insurance professionals, relocation specialists or other qualified professionals.
Information provided during a conversation may be entered into CABR’s management systems where necessary to handle the enquiry. Under the current configuration, audio from new conversations is not retained by the AI agent; transcripts and associated conversation data may be retained for up to 90 days for enquiry management, quality control and traceability.
CABR does not use this assistant to make solely automated decisions that produce legal effects or similarly significantly affect an individual. Relevant professional decisions are subject to human review.
5A. Visa eligibility quiz
CABR may use a visa eligibility quiz to provide an initial screening of possible immigration routes. Depending on the user’s answers, the quiz may collect identification and contact details, nationality and residence information, family composition, intended move timeline, information about income, savings, employment, professional activity, qualifications and studies. It may also record technical and campaign-attribution data such as landing page, referrer, UTM parameters and, where present, identifiers associated with advertising campaigns.
The public quiz is designed not to request detailed criminal-record information, medical information or other highly sensitive information. Where a professional review of background, eligibility or sensitive documentation is necessary for a specific immigration matter, CABR will request it later through an appropriate private channel. The quiz result is indicative only and does not constitute legal advice or a final decision on whether a visa or residence authorisation will be granted or refused. Relevant cases are subject to human review.
6. Sources of personal data
Personal data is generally obtained directly from the data subject or their representative. It may also be received from collaborators, partners or referrers, service providers required for a requested service, public authorities or legitimately accessible sources where a lawful basis exists. Where personal data has not been obtained directly from the data subject, CABR will provide the information required by applicable law where relevant.
7. Recipients
Where necessary for the relevant purpose or required by law, data may be disclosed to public authorities, consulates, immigration authorities, police, municipalities, tax and social-security bodies, insurers, financial institutions, educational institutions, landlords, real-estate agencies or professionals, notaries, registries, advisers and other recipients connected with the service requested.
CABR also uses professional and technology providers that may act as processors or independent service providers, depending on the service. Current providers may include GoDaddy and WordPress-related infrastructure for hosting and website operation, Cloudflare for security and traffic protection, Zoho for CRM, forms and business workflows, Microsoft 365 for email and productivity, Calendly for appointment scheduling, Google services and MonsterInsights for consent-based analytics, and ElevenLabs for the Claire AI virtual assistant. These providers are used only where necessary for the relevant purpose and subject to the applicable contractual, technical and legal safeguards.
8. International data transfers
Some technology providers, including providers used for CRM, cloud productivity, analytics, scheduling, security or artificial-intelligence services, may be established outside the European Economic Area or use infrastructure or subprocessors located in third countries. Where an international transfer takes place, CABR will rely on a transfer mechanism permitted by the GDPR, such as an adequacy decision, Standard Contractual Clauses or another legally valid safeguard, as applicable. Additional information about the applicable transfer mechanism may be requested using the contact details in this Policy.
9. Retention periods
Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected. Client data will be retained for the duration of the contractual relationship and afterwards for as long as necessary to comply with legal obligations and address potential liabilities. Prospective-client and enquiry data will be retained for the period reasonably necessary to manage and follow up the enquiry and subsequently for the periods required to defend potential claims. Data used for marketing will be retained until consent is withdrawn or the right to object is exercised, without prejudice to retaining the minimum information necessary to evidence such a request.
10. Your rights
Where applicable, you may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw consent, by contacting info@relocationforexpats.es. The request must allow CABR to identify the data subject and the right being exercised.
You may also contact the Data Protection Officer at igarcia@consultoriaapc.es. If you believe that the processing of your personal data does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).
11. Children’s data
CABR’s services are primarily intended for adults. Where a case or service requires the processing of a child’s data —for example in family immigration, schooling or relocation matters— the information must be provided by the child’s legal representatives or otherwise processed on another valid legal basis, and will be limited to what is strictly necessary.
12. Security and confidentiality
CABR applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure, taking into account the nature of the data, the context of processing and the risks involved. No system can guarantee absolute security, and measures are therefore reviewed and adapted periodically.
13. Cookies
The website may use technical cookies and, subject to consent where required, analytics, personalisation or third-party cookies. Detailed information is available in the Cookie Policy, where preferences may also be changed.
14. Updates to this policy
CABR may update this Privacy Policy to reflect legal, organisational, technological or service changes. The current version will be the one published on this page and will display its latest update date.