Privacy Policy

Last updated: 19 September 2026.

This Privacy Policy explains how CABR Relocation Solutions for Expats, S.L. processes personal data relating to clients, prospective clients, website users and other individuals who interact with the company.

1. Data Controller

CABR Relocation Solutions for Expats, S.L.
Tax ID (CIF): B72573744
Registered office: Calle Cristóbal Bordiú 35, Entreplanta B, 28003 Madrid, Spain.
Email: info@relocationforexpats.es
Legal representative of the company: Roberto Solana Uriarte.

2. Data Protection Officer

CABR has appointed an external Data Protection Officer: APC Consulting, S.L. The DPO can be contacted at igarcia@consultoriaapc.es.

3. Personal data we may process

Depending on your relationship with CABR and the service requested, we may process identification and contact data, nationality and residence information, data required for immigration or administrative procedures, information relating to relocation and property services, data required for insurance mediation or management, billing and payment information, communication preferences and information voluntarily provided through forms, email, telephone calls or conversations with our virtual assistants.

We apply the data minimisation principle and seek to request only information that is necessary for each purpose. You should not send sensitive documents or special-category information unless it is required for a specific service and you have been given an appropriate channel.

4. Purposes and lawful bases

• Responding to enquiries and information requests: managing contacts made through the website, email, telephone, forms, messaging or virtual assistants. The lawful basis is taking pre-contractual steps at the data subject’s request and, where appropriate, CABR’s legitimate interest in managing professional communications.
• Providing contracted services: immigration and international mobility, administrative management, relocation, property search, insurance and other contracted services. The lawful basis is performance of a contract and pre-contractual steps requested by the client.
• Compliance with legal obligations: tax, accounting, corporate, administrative, anti-fraud and other obligations applicable to CABR.
• Marketing communications: where applicable, information about CABR’s own services. The lawful basis will be consent when required or legitimate interest in cases permitted by law. Consent may be withdrawn and marketing may be objected to at any time.
• Security, quality and service improvement: system maintenance, misuse prevention, traceability, quality control and process improvement on the basis of CABR’s legitimate interests, while respecting data subjects’ rights and freedoms.
• Cookies and analytics: non-essential cookies and equivalent technologies are used only where a valid legal basis exists, including consent where required. Preferences can be reviewed and changed through the Cookie Policy.

5. Artificial intelligence virtual assistant (Claire)

CABR uses an artificial intelligence virtual assistant to provide initial assistance, classify enquiries and collect the information needed for the appropriate team to follow up. The assistant identifies itself as an AI system and does not replace professional review by lawyers, insurance professionals, relocation specialists or other qualified professionals.

Information provided during a conversation may be entered into CABR’s management systems where necessary to handle the enquiry. Under the current configuration, audio from new conversations is not retained by the AI agent; transcripts and associated conversation data may be retained for up to 90 days for enquiry management, quality control and traceability.

CABR does not use this assistant to make solely automated decisions that produce legal effects or similarly significantly affect an individual. Relevant professional decisions are subject to human review.

5A. Visa eligibility quiz

CABR may use a visa eligibility quiz to provide an initial screening of possible immigration routes. Depending on the user’s answers, the quiz may collect identification and contact details, passport or nationality information, family composition, intended move timeline, information about income, savings, employment, professional activity, qualifications, studies and answers relating to criminal-record requirements. It may also record technical and campaign-attribution data such as landing page, referrer, UTM parameters and, where present, identifiers associated with advertising campaigns.

The purpose is to provide initial guidance and enable CABR’s team to follow up the enquiry. The quiz result is indicative only and does not constitute legal advice or a final decision on whether a visa or residence authorisation will be granted or refused. Where necessary, the case will be reviewed by a member of the team. Data relating to criminal convictions or offences will only be processed where relevant to the immigration purpose and where a lawful basis permits such processing.

6. Sources of personal data

Personal data is generally obtained directly from the data subject or their representative. It may also be received from collaborators, partners or referrers, service providers required for a requested service, public authorities or legitimately accessible sources where a lawful basis exists. Where personal data has not been obtained directly from the data subject, CABR will provide the information required by applicable law where relevant.

7. Recipients

Where necessary for the relevant purpose or required by law, data may be disclosed to public authorities, consulates, immigration authorities, police, municipalities, tax and social-security bodies, insurers, financial institutions, educational institutions, landlords, real-estate agencies or professionals, notaries, registries, advisers and other recipients connected with the service requested.

CABR also uses professional and technology providers that may act as processors, including hosting, email and productivity, CRM, forms, appointment scheduling, communications, analytics, marketing and artificial-intelligence services. These providers must process data in accordance with CABR’s instructions and the applicable contractual and legal safeguards.

8. International data transfers

Some technology providers may be established outside the European Economic Area or use infrastructure located in third countries. Where an international transfer takes place, CABR will apply the safeguards provided for under the GDPR, such as adequacy decisions, Standard Contractual Clauses or other legally valid mechanisms, as applicable.

9. Retention periods

Personal data will be retained for as long as necessary to fulfil the purpose for which it was collected. Client data will be retained for the duration of the contractual relationship and afterwards for as long as necessary to comply with legal obligations and address potential liabilities. Prospective-client and enquiry data will be retained for the period reasonably necessary to manage and follow up the enquiry and subsequently for the periods required to defend potential claims. Data used for marketing will be retained until consent is withdrawn or the right to object is exercised, without prejudice to retaining the minimum information necessary to evidence such a request.

10. Your rights

Where applicable, you may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw consent, by contacting info@relocationforexpats.es. The request must allow CABR to identify the data subject and the right being exercised.

You may also contact the Data Protection Officer at igarcia@consultoriaapc.es. If you believe that the processing of your personal data does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).

11. Children’s data

CABR’s services are primarily intended for adults. Where a case or service requires the processing of a child’s data —for example in family immigration, schooling or relocation matters— the information must be provided by the child’s legal representatives or otherwise processed on another valid legal basis, and will be limited to what is strictly necessary.

12. Security and confidentiality

CABR applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or improper disclosure, taking into account the nature of the data, the context of processing and the risks involved. No system can guarantee absolute security, and measures are therefore reviewed and adapted periodically.

13. Cookies

The website may use technical cookies and, subject to consent where required, analytics, personalisation or third-party cookies. Detailed information is available in the Cookie Policy, where preferences may also be changed.

14. Updates to this policy

CABR may update this Privacy Policy to reflect legal, organisational, technological or service changes. The current version will be the one published on this page and will display its latest update date.