Privacy policy

Who is responsible for your data

The data controller is Hola Money SL, CIF B26671347, registered at Calle Granada 7, 04820 Vélez-Rubio, Almería, España. You can reach us at [email protected], and our data protection contact at [email protected].

We are a private company preparing paperwork on your instructions. We are not the DGT, not Tráfico, and not acting on their behalf.

What we collect

Before you sign in: your name, email, phone, which country issued your licence and where you are in your move, and anything you type into the notes field.

Once you start an application: images of your driving licence, your NIE or TIE (or green NIE certificate) and your photograph; the details we read from them — including the categories you hold; and the answers you give to the questions the DGT file requires.

If you accept analytics cookies, we also collect usage data about how you moved through this site. If you reject them, we do not.

Why we are allowed to hold it

For preparing and filing your exchange: performance of a contract with you, or steps taken at your request before entering one (Art. 6(1)(b) GDPR).

For analytics: your consent, freely given and just as freely withdrawn (Art. 6(1)(a) GDPR).

For our invoicing and accounting records: our legal obligations under Spanish tax and commercial law (Art. 6(1)(c) GDPR).

Your identity documents

Images of your licence, NIE/TIE and photo are held in encrypted private storage. They are readable only by you and by the member of our team handling your application, and access is enforced by the database rather than by the website — knowing a file's address is not the same as being allowed to open it.

They are used to prepare your DGT file and to check that the details match. They are not sold, not used for advertising, and not used to train any model.

Automated reading of your documents

To save you typing them, images of your licence and residence documents are read automatically. Part of that reading is done by an artificial intelligence service: the image is sent to our AI processor, which returns the text it can see, and the image is then discarded by them.

We only use AI providers contracted on zero-retention terms. That means, in writing: they do not keep a copy of your document after the request, and they do not use it to train or improve any model. A request that cannot be routed to a zero-retention provider fails, and a person handles your document instead.

We route through OpenRouter, which selects a model provider operating under those terms. Tell us and we will confirm in writing which provider handled your application.

Some of those providers are outside the EEA. Where that is the case we rely on Standard Contractual Clauses, and we can tell you which apply to your case on request.

This is not automated decision-making. Every detail read from your documents is shown to you to confirm before it is used, anything the software is unsure of is flagged rather than assumed, and a person reviews anything that does not reconcile. You can decline the automated reading and type your details in instead, at no extra cost.

Who else sees your data

The DGT (Dirección General de Tráfico), because that is where a canje application and a tasa payment go.

Our hosting, email, payment and appointment-booking providers, as data processors under written contract and only for the purposes described here.

Public authorities where we are legally required to disclose. We do not sell personal data and do not share it for anyone else's advertising.

How long we keep it

Identity document images: deleted once your exchange is complete and the period for querying it has passed.

Application records and the paperwork we generated: for the period in which a claim could still be brought.

Invoicing records: for the period Spanish tax law requires.

Analytics data: 14 months, or until you withdraw consent, whichever comes first.

Enquiries that never became applications: 12 months.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you can withdraw it at any time.

Write to [email protected]. We answer within one month. If we get it wrong you can complain to the Agencia Española de Protección de Datos (www.aepd.es), and we would rather you told us first so we can fix it.