Your data, in plain language.

Last updated: 9 September 2026.

Who is responsible for your data

The data controller is Omar Hassan Mohammad Tawalbeh, registered sole trader trading as Spain University Office (ABN 52 956 511 342), reachable in Madrid, Spain and at info@spainuniversityoffice.com. That address is also our data-protection contact — there is no separate department, you reach the person responsible directly.

What we collect

When you send the free assessment we receive what you selected and typed: your country, field of study, current education, your name, your WhatsApp number, and your email if you chose to give one. The current form does not ask for grades, a start date or funding details. Older enquiries may contain those answers if you supplied them before the form was shortened. If you request the visa playbook we receive your name and WhatsApp number. If you write to us on WhatsApp or by email, we receive what you send there. Our server also records the page you submitted from and the time you did it.

Why we are allowed to hold it

• Your consent, and steps taken at your request before a contract (GDPR Art. 6(1)(a) and 6(1)(b)) — for the assessment, the playbook, and any reply we send. You asked us to assess your case; holding what you typed is how we do that.
• Performance of a contract (Art. 6(1)(b)) — once you engage us, for everything your contract covers.
• Legal obligation (Art. 6(1)(c)) — invoices and business records we are required to keep.
• Legitimate interest (Art. 6(1)(f)) — keeping the site secure and blocking spam submissions.

Giving us your details is voluntary. But the assessment cannot be answered without a name and a WhatsApp number — that is what we reply to.

What we use it for

One thing: assessing your situation and replying to you. If you become a client, your information becomes part of your engagement file under the contract. We do not sell, rent or trade your data, we do not send marketing blasts to assessment contacts, and we share it with nobody else except where a law or a court requires it.

Where it lives

Form submissions are saved in a private database on our website server before we confirm receipt. A notification is then sent to our business mailbox. The database, its backups and our mailbox are hosted with our website and email provider, Hostinger, on servers in the European Union. Conversations you start on WhatsApp are processed by WhatsApp/Meta under their own terms.

Transfers outside Europe

Two transfers can happen, and you should know about both. The operator of this business is an Australian-registered sole trader, so your data may be read from outside the EEA by the person answering you. And WhatsApp/Meta may process message data outside the EEA under the European Commission's standard contractual clauses. If you would rather nothing left the EEA, write to us by email instead of WhatsApp and say so — we will keep the whole conversation there.

How long we keep it

• Enquiries that never become clients: deleted 24 months after our last contact with you. Families genuinely do come back a year later; after two years it is dead weight.
• Client engagement files: for the life of the engagement and 6 years after it ends — the window in which contract questions can still arise.
• Invoices and accounting records: as long as tax law requires.

Ask us to delete earlier and we will, unless a signed contract or a law requires us to keep the record.

Cookies and tracking

This site sets no cookies at all. No analytics, no advertising pixels, no third-party trackers — which is why you are not being made to click a cookie banner. Fonts and images are served from our own server, not from Google or anyone else. If we ever add analytics or advertising measurement, likely when we start running ads, we will ask your consent first with a real option to refuse, and this page will say so before it happens.

How the assessment is scored

The current form records an enquiry for our team to review. It does not score your grades or finances, decide eligibility, or reject anyone automatically. A human reviews your request before giving assessment advice. Older enquiries may retain an internal priority label from the previous form; that label was not an admission decision.

If you are under 18

Much of what we do concerns students who are still minors. In Spain a person aged 14 or over can give this consent themselves; under 14, a parent or guardian should send the form. If you are a parent submitting for your child, you are confirming you are entitled to do so.

Your rights

You can ask us to show you what we hold (access), correct it, delete it, pause our use of it (restriction), object to our use of it, or hand it over to you or another provider in a portable file. Where we rely on your consent, you can withdraw that consent at any time — that stops future use without unpicking what was lawful before.

One email to info@spainuniversityoffice.com does any of them, and we answer within one month.

If we get it wrong

Tell us first — we would much rather fix it. But you always have the right to complain to a data protection authority. In Spain that is the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). If you live elsewhere in the EEA, your own national authority will take the complaint too.