Data Protection

All traffic between your browser and the platform is encrypted with TLS. Documents and database records are encrypted at rest by the hosting infrastructure.

Uploaded files are stored in private buckets that are not publicly reachable. Files are transferred directly over an encrypted connection and can only be retrieved through short-lived signed links issued to authorised users.

• Every record is protected by row-level security tied to the account that owns it
• Staff roles are separated from administrator roles and granted on a need-to-know basis
• Administrative actions require an authenticated session validated on the server
• Passwords are stored only as salted hashes and can be strengthened with leaked-password checks

Generation of official forms, signature capture, document status changes and acceptance of legal terms are written to append-only audit records containing timestamp, actor, document version and technical metadata. These records cannot be modified from the application.

The database is backed up automatically by the hosting provider with point-in-time recovery. Backups are encrypted and stored within the European Union.

Documents are deleted according to the retention schedule in the Privacy Policy, or earlier at your request once your case is closed. Deletion requests are handled by privacy@spainmover.com.

Suspected security incidents are investigated immediately. Where a personal data breach is likely to result in a risk to your rights, we notify the Agencia Española de Protección de Datos within 72 hours and inform affected customers without undue delay.