Privacy policy

Data controller

DeadcowLabs, Inc. has no establishment in the European Union and must appoint an EU representative under article 27 of Regulation (EU) 2016/679 (GDPR). [TODO: appointment pending; their details will be published here.] In the meantime, you can contact us about any matter relating to your data.

What data we process

We only ask for the data and documents needed for the service you request.

• Contact and account data: name, email address and, if you provide it, your billing address.
• Payment data: handled by Stripe. We never see or store your full card number.
• Checklist answers: your situation (procedure, nationality, time in Spain, family), needed to build your list.
• Documents to be translated and the resulting translations, which may contain identity, marital status, family or education data.
• Criminal record certificates (art. 10 GDPR): we only process them when you, as the data subject, ask us to translate your own certificate so you can file it with the Spanish authorities. We process them to the minimum extent necessary, only for that purpose, and never reuse them for anything else.
• Health data (art. 9 GDPR), for example in medical certificates: only with your explicit consent (art. 9.2.a), which we ask for before you upload the document.
• Translator and advertiser data: identification, professional, tax and bank details needed for their relationship with us.
• Technical data: security logs (IP address, date and time of access) to protect the service.

Please do not upload copies of your passport or NIE unless that is the document you want translated.

Purposes and legal bases

You can withdraw your consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.

Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you. Checklists are generated by deterministic rules written by our team from the published regulations; we do not use artificial intelligence to generate them or to analyse your documents.

How long we keep data

• Source documents and translations: deleted automatically 30 days after delivery, giving you time to download them. Drafts of unpaid orders are deleted within 48 hours.
• Invoices and transaction data: for the periods required by tax and commercial law (between 4 and 6 years).
• Seller data for DAC7 purposes (translators): 10 years, under the information exchange rules [period to be verified].
• Checklist answers: as long as needed to deliver the result and handle complaints, and no longer than the retention period of the related invoice.
• Security logs: the minimum time needed to detect and investigate incidents.

Where your documents are stored

Files are stored in Vercel Blob, in a private store located in the European Union (Frankfurt, region fra1). Files are never public: they can only be reached through signed download links that expire within minutes. Connections to the site are encrypted. We do not send documents by email.

Who we share data with

We use the following processors, under contracts that meet article 28 GDPR:

Each sworn translator only accesses the documents of the order they accept, and signs a data processing agreement with us that requires them to:

• process the data only on our instructions and only to carry out your translation;
• keep it confidential;
• keep no local copies once the translation has been delivered;
• not engage any sub-processors;
• notify us of any security breach within 24 hours.

We may also disclose data to public authorities where the law requires it. We do not sell your data.

International transfers

Some providers (and DeadcowLabs, Inc. itself) are based in the United States. Where data is transferred outside the European Economic Area, the transfer relies on the mechanisms in Chapter V of the GDPR, such as the provider's certification under the EU-US Data Privacy Framework and/or the standard contractual clauses adopted by the European Commission. You can ask us for more information about these safeguards.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by writing to hola@papeleoya.com and stating which right you want to exercise. We will reply within one month. We may ask for additional information to confirm your identity, but never for a copy of your ID unless it is strictly necessary.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es) or with the supervisory authority of your EU country of residence.

Cookies

We only use technically necessary cookies and your browser's local storage for your drafts. We do not use analytics or advertising cookies. See the cookie policy for details.

Changes

If we make material changes to this policy, we will show them on this page with a new update date and, where appropriate, let you know by email.