GDPR Compliance

MadridAddress.com complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page explains how we process personal data and uphold your rights as a data subject.

1. Data Controller

MadridAddress.com acts as the data controller for personal data collected through our website and services. We are responsible for how your data is collected, used, and protected.

2. Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Contract performance: To provide you with the virtual address and mail management services you subscribed to
• Legal obligation: To comply with Spanish tax, anti-money laundering, and record-keeping requirements
• Legitimate interest: To communicate service updates and improve our services
• Consent: For marketing communications, if you opt in (you can withdraw at any time)

3. Personal Data We Process

• Identification data: name, email, phone, country
• Service data: subscription plan, use case, mail preferences
• Payment data: processed by Stripe (we do not store card details)
• Correspondence data: enquiry messages and support communications

4. Data Subject Rights

Under GDPR Articles 15-22, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a structured format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for marketing at any time

To exercise any of these rights, contact us through the enquiry form on our homepage. We will respond within 30 days as required by GDPR Article 12.

5. International Data Transfers

Your data is stored on servers within the European Union. If data is transferred outside the EU (for example, by Stripe for payment processing), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy. Subscription data is retained for the duration of your subscription plus up to 5 years for legal compliance. Mail scanning data is retained according to your plan terms.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including: (a) encrypted data transmission (TLS/SSL); (b) secure access controls and authentication; (c) regular security reviews; (d) encrypted payment processing via Stripe.

8. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. If the breach poses a high risk to your rights and freedoms, we will also notify you without undue delay.

9. Children's Data

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors.

10. Supervisory Authority

If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos, www.aepd.es) or your local supervisory authority.

11. Contact

For GDPR-related enquiries or to exercise your data subject rights, please contact us through the enquiry form on our homepage.