Privacy Policy

Protecting your personal data is a priority. This policy explains how the data you give us through the website sworntranslator.online is processed, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

No data protection officer has been appointed, as this is not required under article 37 of the GDPR. Any data protection matter can be raised at the email address given above.

2. Data we collect

Most of the data processed is the data the user provides voluntarily through the quote and contact form, together with the documents they supply so that the quote can be worked out. In addition, simply visiting the site involves processing certain technical data, which is also set out below:

• Identification and contact data: name, email address, telephone number and, where a paper copy is to be posted, the full postal address of the recipient.
• Documents supplied: the files the user uploads so that the translation can be quoted, which may contain personal data and even special categories of data depending on the type of document (for example, academic certificates, civil registry records and certificates, criminal record certificates or medical documentation).
• Browsing data: technical and usage information about the website collected by means of analytics and advertising cookies, on the terms set out in the cookie policy.
• Technical connection data, with nothing to fill in: when any page is opened, the site asks its infrastructure provider whether form submissions are switched on, so that provider receives the IP address of the visit even if the user never submits a form. On pages that contain a form, the anti-fraud system that protects the submission is also loaded, and it receives the IP address and technical browser data before the user types anything. When a form is submitted, the IP address and the email address are recorded temporarily in order to prevent bulk submissions. The server provider, for its part, keeps the usual access logs (IP address, date and page requested).

The user warrants that the data provided is truthful and that, when providing third-party data, they have that person's consent or another lawful basis for disclosing it.

Providing your name, email address and the documents you want translated is necessary in order to prepare the quote and provide the service: without that data the request cannot be dealt with. The phone number and the message are optional, and the postal address is only needed if you ask for a paper copy to be posted.

3. Purposes of the processing

• To handle and manage quote requests and contact enquiries.
• To provide the sworn translation service contracted and to manage the relationship with the client.
• To translate and certify the documents supplied, including any that contain special categories of data or data relating to criminal offences and convictions.
• To process payment for the service and issue the corresponding invoice.
• To protect the forms against automated and abusive use, and to safeguard the security and availability of the information.
• To send commercial communications about our own services, only where the data subject has given prior consent.
• To comply with the applicable legal, tax and accounting obligations.
• To analyse the use of the website for statistical purposes, so as to improve its content and how it works, and to measure the results of advertising campaigns.

4. Legal basis for the processing

• Performance of a contract or pre-contractual measures (art. 6.1.b GDPR): to deal with the quote request, prepare the quote and provide the translation service. This is the basis that covers the contact details, the delivery address and the documents: without them there can be no quote and no job. It is not consent, precisely so that withdrawing a consent does not force an ongoing job to be interrupted.
• Explicit consent of the data subject (art. 9.2.a GDPR): to process the special categories of data and the data relating to criminal offences and convictions (art. 10 GDPR and art. 10 LOPDGDD) that the documents supplied may contain. It is given by accepting this policy and sending the documents through the form, through the policy-acceptance tick box, which is not ticked in advance and without which the request cannot be sent, with the user declaring that they understand the documents may contain those categories of data and consenting to their processing for that sole purpose. It can be withdrawn at any time, although withdrawing it will make it impossible to carry on with the job.
• Consent of the data subject (art. 6.1.a GDPR): to use analytics and advertising cookies and to send commercial communications.
• Legitimate interest of the owner (art. 6.1.f GDPR): to protect the forms against automated and abusive use, to safeguard the security and availability of the information by means of backups, and to keep an internal audit trail of operations.
• Compliance with a legal obligation (art. 6.1.c GDPR): to meet tax, accounting and administrative obligations.

5. Documents supplied and special categories of data

By their very nature, the documents the user supplies for quoting or for translation may contain special categories of personal data (article 9 GDPR), for example, health data in a medical report, or data revealing religious beliefs or ethnic origin, as well as data relating to criminal offences and convictions (article 10 GDPR and article 10 LOPDGDD), as is the case with a criminal record certificate.

That data is processed solely in order to translate and certify the document, and it relies on the explicit consent of the data subject (article 9.2.a GDPR). That consent is given by accepting this policy and sending the documents through the form, through the policy-acceptance tick box, which is not ticked in advance and which has to be ticked before the request can be sent, with the user stating that they understand the documents may contain data of those categories and expressly consenting to it being processed for that sole purpose. It can be withdrawn at any time by writing to the address given in the section on rights, although withdrawing it will make it impossible to carry on with the job.

Access to those documents is limited to expressly authorised staff and restricted according to their role: whoever handles quotes does not reach the documents attached to orders, and the other way round. The files are held in a private repository, with no public access, and they are opened through individually issued five-minute temporary links. The files are never attached to the internal email notifications. The page count used to work out the quote is done in the user’s own browser: the content of the document is not sent to any external analysis service.

6. Third-party data contained in the documents

An official document may contain personal data about people other than the person supplying it: for example, the parents on a birth certificate or the parties to a deed. The source of that data is, in every case, the document supplied by the user themselves.

That data is processed solely in order to translate and certify the document, is kept for the same periods set out in this policy, and is not used for any other purpose nor disclosed to anyone beyond the recipients listed. Since the owner has no contact details for those people and informing them individually would involve a disproportionate effort, this information is made publicly available in this policy, in accordance with article 14.5.b of the GDPR.

Those people may exercise the rights described below on the same terms as any other data subject.

7. Retention periods

Data will be kept for as long as the relationship with the data subject lasts and, once it has ended, for the periods legally required in order to deal with any liabilities that may arise (for example, tax and commercial obligations). Documents supplied for quoting purposes are securely deleted once the job has been completed or the request has been dropped, unless there is a legal obligation to keep them. Traffic and browsing data will be kept for a maximum of two years.

In addition, so that the user knows what erasure actually covers, it is worth knowing that the following parallel retentions exist:

• Database backups: these are made several times a day and kept for a maximum of 90 days. Data erased from the live systems may remain in those copies until that period expires, at which point it disappears automatically. The copies are encrypted and are only restored in the event of an incident; the documents supplied are not part of them.
• Internal email notifications: when a request or an order is registered, the owner receives a notification containing the contact details, the user’s message and, where applicable, the delivery address and the file names. That notification stays in the owner’s mailbox for the periods that apply to the relationship, and it does not include the documents supplied.
• Abuse-prevention counters: the temporary records of IP address and email address that stop forms being submitted in bulk are deleted automatically after 48 hours.
• Server access logs: these are kept by the hosting provider according to its own configuration. The user can ask about that period by writing to the address given in the section on rights.

8. Recipients and data processors

No data is disclosed to third parties unless there is a legal obligation to do so. In order to provide the service, the owner relies on the suppliers listed below, which process personal data on the owner’s behalf and which, except where stated otherwise, act as data processors:

• Application, database and document storage infrastructure: Supabase, Inc. (United States), which hosts the database, the server functions and the private store where the documents supplied are kept. The database and the storage are located in the European Union (Paris region, France), on Amazon Web Services infrastructure as a sub-processor. This supplier also receives the IP address of every visit to the site, on the terms described in the section on the data we collect.
• Payment processing: Stripe Payments Europe, Limited (Dublin, Ireland), part of the Stripe, Inc. group (United States). Stripe receives the email address, the name and the amount, and collects the card details directly on its own page, so they never pass through the owner’s systems. On its role in the processing, see the next section.
• Sending the internal email notifications: Resend, Inc. (United States), with processing in the European Union (Ireland) and Amazon Web Services as a sub-processor. It is used exclusively for transactional email: no contacts are passed to any marketing tool and no mailing lists are created.
• Protecting the forms against automated use: Cloudflare, Inc. (United States), through the Turnstile technology, which is only loaded on pages that contain a form. It receives the IP address and technical browser data, and also the IP address that the server passes to it to validate the submission, for the sole purpose of telling a person apart from an automated program.
• Website hosting: the site is published on a server managed for the owner by a hosting provider, which processes the IP address and the technical connection data in the server access logs. The published site is static and the forms are not processed on it. The user can ask for the identity and the location of this provider by writing to the address given in the section on rights.
• Custody of the backups: GitHub, Inc. (United States), part of the Microsoft group, where AES-256 encrypted backups of the database are stored and whose decryption key is held by the owner alone.
• Web analytics and advertising measurement: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, through Google Tag Manager, Google Analytics 4 and Google Ads, and only if the user gives their consent in the cookie notice, on the terms described in the cookie policy. These tools are not active on this site yet: no measurement container is loaded on sworntranslator.online, so no analytics or advertising data is collected here at present. Once one is enabled, Google may also process the advertising data for its own purposes, under its own terms.

The regime that applies to each of these arrangements is the one set out in article 28 of the GDPR, which requires the processing to be governed by a contract or another binding legal act. The user can ask for information about the instrument that applies to a particular supplier by writing to the address given in the section on rights.

Beyond these cases, data is only disclosed to third parties where there is a legal obligation to do so, as is the case with the Spanish tax authorities.

9. Stripe’s role in the processing

When payments are processed, Stripe acts in a dual capacity, and it is worth knowing the difference:

• As a processor on the owner’s behalf: when it takes the payment for the amount due for the job, following the owner’s instructions.
• As a controller in its own right: when it processes that same data for purposes imposed by its own regulatory framework, on which the owner cannot give instructions: fraud prevention, risk management, compliance with anti-money-laundering rules and with the obligations that fall on it as a payment institution, and retention of transaction information for the periods legally required.

As a result, if the user exercises their right to erasure against the owner, the owner will erase the data from its own systems on the terms set out in the section on retention periods, but Stripe may keep the transaction information in order to comply with its own legal obligations. For the processing Stripe carries out in its own right, the user can consult and exercise their rights under Stripe’s privacy policy.

10. International data transfers

Several of the suppliers listed are, or belong to groups whose parent company is, established in the United States (Supabase, Stripe, Resend, Cloudflare, GitHub and, once a measurement container is enabled on this site, Google), so an international transfer of data or access from a third country may take place, even though the main processing is carried out in the European Union.

In every case the transfer is made under one of the mechanisms provided for in chapter V of the GDPR: the importer’s certification under the EU-US Data Privacy Framework adequacy arrangement, where that is the case, or the standard contractual clauses approved by the European Commission (article 46.2.c GDPR), together with any supplementary technical and organisational measures that may be needed.

The user can ask which specific mechanism applies to each supplier, and for a copy of the safeguards adopted, by writing to the address given in the section on rights.

11. Automated decisions

The website automatically works out the amount of the quote from the language pair, the number of pages and the turnaround and delivery options chosen. That calculation does not amount to an automated decision of the kind covered by article 22 of the GDPR: it produces no legal effects on the user and does not significantly affect them, and no profiling is carried out. Accordingly, no decisions are taken based solely on automated processing.

12. Rights of the data subject

You can exercise the following rights at any time by writing to info@nuriamasdeu.com, stating the right you wish to exercise and enclosing, where appropriate, a document that proves your identity:

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of your data when it is no longer necessary.
• Objection to the processing on grounds relating to your particular situation.
• Restriction of the processing in the cases provided for.
• Portability of your data to another controller.
• Not to be subject to decisions based solely on automated processing.
• Withdrawal of the consent given, without this affecting the lawfulness of the processing carried out before it was withdrawn.

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.

13. Security measures

The owner has adopted appropriate technical and organisational measures to ensure a level of security suited to the risk, in order to protect personal data against loss, alteration, unauthorised processing or unauthorised access, taking into account the state of the art and the nature of the data processed.

Those measures include: storing the documents in a private repository, with no public access, with a size limit and a list of accepted file types; access to the documents through individually issued five-minute temporary links, and only for authorised staff; role-based access control that distinguishes who can see quotes and who can see orders; AES-256 encryption of the backups; self-hosting of the typefaces, so that simply visiting the site does not send data to any font provider; and analysing the documents in the user’s own browser to count their pages, so that their content is not sent to any external analysis service.

14. Cookies

This website uses cookies. You can find the details of the cookies used, what they are for and how to manage them in the cookie policy.

Last updated: August 2026