Privacy Policy

Last updated: October 14, 2026

Who is responsible for your data. The data controller is Saskia González Lipiani, trading as SAS Relocations, NIF 07505241L, Calle Lancharejos 2, 28692 Quijorna, Madrid, Spain. Contact: hello@sasrelocations.com.

Legal framework. SAS Relocations is established in Spain and processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and Spain's Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD). Because our clients are based primarily in the United States, we want to be upfront: no US state or federal privacy law currently requires us to comply with it, since we have no US establishment. As a matter of company policy, we apply the same protections described in this policy — among the strongest consumer privacy standards in the world — to every visitor and client, regardless of where they live.

What we collect and why

Who else sees your data (data processors). We work with a small number of service providers who process data on our behalf, under contract, and only for the purposes above:

• Google Analytics 4 — website analytics
• Google Ads, Meta Ads, and Microsoft Ads — once active, for advertising performance measurement
• HighLevel (GoHighLevel) — our client relationship management (CRM) platform
• Netlify — our website hosting provider
• Our independent, collaborating immigration law firm — only if you are referred for visa/immigration matters, and only the information necessary for that referral

We do not sell your personal data, and we do not name every individual service-delivery partner (moving, insurance, and similar) on this Site as a matter of business policy — see our Terms of Service. If a specific partner processes your personal data as part of a service you've contracted, you can request their identity directly from us at any time using the contact details above, and where required by law we will name them in this policy.

International data transfers. Some of the providers above are based in the United States. Where that's the case, we rely on the following safeguards:

• Google (Analytics 4, Ads): certified under the EU–US Data Privacy Framework.
• HighLevel (GoHighLevel): "We use the HighLevel (GoHighLevel) platform, operated from the United States. HighLevel is certified under the EU–US Data Privacy Framework (DPF), which permits the transfer of personal data from the European Union to the United States in accordance with Article 45 of the GDPR. For more information, please refer to HighLevel's Privacy Policy, Data Processing Agreement, and security and compliance documentation."

Contacting us through WhatsApp Business. If you contact us through WhatsApp Business, we process your data to respond to your request, on the legal basis of pre-contractual steps or, where applicable, performance of our contract with you.

The service is provided by Meta Platforms Ireland Ltd., which acts as an independent data controller in respect of the data arising from your use of the application. Using WhatsApp involves the international transfer of data to the United States and to other countries where Meta operates infrastructure. These transfers rely on the Standard Contractual Clauses adopted by the European Commission and on the additional safeguards applied by Meta. You can read WhatsApp's privacy policy at https://www.whatsapp.com/legal/privacy-policy.

WhatsApp is an informal channel and we use it for general questions only. Please do not send personal or sensitive documents through it — passports, payslips, medical reports, or information about your children. When we need documents from you, we will give you access to a secure folder instead.

If something sensitive does reach us through WhatsApp, we will move it to that secure folder and delete it from our device. Please bear in mind that messages remain on your own device and in the service provider's systems: we can only delete messages within our own systems.

Advertising and analytics pixels. We use tracking technologies including the Meta Pixel, Google tags (via Google Tag Manager), and Microsoft's UET tag, once our advertising campaigns are active, to measure the performance of our marketing. Full detail on each is available in our Cookie Policy, and none of these load until you consent, where consent is required.

How long we keep your data. We retain personal data for as long as needed to deliver the service you've contracted, plus any additional period required by Spanish tax and commercial record-keeping law (generally up to 6 years for invoicing records). Quiz and inquiry data from people who don't become clients is retained for up to 24 months, after which it is deleted unless you ask us to keep it or contact us again.

Messaging channels. We keep WhatsApp conversations for a shorter period than the records described above: three months for people who do not become clients, and until the end of your service plus six months for clients. Where a conversation contains information we need in order to deliver your service, we transfer that information to your client record — where the retention periods above apply — and delete the conversation itself.

Your rights. Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to certain processing
• Port your data to another provider
• Lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es), or your local authority if you're outside Spain

To exercise any of these rights, contact us at hello@sasrelocations.com. We aim to respond within 24 hours and to resolve requests within the timeframes required by law.

Children's data. Our services are contracted by adults, but relocating a family necessarily involves information about children — names, ages, school records, and similar details required for school search and enrollment.

We process that information on the instruction of the parent or legal guardian who contracts with us, on the basis of performing that contract, and only to the extent needed to deliver the service. We do not collect personal data directly from children, we do not address marketing to them, and we delete children's data on the same schedule as the rest of your file.

Security. We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse, consistent with the size and nature of our business.

Changes to this policy. We may update this policy from time to time; the "Last updated" date at the top will always reflect the most recent version.