Privacy Policy.

Who we are

Nômade España is published by Nômade Media. We operate spainsdigitalnomadvisa.com (this site) and a small set of related publications. The data controller for this site is Nômade Media, contactable at info@nomademedia.travel.

What we collect

• Contact-form submissions. When you fill in the form on the contact page we collect your name, email, message, and a topic tag. The form is processed by Web3Forms on our behalf — they relay the message to our inbox.
• Newsletter signups. If you submit your email on the homepage signup form, we collect only your email address. Same Web3Forms relay; no third-party newsletter platform.
• Analytics. We use Google Analytics 4 to track aggregate, anonymized site usage — pages visited, country, device. We run two GA4 properties on this site: a Nômade Media Global property (G-8VQ3XY0M97) and a Nômade España country property (G-XRNPBT8NBD). Both rely on cookies, and both load only after you click Accept analytics on the cookie banner that appears on your first visit. We do not pass personal data to Google.
• Server logs. Our hosting provider keeps short-term server access logs for security and abuse prevention (typically IP address, timestamp, user agent, requested URL).

What we do not collect

• We do not sell your data, ever.
• We do not run third-party advertising on this site.
• We do not use behavioural retargeting cookies.
• We do not pass your email or any contact-form data to listed lawyers, gestores, or agencies. Our resources directory is informational, not lead-generation.

Affiliate links

Some outbound links on this site (Wise, SafetyWing, Airalo) are affiliate links. If you click and sign up, the partner pays us a small commission at no extra cost to you. The affiliate program tracks the click via a referral code in the URL — they may set their own cookies on their domain. We do not receive your personal data through this mechanism, only an aggregate count of referred conversions.

Cookies

• Strictly necessary. Site preferences, including your in-browser checklist progress (stored in localStorage under the key es-checklist-v1) and any session preferences. These cannot be turned off.
• Analytics. Google Analytics 4 cookies (_ga, _ga_*). You can opt out by using a browser extension or setting Do Not Track. Disabling does not affect site functionality.

Your GDPR rights

If you are in the European Economic Area, the United Kingdom, or any jurisdiction with comparable data protection law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion (derecho de supresión / right to be forgotten).
• Object to processing or request restriction.
• Receive your data in a portable format.
• Lodge a complaint with the Spanish data protection authority (Agencia Española de Protección de Datos — aepd.es) or your local equivalent.

To exercise any of these rights, email info@nomademedia.travel with the subject "GDPR request." We respond within 30 days.

Lawful bases for processing (GDPR Article 6)

For transparency, here is the lawful basis we rely on under Article 6(1) of the EU General Data Protection Regulation for each distinct processing activity on this site. If you are an EU/EEA resident, you can use this list to understand exactly why we are entitled to hold the information we hold.

• Web analytics (Google Analytics 4 — G-8VQ3XY0M97, G-XRNPBT8NBD): Art. 6(1)(a) — consent. Analytics scripts and cookies do not load until you click Accept analytics on the cookie banner. You can withdraw consent at any time by using the Cookie settings link in the footer, which resets your choice and re-shows the banner.
• Contact-form submissions & replies (name, email, message, topic tag): Art. 6(1)(f) — legitimate interest. We have a legitimate interest in receiving and answering messages addressed to us. By submitting the form you reasonably expect us to read and reply to your message. We do not use form data for marketing without separate opt-in.
• Newsletter subscriptions (email address only; not yet launched but reserved): Art. 6(1)(a) — consent. A separate, freely-given opt-in via the signup form. One-click unsubscribe at any time.
• Featured Listing applications & sponsor records (firm name, contact name, email, listing copy): Art. 6(1)(b) — performance of a contract (and steps taken at the prospective sponsor's request prior to entering into one). Signed sponsorships are additionally retained under Art. 6(1)(c) — legal obligation for the records-retention period set by tax and contract-history law.
• Server access logs (IP address, timestamp, user agent, URL — retained by our hosting provider for ~30 days): Art. 6(1)(f) — legitimate interest in network security, abuse prevention, and debugging. We do not match these logs to identified individuals in the ordinary course of business.
• Cookie-consent record (the value accepted or declined stored under nm_consent in your browser's localStorage): Art. 6(1)(c) — legal obligation. Storing your consent decision is itself required by the EU ePrivacy Directive and GDPR so that we can prove your choice on request and stop showing you the banner.
• Checklist progress (the es-checklist-v1 entry in your browser's localStorage — your tick-marks on the visa checklist): No personal data leaves your device. This data lives only in your browser's local storage; we never receive a copy. No GDPR basis is required because we are not the data controller — you are.

Where the lawful basis is consent (analytics, newsletter), you have an unconditional right to withdraw it. Where the lawful basis is legitimate interest (forms, server logs), you have the right to object — we will weigh your objection against our interest and respond.

Cookie consent & analytics opt-out

The first time you visit any page on this site, you'll see a cookie banner asking whether you accept analytics cookies. Until you choose, no analytics scripts or cookies are loaded. If you click Decline, no analytics will run on subsequent visits either. If you click Accept analytics, you can change your mind at any time by clicking the Cookie settings link in the footer of any page on this site — that will reset your choice and the banner will reappear on your next page load. (Clearing this site's cookies in your browser settings has the same effect.) We also honour the Do Not Track and Global Privacy Control browser signals: if either is enabled, we treat your visit as declined automatically and never show the banner.

California residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know. You may request a description of the personal information we have collected about you in the past 12 months, the sources of that information, and the categories of third parties (if any) with whom we have shared it.
• Right to delete. You may request that we delete the personal information we have collected from you.
• Right to correct. You may request correction of inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined in the CCPA/CPRA. There is therefore nothing for you to opt out of, but you may still make a verifiable request and we will honour it.
• Right to non-discrimination. We will not deny you services, charge you a different price, or provide a different level of quality of service for exercising any of these rights.

To exercise any of these rights, email info@nomademedia.travel with the subject line "CCPA request" and identify yourself sufficiently to allow us to verify your identity (typically the email address you used to submit a form on this site). We respond within 45 days as required by law.

Data retention

We keep your information only as long as we need it. Specifically:

• Contact form submissions are retained for 24 months after the last reply in the thread, then permanently deleted from our inbox.
• Featured Listing applications that don't result in a signed sponsorship are retained for 24 months, then deleted.
• Featured Listing sponsor records (signed sponsorships) are retained for the duration of the sponsorship plus 7 years thereafter, in line with standard tax-audit and contract-history records-retention guidance.
• Newsletter subscribers (when we launch a newsletter) are retained indefinitely while you remain subscribed. One-click unsubscribe removes you immediately, and we permanently delete the record within 30 days.
• Google Analytics user-level data is retained for 14 months, then automatically deleted by Google. Aggregated reports (e.g., total monthly visitors) are retained indefinitely but contain no individual-level data.
• Server logs (IP address, user agent, page requested) are retained by our hosting provider for approximately 30 days, then automatically purged.

You can request deletion of any information you've submitted at any time by emailing info@nomademedia.travel, and we will honour the request within a reasonable time regardless of the retention windows above. The exception is records we are legally required to retain (e.g., signed sponsor contracts and associated invoices for tax purposes).

Children

This site is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has submitted data through one of our forms, contact us and we will delete it.

Changes to this policy

We may update this policy as our practices or applicable law evolves. Significant changes are dated at the top. Trivial changes (typo fixes, link updates) are not.

Contact

Questions about privacy: info@nomademedia.travel · subject line "Privacy."