Privacy policy
This page is an English translation provided for convenience. In the event of any discrepancy, the French version prevails.
Last updated: 26 October 2026
To prepare your Spanish tax returns, Fiscasa processes personal data, some of it confidential in nature: identity, tax identification number (NIE), address, information on your assets and bank details. This policy explains, as clearly as possible, what data we process, why, on what basis, for how long, who we share it with and what your rights are. It applies to the website [DOMAIN NAME] and to Fiscasa's services.
1. Data controller
The data controller is [COMPANY NAME], [LEGAL FORM], [ADDRESS], RCS [CITY] [RCS NUMBER], which operates the Fiscasa service.
- Contact for any question about personal data: [DATA PROTECTION EMAIL]
- Data protection officer (DPO): [NAME OR "not appointed"; where applicable, DPO contact details]
Fiscasa is a private service, independent of the Agencia Tributaria. When you file a return with the Spanish tax authority, that authority processes your data as a separate controller, under its own rules.
2. Data processed
| Category | Examples |
|---|---|
| Identification | surname, first name, date of birth, nationality, NIE, copy of identity document where necessary |
| Contact details | postal address, email, telephone |
| Tax situation | country of tax residence, ownership share, family situation relevant to the service |
| Property data | address, cadastral reference and value, IBI bills, purchase or sale deeds, rent, days let, expenses and invoices |
| Tax payment data | IBAN of the account used to pay the tax or receive a refund, payment IDs generated |
| Order data | plans ordered, invoices, history of exchanges |
| Payment data for our services | processed by our payment provider; we do not keep full card numbers |
| Browsing data | IP address, technical logs, cookies (see the cookie policy) |
| Calculator data | values entered for the estimate, with no obligation to provide your identity |
We never ask for your Cl@ve credentials, your digital certificate or your bank codes. We do not process special categories of data within the meaning of article 9 of the GDPR (health, opinions, etc.); please do not send us any.
When you give us data about other people (spouse, co-owner), you undertake to inform them and to obtain their consent where necessary.
3. Purposes and legal bases
| Purpose | Legal basis (article 6 of the GDPR) |
|---|---|
| Preparing your returns, calculating the tax, providing documents and payment instructions | Performance of the contract (art. 6.1.b) |
| Managing your account, orders, invoicing and customer service | Performance of the contract (art. 6.1.b) |
| Meeting our accounting and tax obligations | Legal obligation (art. 6.1.c) |
| Verifying your identity and meeting due diligence obligations (anti-money laundering) where they apply | Legal obligation (art. 6.1.c) |
| Reminding you each year of the tax deadlines for your properties | Performance of the contract for clients who have subscribed to follow-up; otherwise legitimate interest, which you can object to at any time |
| Managing the Fiscasa guarantee, complaints and disputes | Performance of the contract and legitimate interest (defence of our rights) |
| Providing the calculator and improving the site (statistics) | Legitimate interest; consent for non-essential cookies |
| Sending you marketing information | Clients: legitimate interest for similar services (you can object at any time); prospects: consent |
| Ensuring the security of the site and preventing fraud | Legitimate interest |
4. Retention periods
| Data | Period |
|---|---|
| Account and order data | duration of the contractual relationship, then 5 years (civil limitation period) |
| Returns prepared and supporting property documents | duration of the relationship, then [PERIOD, e.g. 6 years] after the year concerned, to cover the Spanish tax limitation period (4 years) and the handling of complaints |
| Invoices and accounting records | 10 years (article L. 123-22 of the French Commercial Code) |
| Identity verification data (where applicable) | period required by the applicable regulations, at most [PERIOD] |
| Prospect data | 3 years from the last contact |
| Data entered in the calculator without creating an account | [PERIOD, e.g. 30 days] |
| Technical logs | 12 months maximum |
| Cookies | see the cookie policy |
At the end of these periods, the data is deleted or anonymised.
5. Recipients and processors
Your data is accessible only to those people at Fiscasa who need it to provide the service, who are bound by confidentiality. It may be disclosed to:
- our processors, who act on our instructions and are bound by a contract complying with article 28 of the GDPR:
| Provider | Service | Data location | Safeguards in case of transfer |
|---|---|---|---|
| [HOST] | hosting of the site and data | [COUNTRY] | [SAFEGUARDS] |
| [DOCUMENT STORAGE] | secure storage of documents | [COUNTRY] | [SAFEGUARDS] |
| [PAYMENT PROVIDER] | payment for our services | [COUNTRY] | [SAFEGUARDS] |
| [EMAIL / SUPPORT] | emails and exchanges with customer service | [COUNTRY] | [SAFEGUARDS] |
| [ELECTRONIC SIGNATURE] | signing documents | [COUNTRY] | [SAFEGUARDS] |
| [IDENTITY VERIFICATION TOOL] | identity verification, where applicable | [COUNTRY] | [SAFEGUARDS] |
| [AUDIENCE MEASUREMENT] | visitor statistics | [COUNTRY] | [SAFEGUARDS] |
- the Spanish tax authority, when you file the return prepared or ask us to assist with a procedure;
- authorised authorities, where required by law;
- our advisers (lawyers, accountants, insurer) in connection with defending our rights or handling a claim.
We do not sell or rent your data.
6. Transfers outside the European Union
We favour providers that host data in the European Union. Where a transfer outside the European Economic Area is necessary, it is governed by an adequacy decision of the European Commission (including, where applicable, the EU–US Data Privacy Framework) or by standard contractual clauses adopted by the Commission, supplemented where necessary by additional measures. You can obtain a copy of these safeguards by writing to [DATA PROTECTION EMAIL].
7. Security
We implement technical and organisational measures appropriate to the nature of the data: encrypted communications (HTTPS), encryption of stored documents, access control and logging, strong authentication for our team, backups, staff awareness training. In the event of a data breach posing a risk to your rights, we notify the supervisory authority within 72 hours and, where the risk is high, we inform you.
8. Your rights
Under articles 15 to 22 of the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:
- right of access to your data and to obtain a copy;
- right to rectification of inaccurate or incomplete data;
- right to erasure, except where retention is necessary to comply with a legal obligation or to defend our rights;
- right to restriction of processing;
- right to object to processing based on legitimate interest, and at any time to direct marketing;
- right to data portability for data you have provided to us, for processing based on the contract or consent;
- right to withdraw your consent at any time, without affecting the lawfulness of prior processing;
- right to give instructions regarding what happens to your data after your death (article 85 of the loi Informatique et Libertés).
To exercise your rights, write to [DATA PROTECTION EMAIL] or to [ADDRESS], specifying your request. We may ask for proof of identity in case of reasonable doubt. We reply within one month, which may be extended by two months for complex requests.
You can also register free of charge on Bloctel, the French telephone marketing opt-out list.
9. Complaints to a supervisory authority
If you believe your rights have not been respected, you can lodge a complaint with:
- the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, the lead authority for Fiscasa;
- or the supervisory authority of your country of residence or work, for example the Agencia Española de Protección de Datos (AEPD) in Spain (www.aepd.es) or the Data Protection Authority in Belgium (www.autoriteprotectiondonnees.be).
10. Automated decisions
The calculator produces an automatic, indicative estimate of the tax. No decision producing legal effects concerning you is taken solely on the basis of automated processing: every return is checked by a person before it is provided.
11. Changes to this policy
We may amend this policy to reflect changes in our services or in the regulations. The date of the last update is shown at the top of the page; in the event of a significant change, we will inform you by email.