Privacy policy

At RightNOW Spain we take your data seriously. This page explains, in plain terms, what information we process, why, on what legal basis and how you can exercise your rights, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

For any privacy matter or data-protection rights request you can write to info@right-now.es.

2. What data we process

• Account and contact data: name, email and language.
• Pre-purchase lead data: name, surname and email if you leave them in NAVI, a generator, a form or before checkout but do not yet buy a product.
• Data you provide in forms and to NAVI: the description of your situation, personal data and, where relevant, case data (for example, NIE, administrative or employment status).
• Documents you upload for review, preparation or case tracking.
• Payment data: handled by our payment processor Stripe; we do not store your full card details.
• Usage and technical data: IP address, device, pages visited and cookies (see the cookies section).

3. Why we use your data, and the legal basis

• To provide the service (analysing your situation with NAVI, generating routes and documents, tracking your case) — basis: performance of the contract.
• To handle payments and invoicing — basis: contract and legal obligation.
• To answer your enquiries sent via forms or email — basis: your consent or our interest in replying.
• To send marketing related to your request (for example, reminding you about an unfinished order or a relevant RightNOW service) — basis: consent or legitimate interest; you can opt out at any time.
• To improve the platform and measure usage (analytics) — basis: consent (cookies) or legitimate interest in a secure, working service.
• To comply with legal obligations (tax, accounting) — basis: legal obligation.
• To improve the quality of the help we give other clients from depersonalised records of how a case moved and how it ended ("practice records") — basis: our legitimate interest (art. 6(1)(f) GDPR). We name that interest plainly: building our help on what actually happened in similar cases rather than on assumptions. On top of that, and entirely voluntarily, you can tick an optional box while placing your order: if you do not tick it, your case does not enter the practice records at all. The box is not a condition of purchase and does not replace the legal basis — it only narrows what goes in.

What a practice record contains. Every feature enters as a broad category, never as a value. About how the case went: whether a written reply was made or not; whether the supporting paperwork was complete or not; whether the other side had already been contacted; who that other side is — a private party or a public authority; whether you are in the country or not; and the citizenship regime, in two categories. About your situation, in wide bands: an age group (under 30, 30–40, 40–50, 50–65, 65 and over), not your age; a monthly income band (no income, under €1,000, €1,000–2,000, €2,000–3,000, over €3,000), not your figure; the autonomous community — an autonomous city in the case of Ceuta and Melilla — and not the province, the town or your address; and the household composition, grouped: one, two, or three and more adults; no children, one, two, or three and more; and single parent yes, no or not recorded. Added to that are the outcome of the case and how long it took. Each feature also has its own "not recorded" category: not knowing is an observation too, and we do not replace it with a guess. What does not go in: your name, your contact details, your NIE/NIF, your address or town, your documents, the texts you wrote, your exact age, your exact income, or any exact amounts or dates. While the record is being computed we use a technical pseudonym to group the events of one case; that pseudonym is not carried into the stored record, and the record keeps no link back to your case file. We still treat it as pseudonymised data and not as anonymous data: that is the honest classification, and the more demanding one for us.

How to object. You can object to this particular use at any time (art. 21 GDPR), and you do not have to give reasons to stay out of it: simply leave the box unticked when you place your order — the same gesture by which it is given — or write to info@right-now.es and we will withdraw it for you. Both routes count equally; email is not the only one. From that moment your case stops being used to derive new practice records.

About the records already stored, the honest picture is this. A stored record carries no name, no pseudonym and no link to your case file — so we are objectively not in a position to tell which record came out of your case, and the GDPR addresses that situation head-on: under art. 12(2) GDPR the exercise of the rights in arts. 15 to 22 may be limited only where the controller DEMONSTRATES that it is not in a position to identify the data subject, and our demonstration is the construction of the record described above. If you give us information that lets your record be pointed to reliably, we will honour the objection in full and delete it; we will say it plainly: given how the record is built, such pointing will rarely be possible. For as long as the record is not pointed to, after your objection the stored records are used solely in aggregate statistics with a minimum-count threshold — never one at a time, and never for any measure or decision about an individual person; the balancing behind that continued use is documented in our legitimate interests assessment, and is not derived from our being unable to find the record. Objecting does not affect the service already delivered, nor the other processing described in this policy.

4. Artificial intelligence (NAVI)

NAVI processes the information you give us to structure your situation, suggest a route and prepare documents. We do not make automated decisions producing legal effects about you without human involvement: AI is a support tool, and decisions affecting your case are made by the relevant authorities, organisations or professionals. You can ask how your case was handled and request human review.

If you use NAVI or a generator as a user and do not become a client, your prompts and free-text answers are not stored beyond your actual session, unless you separately ask us to submit an unsupported-topic request for research. Information about a non-client user's personal situation may be used for statistics and demand research only in anonymised and aggregated form, without being linked to an identifiable person. If you place an order, the prompt, documents and context may become part of the order materials and are retained under the rules below.

5. Recipients and processors

We do not sell your data and we do not transfer it to third parties without your consent, except where the law expressly requires it. The following providers may access it, as processors and only to deliver the service:

• hosting and infrastructure: cdmon, Spain / European Union;
• analytics: Google Site Kit / Microsoft Clarity;
• payments: Stripe;
• email and communications;
• certified communications and burofax-type notice delivery: Notificados.

Where your case requires an external professional (lawyer, gestor, mediator) and you authorise it, we share only the data needed with them. We may also disclose data to authorities where legally required.

6. International transfers

Some technology providers may process data outside the European Economic Area. Where this happens, we apply the safeguards required by the GDPR, including adequacy decisions, standard contractual clauses or equivalent lawful mechanisms.

7. Retention

Order means a specific request for a RightNOW service or product: a consultation, document review, generator, Action Plan, case management, RightNOW Sent delivery, Protection Plan subscription or another product you expressly choose.

Client personal data linked to an order is kept only for the period needed to service that order and is deleted after completion, unless longer retention is required for legal, accounting, payment, security or legal-claims reasons. Case documents and materials are deleted or anonymised after the order work is completed, taking into account any technical recovery period where needed.

For subscription clients, data is kept until the subscription ends and for a further 3 months, so that you can restart without losing your context. If the subscription is not restarted, the context is deleted or anonymised, except for the minimum data we must keep by law.

If you provided your name, surname and email but did not buy a product, those contact details may be kept for marketing purposes for up to 1 year and then automatically deleted if you did not become a client. If you become a client, the retention of those contact details is extended for the whole service relationship and for 1 year after the relationship with RightNOW ends, unless you ask us to delete them earlier and the law does not require otherwise.

Anonymised statistical data and aggregated research may be kept for longer where it cannot reasonably identify a specific person.

Practice records, described in section 3, are kept for as long as they still serve that statistical purpose of improving the service. They are stored separately from your case materials and do not extend the retention of those materials, which continues to follow the paragraphs above. The other side of it has to be said just as plainly: because the stored record carries no name, no pseudonym and no link to your case file, we can locate "your" record only if you yourself give us information that points to it reliably — under art. 12(2) GDPR that limitation applies only where the inability to identify is demonstrated, and demonstrating it is on us, not merely asserting it. How your objection operates — including what becomes of records already stored — is described in section 3.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, and withdraw consent, by writing to info@right-now.es. If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es.

9. Security

We apply reasonable technical and organisational measures to protect your data (encryption in transit, access controls and backups). No system is infallible, but we work to minimise risk.

10. Minors

RightNOW Spain is intended for adults. If a case concerns a minor, the data must be provided by a parent, guardian or legal representative, or with valid authorisation.

11. Cookies

We use first- and third-party cookies for the site to work and, with your consent, for analytics. You can manage your preferences at any time through the cookie consent tool available on the website.

12. Changes

We may update this policy. The version in force is always published on this page.

Last updated: 21 August 2026. Related documents: Legal notice · Terms and conditions.