Privacy policy — Mémoria

Contents

Data controller
Data we collect
Purposes and legal bases
Retention periods
Recipients and processors
Transfers outside the EU
Security and storage
Your rights

1. Data controller

Controller	Star Alliance Consulting S.L. ("Mémoria")
Tax ID	B19750199
Address	C/ José Ortega y Gasset 22-24, 28006 Madrid, Spain
Data contact	info@starallianceconsult.com

2. Data we collect

a) Through the consultation form

Full name
Email address
Phone number (optional)
Your declared situation and services of interest
Free-text message and preferred language

b) In the course of a contracted service

Depending on the service, we may process:

identity documents (passport, DNI/NIE, family record book);
proof of address (rental contract, title deed, utility bills);
contractual and financial documents (energy, telecom and insurance contracts; bank statements for identifying subscriptions);
property documents (deed, mortgage, warranties, renovation invoices);
household members' data where the procedure concerns them (spouse, minor children).

We never ask for or store your passwords. Where access to a customer portal (supplier, administration) is needed, it is done in your presence or using credentials you enter yourself. No password is ever stored in the files we build.

c) Browsing data

Strictly necessary technical cookies only. See the cookie policy.

3. Purposes and legal bases

Purpose	Legal basis (art. 6 GDPR)
Responding to your consultation request and preparing the call	Pre-contractual steps at your request (art. 6.1.b)
Performing contracted services (procedures, audit, dossier)	Performance of a contract (art. 6.1.b)
Acting on your behalf with administrations and suppliers	Performance of a contract and the express authorisation you sign
Accounting, tax and invoicing obligations	Legal obligation (art. 6.1.c)
Sending information about our services (where applicable)	Consent, withdrawable at any time (art. 6.1.a)

4. Retention periods

Consultation requests with no follow-up: maximum 12 months, then deleted.
Service-related documents: kept for the duration of the contractual relationship. Copies held by Mémoria are deleted within 3 months of its end, except documents we must retain by law.
Invoicing data: 6 years (Commercial Code) and 4 years for tax purposes.
The client's document dossier: it is built and maintained in the client's own storage space (Dropbox, Google Drive, OneDrive). The client owns it and may revoke our access at any time, immediately ending our ability to view it.

5. Recipients and processors

Your data is never sold or transferred to third parties for commercial purposes. It may be shared with:

public administrations (extranjería, ayuntamiento, TGSS, AEAT, DGT…) strictly within the procedure you entrust to us;
suppliers (energy, telecom, insurance, banks) when you ask us to take out or change a contract on your behalf;
partner professionals (gestoría, lawyer) only with your prior agreement, where the matter falls under a regulated profession;
our technical providers, acting as processors within the meaning of art. 28 GDPR:

Provider	Purpose	Location
Netlify	Website hosting and form submissions	United States — standard contractual clauses
[Email provider, e.g. Google Workspace]	Business email	[EU / US — SCC]
Zoom	Remote consultations	United States — standard contractual clauses
Plausible Analytics	Aggregate traffic measurement, no cookies or personal data	European Union

6. Transfers outside the European Union

Some technical providers listed above are established outside the European Economic Area. Such transfers are covered by the mechanisms set out in Chapter V of the GDPR: an adequacy decision (EU-US Data Privacy Framework, where applicable) or standard contractual clauses adopted by the European Commission.

7. Security and storage principle

We apply appropriate technical and organisational measures: restricted access, encrypted storage, two-factor authentication on our accounts, and secure deletion of temporary copies.

Mémoria's core principle: our clients' document dossiers are hosted in their own storage space, which they alone own. We access them only by explicit authorisation, revocable at any time and without notice.

8. Your rights

You have the right at any time to: access your data, rectify inaccurate data, request erasure (subject to our legal retention duties), restrict processing, request portability, object to processing, and withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to info@starallianceconsult.com, enclosing a copy of an identity document. We respond within one month at most.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.

Last updated: 19 July 2026