Privacy Policy
Last updated: 2025-07-14
At RIGFARM STORE OÜ (hereinafter, "Movea"), we are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Movea Remote Spain Lite platform, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable legislation.
1. Data controller
The data controller for your personal data is RIGFARM STORE OÜ, a company registered in Estonia (EU), with registry code 16323171. Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 3 // 5 // 7, 10145, Estonia. For any data protection inquiries, you can contact us at hola@movea.lat.
2. Data we collect
We collect the following categories of personal data: (a) Eligibility assessment (screener) data: nationality, current location, employment status, type of employment relationship, income, family composition, interests (Beckham, family), available documentation, and paying company country. (b) Onboarding data: full name, email, WhatsApp number, preferred language, consents granted. (c) Documents: files uploaded to the case file (passport, contracts, bank statements, family documentation, etc.), including file name, type, size, and upload date. (d) Payment data: Stripe transaction identifier, amount, currency, payment status, and date. We do not store credit card data; this is managed exclusively by Stripe. (e) Usage data: pages visited, actions performed on the platform, activity timestamps, and technical browser data.
3. Legal basis for processing
We process your personal data on the following legal bases: (a) Contract performance (Art. 6.1.b GDPR): processing is necessary for the delivery of the contracted service (eligibility assessment, checklist generation, case dashboard, partner coordination). (b) Consent (Art. 6.1.a GDPR): for sharing your case file with external partners (lawyers, tax advisors, administrative agencies) when necessary for your case. This consent is freely given, specific, informed, and unambiguous, and you may withdraw it at any time. (c) Legitimate interest (Art. 6.1.f GDPR): to improve our services, prevent fraud, and ensure platform security. (d) Legal obligation (Art. 6.1.c GDPR): to comply with applicable tax, accounting, and data retention obligations.
4. Purposes of processing
We use your personal data to: assess your eligibility for the international remote work route in Spain; generate your personalized document checklist; manage your case through the dashboard; coordinate with qualified external partners (legal, tax, administrative) when necessary and with your consent; process your payment securely through Stripe; communicate with you about your case status; improve the platform and user experience; comply with legal and tax obligations; and maintain an audit log of actions performed on your case.
5. Data recipients
Your personal data may be shared with: (a) Supabase (infrastructure provider): data storage and authentication, with servers in the EU. (b) Stripe (payment processor): exclusively for processing your payment, under their own privacy policies and PCI-DSS compliance. (c) Legal, tax, and administrative partners: only when necessary for your case and with your prior and explicit consent. Partners operate under data processing agreements (DPA) that ensure the protection of your data. We do not sell, rent, or transfer your personal data to third parties for commercial purposes.
6. International transfers
Your data is stored on Supabase servers located in the European Union. In the event that any sub-processor operates outside the European Economic Area, we ensure that adequate safeguards exist in accordance with the GDPR, such as standard contractual clauses approved by the European Commission or adequacy decisions. Stripe, as a payment processor, complies with the EU-US Data Privacy Framework and standard contractual clauses.
7. Retention periods
We retain your personal data for the following periods: (a) Active case data: while your case is ongoing and for 3 years after closure, for potential inquiries or claims. (b) Payment data: 5 years from the transaction date, in accordance with applicable tax and accounting obligations. (c) Eligibility assessment data (leads who do not contract): 12 months from last activity, after which it is anonymized. (d) Audit log: 5 years, in accordance with legal traceability obligations. (e) Uploaded documents: deleted 6 months after case closure, unless legal retention obligations apply. After these periods, data is deleted or irreversibly anonymized.
8. Data subject rights
In accordance with the GDPR, you have the following rights: (a) Right of access (Art. 15): obtain confirmation of whether we process your data and access a copy thereof. (b) Right to rectification (Art. 16): request correction of inaccurate or incomplete data. (c) Right to erasure (Art. 17): request deletion of your data when it is no longer necessary, you withdraw consent, or you object to processing. (d) Right to data portability (Art. 20): receive your data in a structured, commonly used, and machine-readable format, and transmit it to another controller. (e) Right to object (Art. 21): object to the processing of your data based on legitimate interest. (f) Right to restriction of processing (Art. 18): request restriction of processing in certain circumstances. To exercise any of these rights, send an email to hola@movea.lat indicating your name, the email associated with your account, and the right you wish to exercise. We will respond within a maximum of 30 days. If you believe your rights have not been adequately addressed, you may file a complaint with the Estonian Data Protection Authority (Andmekaitse Inspektsioon) or the data protection authority of your country of residence.
9. Contact and data protection officer
For any inquiry, request, or complaint related to the protection of your personal data, you can contact us at: hola@movea.lat. RIGFARM STORE OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 3 // 5 // 7, 10145, Estonia. We will address your request as soon as possible and always within the legal period of 30 days.
10. Cookies and similar technologies
The Movea platform uses strictly necessary cookies for the operation of the service: session cookies to maintain your authentication, language preference cookies (Spanish/English), and technical security cookies. We do not use advertising or third-party tracking cookies. Session cookies are deleted when you close the browser or when the session expires. Language preference cookies are retained for 1 year. You can configure your browser to reject cookies, although this may affect the operation of the platform.
11. Minors
The Movea platform is intended for persons over 18 years of age. We do not intentionally collect personal data from minors. If we detect that we have collected data from a minor, we will delete it immediately.
12. Modifications to this policy
RIGFARM STORE OÜ reserves the right to update this Privacy Policy to reflect changes in our data processing practices or applicable legislation. Modifications will be communicated to the user by email or through a notice on the platform at least 15 days in advance. The date of last update is indicated at the beginning of this document.
RIGFARM STORE OÜ · Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 3 // 5 // 7, 10145 · Registry code: 16323171 · Jurisdiction: Estonia (EU) · hola@movea.lat