Last updated 30 September 2026
Privacy
What we collect, why, who else sees it and how long we keep it. Written to describe what the system actually does rather than to cover every eventuality.
Who is responsible
The data controller is Davide Di Grottole, trading as Tenerife Lab, NIF Y9615051F, Calle Benchijigua 7, 38627 Arona, Santa Cruz de Tenerife, Spain.
Telephone +34 641 030 846.
SimplyNIE is a trading name of the same business. There is no separate company behind it.
You can reach us at davide@simplynie.com about anything on this page.
What we collect
Only what the application needs. We do not use general website analytics. If advertising measurement is enabled and you accept it, Google Ads can recognise an ad visit and be told when it led to a sent enquiry, a tap on our WhatsApp link or a payment; the details are in the last two rows below.
| What | When | Why |
|---|---|---|
| Name, email | When you first write to us | To answer you and to open your case |
| Phone number | If you give it | To reach you on WhatsApp, which is how most clients prefer to talk |
| Where you are now | On the enquiry form | Which offices are worth trying depends on it |
| What you need the NIE for | If you tell us | Some reasons change which NIE applies |
| Date of birth, nationality | When you complete your details | Form EX-15 asks for them |
| Passport number | When you complete your details | Form EX-15 asks for it |
| Address | When you complete your details | Form EX-15 asks for it |
| Documents you upload | When you send them | Usually a passport copy, to prepare and check the application |
| Which of our ads you clicked | Only if you came from one of our Google ads and then wrote to us | To see which ads bring clients. The click reference arrives in the page address and is saved with your enquiry |
| Google Ads measurement data | Only if advertising measurement is enabled and you accept it | To attribute a sent enquiry, a tap on our WhatsApp link or a completed payment to an advert. This can include the ad click, consent state and page, and for a payment its value, currency and transaction reference. Never what you wrote in the form or on WhatsApp |
We do not ask for, and have no use for, anything about your health, beliefs, politics or anything else the GDPR treats as a special category.
Why we are allowed to
For a case we are working on: performing the contract between us (GDPR Article 6(1)(b)). We cannot complete form EX-15 without the details it asks for.
For an enquiry that has not become a case: our legitimate interest in answering someone who wrote to us (Article 6(1)(f)). You can ask us to delete it at any point and we will.
For keeping the record of a completed case: our legal obligation to retain business records (Article 6(1)(c)).
For noting the ad click reference with your enquiry: our legitimate interest in knowing which advertising brings us clients (Article 6(1)(f)).
For Google Ads cookies and conversion measurement, if enabled: your consent (Article 6(1)(a)). You can refuse or withdraw it at any time from Cookie settings without affecting the service.
Who else sees it
Davide handles every case himself. Access to your file is limited to the people who operate SimplyNIE — today Davide and the developer who maintains the system. The database holds that list and refuses everyone else, so it is not a rule anybody could forget to apply.
The following suppliers process data on our behalf, each under terms that limit how it is used:
| Supplier | What they hold | Where |
|---|---|---|
| Supabase | The database, your uploaded documents and your sign-in | Frankfurt, Germany |
| Resend | Emails we send you, and their delivery logs | Ireland |
| Vercel | Serves the website. Does not hold your case data | EU region |
| Hostinger | The domain, and the mailbox Davide reads | EU |
| Google Ads, if advertising measurement is enabled | Ad and conversion measurement data, only with your consent | Google global infrastructure, subject to its data-transfer safeguards |
Your details go to Policía Nacional as part of the application itself — that is the point of the service, and the application is made in your name.
We do not sell personal data. If advertising measurement is enabled and you consent, we send the limited conversion-measurement data described above to Google Ads; we do not send your name, email, passport or uploaded documents.
How long we keep it
Documents are deleted 30 days after your case closes — the passport copy you sent us, anything else you uploaded, and anything Davide sent you. All of it, with no exception. This is automatic: a scheduled job removes the files and the records pointing at them, and it runs whether or not anyone remembers. Save what you are sent when you get it.
The same job erases what you told us about yourself: your date of birth, passport number, nationality, addresses, your parents’ names and your marital status. Those exist to fill in form EX-15, and the form has been filed by then. What is kept is the business record — the reference, the service, the amount, the dates, the link to your invoice — together with the messages between you and Davide and enough to reach you if you come back: your name, email and phone number. That is held for six years, as Spanish law requires of business records, and then deleted.
An enquiry that never becomes a case is deleted when we tell you we cannot help, or on request.
What you can ask for
You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, ask us to send it to you in a portable form, or object to us holding it. Write to davide@simplynie.com and we will answer within a month.
Deleting a case in progress means we cannot continue it — the application needs the details. We will say so before doing it rather than after.
If you think we have handled your data badly, you can complain to the Agencia Española de Protección de Datos at aepd.es. We would rather you told us first.
How it is protected
Your case is readable only by you and by Davide. That is enforced by the database itself rather than by the website, so it holds even if someone reaches the data another way.
Uploaded documents are in private storage. They are never served from a public address, and a link to one expires after a minute.
Sign-in is by emailed link. There is no password to be guessed or reused.
Questions about any of this go to davide@simplynie.com.