Last updated 22 August 2026
Privacy
What we collect, why, who else sees it and how long we keep it. Written to describe what the system actually does rather than to cover every eventuality.
Who is responsible
The data controller is Davide Di Grottole, trading as Tenerife Lab, NIF Y9615051F, Calle Benchijigua 7, 38627 Arona, Santa Cruz de Tenerife, Spain.
Telephone +34 641 030 846.
SimplyNIE is a trading name of the same business. There is no separate company behind it.
You can reach us at davide@simplynie.com about anything on this page.
What we collect
Only what the application needs. There is no analytics, no advertising and no tracking of any kind on this site.
| What | When | Why |
|---|---|---|
| Name, email | When you first write to us | To answer you and to open your case |
| Phone number | If you give it | To reach you on WhatsApp, which is how most clients prefer to talk |
| Where you are now | On the enquiry form | Which offices are worth trying depends on it |
| What you need the NIE for | If you tell us | Some reasons change which NIE applies |
| Date of birth, nationality | When you complete your details | Form EX-15 asks for them |
| Passport number | When you complete your details | Form EX-15 asks for it |
| Address | When you complete your details | Form EX-15 asks for it |
| Documents you upload | When you send them | Usually a passport copy, to prepare and check the application |
We do not ask for, and have no use for, anything about your health, beliefs, politics or anything else the GDPR treats as a special category.
Why we are allowed to
For a case we are working on: performing the contract between us (GDPR Article 6(1)(b)). We cannot complete form EX-15 without the details it asks for.
For an enquiry that has not become a case: our legitimate interest in answering someone who wrote to us (Article 6(1)(f)). You can ask us to delete it at any point and we will.
For keeping the record of a completed case: our legal obligation to retain business records (Article 6(1)(c)).
Who else sees it
Davide handles every case himself. Nobody else at Tenerife Lab reads your file.
Four suppliers process data on our behalf, each under a contract that limits them to doing so:
| Supplier | What they hold | Where |
|---|---|---|
| Supabase | The database, your uploaded documents and your sign-in | Frankfurt, Germany |
| Resend | Emails we send you, and their delivery logs | Ireland |
| Vercel | Serves the website. Does not hold your case data | EU region |
| Hostinger | The domain, and the mailbox Davide reads | EU |
Your details go to Policía Nacional as part of the application itself — that is the point of the service, and the application is made in your name.
We do not sell anything to anybody, and we do not share your data for advertising.
How long we keep it
Documents you upload — the passport copy and anything else — are deleted 30 days after your case closes. This is automatic: a scheduled job removes the files and the records pointing at them, and it runs whether or not anyone remembers.
The case record itself — your name, the service, the dates, what was agreed — is kept for as long as Spanish law requires business records to be kept, and then deleted.
An enquiry that never becomes a case is deleted when we tell you we cannot help, or on request.
What you can ask for
You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, ask us to send it to you in a portable form, or object to us holding it. Write to davide@simplynie.com and we will answer within a month.
Deleting a case in progress means we cannot continue it — the application needs the details. We will say so before doing it rather than after.
If you think we have handled your data badly, you can complain to the Agencia Española de Protección de Datos at aepd.es. We would rather you told us first.
How it is protected
Your case is readable only by you and by Davide. That is enforced by the database itself rather than by the website, so it holds even if someone reaches the data another way.
Uploaded documents are in private storage. They are never served from a public address, and a link to one expires after a minute.
Sign-in is by emailed link. There is no password to be guessed or reused.
Questions about any of this go to tenerifelab1@gmail.com.