Privacy policy

Version 2026-09-v1 · last reviewed 13 September 2026

Who is responsible for your data

Stephen Paul Gregory, Exclusive Insurance Agent of Sanitas S.A. de Seguros. NIE Y2155969D. DGSFP register no. C0320Y2155969D. C/ Alcalde Clemente García 19, 5, 30169 San Ginés, Murcia, Spain. Email info@spanishdnvhealthinsurance.com.

Privacy contact: info@spanishdnvhealthinsurance.com

What we collect and why

What you type into a form: your name, email address and, if you choose to give it, a telephone number; and the circumstances you give for a quote — who needs cover, how many people, how you work, where you are applying from, your preferred start date, which plan interests you, and anything else you add in your own words. For a contact enquiry: the consular post you name and your question. NO HEALTH DATA IS COLLECTED THROUGH THIS WEBSITE. The forms ask for none and say so on the page. Separately, the host records ordinary server logs — IP address, browser and request records — as part of running the website.

Quote calculation and policy issuance: pre-contractual measures and performance of a contract, GDPR Article 6(1)(b). Enquiry handling and customer support: legitimate interest in responding to your request, Article 6(1)(f). Legal, tax and anti-money-laundering compliance: legal obligation, Article 6(1)(c). Website security and fraud prevention: legitimate interest, Article 6(1)(f). MARKETING IS NOT CARRIED OUT THROUGH THIS WEBSITE: no marketing consent is sought, none is recorded, no contact created here is set as a marketing contact, and there is no advertising, remarketing or analytics technology on the site. Asking for a quote is not a marketing permission and is not treated as one.

Health information

None on this website. The quote and contact forms collect no health data, ask no medical question, and tell the visitor so. Health insurance is medically underwritten, and any health information relevant to underwriting is given to Sanitas directly — as the insurer and an independent controller — after an application proceeds, never through this site.

Where your enquiry goes

This website's own same-origin relay at /_api/relay.php. The relay chooses the destination server-side and submits to HubSpot forms in portal 47896067: FULL DNV (e54e9790-bd5c-48f8-9ee0-d549e19552e9) for a quote request, GENERAL (045a64d9-1913-4608-a802-f4339b171931) for a contact enquiry. The browser never names the destination and cannot change it.

HubSpot, portal 47896067 — processor under a written Article 28 data-processing agreement.

Where a quote is issued or a policy contracted, Sanitas, S.A. de Seguros (Calle Ribera del Loira 52, 28042 Madrid) acts as an INDEPENDENT data controller in its capacity as insurer. Its privacy practices are published at sanitas.es/RGPD and its Data Protection Officer can be contacted at dpo@sanitas.es.

Who else processes your data

• Hosting: Hostinger — website hosting, processor under a written Article 28 data-processing agreement.
• Email: Hostinger — mail for this domain routes to mx1.hostinger.com and mx2.hostinger.com, verified from the domain's published MX records on 12 September 2026.

Recipients: HubSpot (CRM) and Hostinger (hosting and email) as processors, each under a written Article 28 agreement; Sanitas, S.A. de Seguros as an independent controller where a quote or policy proceeds; Spanish tax and supervisory authorities (AEAT, the DGSFP, anti-money-laundering supervisors) and courts, regulators or law enforcement where legally required. Personal data is not sold. Data is primarily stored and processed within the European Economic Area. Where a provider processes outside the EEA — HubSpot, in the United States — the transfer relies on a European Commission adequacy decision (the EU–US Data Privacy Framework, where applicable), on Standard Contractual Clauses approved by the European Commission, or on supplementary technical and organisational measures where these are required. This website shares nothing with any advertising or remarketing platform, because it uses none.

How long we keep it

A quote or contact request where no policy is issued: up to 12 months from the last interaction. An active policy: for the duration of the policy plus the statutory limitation period. Tax and accounting records: 6 years, under the Spanish Commercial Code and the General Tax Law. Anti-money-laundering and identity records: 10 years, under Law 10/2010. These periods apply to the CRM record as well as to anything held on the website.

Your rights

You may ask for access to your data, its rectification or erasure, restriction of processing, portability, and you may object to processing carried out on the basis of legitimate interest. To exercise any of these, email info@spanishdnvhealthinsurance.com with proof of identity; we reply within one month of receiving the request, as GDPR Article 12 requires. You may also complain to the Agencia Española de Protección de Datos (www.aepd.es). Where Sanitas is the controller, its rights-exercise procedures are governed by its own privacy policy at sanitas.es/RGPD and its Data Protection Officer is dpo@sanitas.es.