Privacy & Data Protection Policy
Last Updated: October 20, 2026 • Regulated under EU Regulation 2016/679 (GDPR) & Spanish Organic Law 3/2018 (LOPDGDD)
1. Principles of Data Protection
SolFi Telecom Iberia, S.L. values subscriber trust and privacy above all. We are committed to transparency, data minimization, and robust digital security under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”).
We never sell, rent, monetize, or trade subscriber personal data or internet traffic to third-party advertising networks.
2. Personal Data We Collect & Legal Basis
Full legal name, date of birth, nationality, contact phone, email, and identity document number (Passport, NIE, DNI, or EU National ID) along with digital document verification scans.
Legal Basis: Mandatory statutory compliance with Spanish Telecommunications Law (Ley 25/2007, Art. 6) requiring subscriber identity registration prior to cellular line assignment.
Email address, customer ID, and tokenized payment records. All card transactions are processed directly via PCI-DSS Level 1 certified payment infrastructure (Stripe Payments Europe, Ltd.). SolFi never stores full credit card numbers or CVC security codes on its servers.
Legal Basis: Performance of a contract (Art. 6.1.b GDPR).
Delivery address for courier shipments (physical SIM cards and Wi-Fi 6 routers) and optical installation addresses for home fibre setup.
Legal Basis: Performance of a contract (Art. 6.1.b GDPR).
3. Data Processors & EU Infrastructure
Your data is stored in high-security, encrypted data vaults located within the European Union. We partner strictly with GDPR-compliant data processors:
- Stripe Payments Europe, Ltd. (Ireland): Certified PCI-DSS Level 1 payment processor.
- Supabase Inc. (Frankfurt, EU Region): ISO 27001 certified encrypted cloud database infrastructure.
- Licensed Spanish Host Telecom Networks: Official subscriber registry notification under CNMC oversight for line provisioning and emergency call routing (112).
- Correos Express: Tracked logistics courier for physical shipments within Spain.
4. Data Retention Periods
Personal data is retained only for as long as strictly necessary to fulfill the services contracted and satisfy statutory legal obligations:
- Telecommunications Registry Data: Retained for the statutory duration mandated by Spanish Law 25/2007 (currently up to twelve months following line termination).
- Invoices & Tax Records: Retained for five (5) years in compliance with Spanish General Tax Law (Ley 58/2003).
5. Your Statutory Rights (ARCO / GDPR)
Under Articles 15 to 22 of the GDPR, you hold full statutory control over your personal data:
To exercise any of these rights, email our Data Protection Desk at support@gosolfi.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD at www.aepd.es).