Is HayCita legal? What is a crime in Spain — and what is not
Reselling or hoarding Spanish immigration appointments is a crime, and the police prosecute it. Watching a public availability page and telling you when a slot opens is a different activity. Here is the distinction, in the words of the Ministry of the Interior itself.
Short version: paying someone to book a Spanish immigration appointment for you, or buying an appointment from a reseller, is illegal. Paying for a service that watches the public availability page and tells you when a slot opens is not the same thing — and the difference is not a matter of opinion. It is written into the charges the Spanish National Police actually files. This page shows those charges word for word.
What the Spanish police actually prosecutes
The Spanish Ministry of the Interior publishes press releases on its operations against immigration-appointment resale networks. In the operation carried out in Alicante, Murcia and Valencia (21 arrests), the National Police charged four specific offences: computer damage, document forgery, membership of a criminal group and facilitating illegal immigration. This is how the release describes what they did:
“The criminal organisation developed a system for selling appointments online for immigration procedures, accessing the computer server of the Sub-Directorate General for Digital Services and causing blockages through the use of bots.”
“Several of them were tasked with accessing the public/state server in order to monopolise the entire public supply of appointments in certain areas of Spain, making it completely impossible for citizens to obtain an appointment […] other members were responsible for entering false identity data into the Cita Previa application in order to monopolise as many of the offered appointments as possible, and for collecting the sums charged for the sale of the appointment.”
“The services provided involved charging sums for each appointment booking which […] violated the principle of free access presumed in the use of public services.”
Source: Spanish Ministry of the Interior — official press release (translation ours; the original is in Spanish). An earlier operation against a network that blocked the appointment system with a bot in order to resell slots ended with 69 arrests (official release).
Four criminal acts — and what we do instead
Those releases describe four concrete behaviours that carry the criminal liability. None of the four describes what HayCita does:
| What is prosecuted | What HayCita does |
|---|---|
| Blocking the government server with bots so it cannot work normally (art. 264 of the Spanish Criminal Code, computer damage). | We check with a minimum interval of 300 seconds between checks of the same office — a lighter load than one person refreshing the page. We degrade the service for nobody. |
| Hoarding or monopolising appointments by booking them so citizens cannot get them. | We never book. Not a single appointment, ever. When we detect a slot we alert you, and the slot stays open — available to you and to any other citizen looking at that moment. |
| Entering false identity data into the Cita Previa application (document forgery). | We enter nobody's data to make a booking. You book it yourself, with your own real details, on the official site. We do not complete the procedure for you. |
| Charging for the booking itself, violating the free-of-charge principle of a public service (€15–200 per appointment in those cases). | The appointment stays free and you request it yourself on the official government site, paying nothing. What we charge for is a monitoring and notification service. We do not sell appointments and we do not charge to book one. |
The uncomfortable part, stated plainly
The Interior release mentions that the network also used “the system that notified them of appointment availability”. Someone could reasonably ask: isn't that what you do? That deserves a straight answer rather than a dodge.
Yes — detecting availability was one part of what they did. The difference lies in what happens next. They used it to get there first and book in bulk using false identity data, then sell the slot. The four offences charged are exactly those: blocking, hoarding, forging and selling. We stop at the alert. We tell you a slot exists, and there our work ends. The slot stays free and you take it yourself, at no cost, on the official website.
To be precise: these press releases do not declare monitoring to be legal — that is not their purpose; they describe specific crimes. What can be verified by reading them is that none of the offences charged consists of observing public information and telling someone about it. In every one of these operations the liability rests on the blocking, the hoarding, the forgery and the charging for the appointment.
The simplest proof
If HayCita hoarded appointments, our customers would be guaranteed one — we would simply book it for them. They are not guaranteed anything: we alert them, and sometimes they arrive too late because another citizen was faster. That is precisely why we refund people when we fail to alert them. A hoarder does not need a refund guarantee. We do, because we do not control the slot. See the guarantee.
Why the access is lawful
Three articles of the Spanish Criminal Code come up in discussions about appointment monitoring. None applies here:
- Art. 197 bis (unlawful access to computer systems) punishes accessing a system “without authorisation”. Access here uses a legitimate Cl@ve Permanente credential belonging to the operator, exactly as any registered user would. No access control is circumvented.
- Art. 197 ter (intrusion tools) covers programs “specifically designed” to commit such intrusions. A web browser driven by standard automation software is a general-purpose tool used daily by millions of developers, QA teams and public bodies.
- Art. 264 (computer damage) requires conduct that damages, deteriorates or renders data or systems inaccessible. We modify nothing, block nothing and degrade availability for nobody.
Appointment availability is public information: the administration publishes it precisely so that citizens can consult it. There is no secret, no third party's personal data and no restricted system involved. Monitoring and aggregating public information is a long-established practice — price comparison sites, flight trackers and news aggregators all work this way.
What we will never do
- Book an appointment on your behalf.
- Hold, reserve or resell a slot.
- Use your data, or anyone else's, to occupy an appointment.
- Send traffic at a rate that could affect the government service.
- Claim any affiliation with the Ministry of the Interior or any Spanish authority. We have none.
The watch-and-alert model, side by side
The Spanish immigration appointment site (ICPPlus) shows publicly whether or not slots are available. Any citizen can open that page in a browser. HayCita does exactly the same thing, continuously, and tells you when availability appears so that you do not have to keep checking yourself. The difference from the appointment mafias is fundamental:
| Action | HayCita | Appointment mafia |
|---|---|---|
| Check availability | Yes (purpose: alert you) | Yes (purpose: hoard) |
| Book the appointment | Never | Yes (to resell it) |
| Hoard slots | No | Yes |
| Saturate the servers | No (at least 300 s between checks) | Variable |
| Charge for handing over the slot | No | Yes |
You book the appointment yourself, directly on the Ministry's official website, with your own credentials, with no intermediary.
The operator's own Cl@ve credential and your NIE
ICPPlus has two access modes:
- Anonymous access: shows the general availability for the province.
- Access with Cl@ve Permanente: allows filtering by the applicant's specific file, which is required for procedures such as TIE renewal (fingerprints), NIE assignment or TIE collection.
For mode 2, HayCita authenticates on the government gateway with its own operator Cl@ve Permanente account, and uses the NIE you voluntarily provide to identify your file in the availability form. This is equivalent to a trusted relative or adviser checking availability on your behalf from their own computer, with your authorisation.
Your NIE is never used to book anything. It is entered only at the availability-check step (the equivalent of step 3 of the ICPPlus form). The flow stops before the booking step: the system detects whether there is a slot and exits.
This limited delegation is covered by technical assistance (article 13 of Spanish Law 39/2015) and, more broadly, by voluntary representation (article 5 of Law 39/2015), under which any person may act before the Administration on behalf of another with their consent. The consent is recorded explicitly in the alert set-up form, where you read and expressly accept this use.
Your data and your NIE
HayCita applies strict data minimisation: we collect only what is essential to provide the service and delete it as soon as it is no longer needed.
What we collect
- Email — to send you alerts and service messages.
- Phone number (optional) — if you provide it, for SMS alerts.
- Telegram identifier — if you use the bot, for Telegram alerts.
- Province and procedure — to configure the monitoring.
- NIE and name — only if you choose a procedure that requires a Cl@ve check (TIE fingerprints, NIE assignment, etc.). Collected with your explicit consent.
- Payment data — handled entirely by Stripe. HayCita never stores card numbers.
Correction in progress (June 2026): our earlier privacy policy stated “we do not collect the NIE”. That was inaccurate for the procedures that require a Cl@ve check. We are updating all legal texts to reflect this correctly. We apologise for the confusion.
How we protect your NIE
- Encrypted at rest: the NIE and name are stored encrypted with Fernet (AES-128-CBC + HMAC-SHA256). The key lives only in the server's environment variables, never in the database.
- Minimal access: only the monitoring process reads the decrypted value, in memory, at the exact moment of the check, and discards it immediately.
- Deleted after 30 days: NIE and name are erased automatically 30 days after the alert is activated, or earlier if you ask to leave.
- No third parties: the NIE is not shared with any external provider and does not appear in logs or analytics.
Legal basis
- Art. 6(1)(b) GDPR — performance of the contract: providing the alert service (email, SMS, Telegram, monitoring).
- Art. 6(1)(a) GDPR — explicit consent: processing the NIE and name for the procedures that require it. Consent is collected in the alert set-up form and can be withdrawn at any time.
- Art. 6(1)(f) GDPR — legitimate interest: security and technical operation of the service.
Your rights
You may exercise your rights of access, rectification, erasure, portability, restriction and objection at any time by emailing [email protected] with your email or Telegram ID. We answer within 30 days at most. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD). To have your NIE deleted before the automatic 30-day limit, write to the same address with the subject “baja NIE” and your email or Telegram ID; we delete it within 48 hours.
RFC 3161 evidence: a verifiable timestamp
Every alert includes a screenshot of ICPPlus and an RFC 3161 timestamp issued by a recognised Time Stamping Authority (TSA). This means the screenshot cannot have been altered after it was sealed, and the date and time of detection can be verified by any third party (a notary, a judge, the data protection authority). You can use that screenshot as proof that availability existed at that moment, if you need to document your efforts before the Administration. The seal does not guarantee that you can book the slot (slots last seconds), but it does certify that the system detected real availability and alerted you.
Consent and representation
When completing the alert set-up form, the client:
- Reads this page and the Terms of Service.
- Voluntarily provides their NIE and name (if the chosen procedure requires it).
- Expressly accepts that HayCita uses that data exclusively to check the availability of their file on ICPPlus, without booking or taking any other action on their behalf.
- Understands that the appointment must be booked by them, directly, on the official site.
This consent is informed, specific, freely given and revocable at any time. It also constitutes the basis of the limited delegation provided for in article 5 of Law 39/2015 (Common Administrative Procedure) for checking availability on an electronic government site.
The questions we are asked most
Is it legal to pay for an appointment alert service in Spain?
Yes. What the Spanish National Police prosecutes is blocking the government server with bots, hoarding appointments by booking them, entering false identity data into the Cita Previa application, and charging for the booking itself in violation of the free-access principle of public services. A service that only observes public information and notifies the person concerned does none of those things: the appointment remains free of charge and the citizen books it personally on the official government site.
What exactly is a crime regarding Spanish immigration appointments?
According to the Spanish Ministry of the Interior press releases, the offences charged in operations against appointment resale networks are computer damage (blocking the server using bots), document forgery (entering false identity data into the Cita Previa application), membership of a criminal group and facilitating illegal immigration. Those networks charged between 15 and 200 euros per appointment booking, violating the principle that public services are free of charge.
Does HayCita book the appointment for me?
No. HayCita never books appointments. It detects that a slot has opened and alerts you by email, Telegram and SMS. You make the booking yourself, with your own details, free of charge, on the official electronic site of the Spanish Ministry of the Interior (ICPPlus). The slot remains open and available to any citizen.
How is HayCita different from the appointment mafias the police arrest?
In the four behaviours that constitute the offence. The dismantled networks blocked the server with bots, hoarded appointments by booking them in bulk with false data, and resold them. HayCita does not block (it checks at most once every 300 seconds per office), books no appointments, enters nobody else's data, and sells no appointments: it charges for a monitoring and notification service while the appointment itself remains free on the official site.
Do I have to pay to get a Spanish immigration appointment?
No. The immigration appointment (cita previa de extranjeria) is free and is requested on the official electronic site of the Spanish Ministry of the Interior. Nobody should charge you for the appointment itself: charging for the booking violates the free-access principle of public services and has been the subject of police operations. What you may freely choose to pay for is a notification service that tells you when a slot opens.
Is it legal to use a bot to get a Spanish immigration appointment?
It depends entirely on what the program does. Blocking or saturating the administration's server is computer damage under article 264 of the Spanish Criminal Code, and booking appointments in bulk with false data in order to resell them adds document forgery. By contrast, consulting information that the administration publishes for citizens to consult, at a rate that does not affect the service, and telling a person what was observed, does not fall within those offences.
Other questions about legality
Is it the same as the appointment mafias the police pursue?
No. Appointment mafias book the slot and then sell it. HayCita never books. The difference is the one between seeing that a restaurant has a free table and telling you, versus sitting at that table yourself and then charging you to get up.
Could the Ministry block or report HayCita?
A criminal complaint would require proving unauthorised access or damage, and neither occurs: access is always made with a legitimate credential of our own (Cl@ve), to public information, without bypassing any security measure, and with a negligible impact on the infrastructure (human-pace checks, at least 300 seconds between them).
What happens if HayCita closes or suspends the service?
If HayCita sends no alert during the 14 days of service, we refund 100% of the amount paid. See the Terms of Service, section 5.
Is my data safe if HayCita closes?
In the event of closure, we delete all personal data (including the encrypted NIE) before decommissioning the servers, and we notify affected users by email.
This page is information, not legal advice. For questions about your own situation, consult a lawyer specialising in Spanish immigration or administrative law. Controller: HayCita.es — [email protected]. Last updated: 1 October 2026.