How to check LOPIVI sexual offences certificates without keeping copies

At the start of every season, each Spanish club with youth teams repeats the same job: asking coaches, instructors, team delegates and volunteers for the negative certificate from the Central Register of Sex Offenders, checking that it's valid, and filing it. The result is usually a folder with dozens or hundreds of PDFs containing a name, an ID number and something as sensitive as the absence (or presence) of convictions.

We've already explained what the LOPIVI requires and how the certificate is verified. This article is the practical part: how to organise the campaign so that every certificate is checked without piling up copies.

What the law requires, and what it doesn'tCopy Anchor Link

Article 57 of the LOPIVI requires anyone taking up an activity that involves regular contact with minors, paid or unpaid, to provide a negative certificate from the Central Register of Sex Offenders. Organic Law 1/1996, in article 13.5, sets out the same requirement.

What the law asks is that the person proves this and that the organisation doesn't employ anyone with a record. It doesn't say the organisation must file the PDF. That difference is what lets you design a campaign with less data.

The Spanish DPA's guide on data protection in employment relationships makes two useful points here: asking for criminal record certificates is only legitimate when a law provides for it (it expressly cites work with minors and article 13.5 of Organic Law 1/1996), and the legal basis for processing that data ends when the employment relationship ends. In other words: whatever you keep, keep it only while the person is in the role.

The campaign in six stepsCopy Anchor Link

1. List the rolesCopy Anchor Link

Before asking for anything, identify who has regular contact with minors: youth coaches and assistants, camp instructors, team delegates, physiotherapists, regular drivers, volunteers who travel with a team every week. One-off help is assessed case by case. That list drives everything: who is asked and who isn't.

2. Write down your age policyCopy Anchor Link

The LOPIVI sets no expiry date for the certificate: it proves the situation on the day it's issued. Decide how old a certificate you accept (for example, issued this season or in the last three months) and apply it to everyone. Put it in your protocol.

3. Collect certificates through a single channelCopy Anchor Link

Avoid email and messaging apps: every email with a PDF attached is another copy, in the sender's mailbox and in yours. A single upload channel (a form on your website, your club management software or a personal link for each person) lets you check the document on the spot and keep nothing you don't need.

Ask for the original PDF downloaded from the e-office, not a photo or a scanned printout: the PDF carries a readable Secure Verification Code (CSV) and the Ministry's electronic signature.

4. Check each certificate on arrivalCopy Anchor Link

For every document, the questions are the same:

• Is it a sexual offences certificate and not something else (for example, the general criminal record certificate)?
• Does it belong to that person? Name and ID number match your list.
• Does the issue date meet your policy?
• Does it say no records?
• Is the CSV readable and plausibly formatted?

5. Verify the CSV on the e-officeCopy Anchor Link

The Ministry of Justice e-office says that whoever receives the certificate should check its validity with the CSV and the holder's ID document (verification guide). That lookup has a CAPTCHA: a person does it. With the previous steps done, it's two values to paste and a button to press. For volume, the official route is for the person to authorise your organisation through the TeAutorizo service (Ministry e-office).

6. Record the minimum and delete the restCopy Anchor Link

To show you did the check you don't need the PDF. One record per person with these fields is usually enough:

When someone leaves the role, review what you hold about them and delete it if there's no longer a basis for keeping it. If your federation or a regulation requires you to keep the document, identify that rule in writing; if you can't find it, you probably don't need to.

What Constaia automatesCopy Anchor Link

Constaia handles step 4 and prepares step 5. The es_sexual_offences_certificate type extracts the holder, their ID number, the issue date, whether records exist (has_records) and the CSV, and runs deterministic checks: the holder's NIF check letter, maximum age and CSV format. For PDFs it also verifies the electronic signature (integrity, trust chain and whether the file was modified after signing). A photo or a scanned printout doesn't carry that signature, and the result will say so.

For one person, when they upload their certificate:

import { Constaia } from "@constaia/sdk";
import { fromPath } from "@constaia/sdk/node";

const constaia = new Constaia(); // reads CONSTAIA_API_KEY

const analysis = await constaia.analyze(await fromPath("certificate.pdf"), {
  expect: "es_sexual_offences_certificate",
  checks: {
    maxAgeDays: 90, // your policy, not a legal deadline
    holder: { fullName: "Laura Pérez Gil", documentNumber: "12345678Z" },
  },
  storage: "none",
  keepResults: false, // neither the file nor the extracted data is kept
  language: "en",
});

const record = {
  status: analysis.verdict?.status, // "valid" | "invalid" | "review"
  noRecords: analysis.fields.has_records?.value === false,
  issueDate: analysis.fields.issue_date?.value,
  csv: analysis.fields.csv_code?.value, // for verification on the e-office
  checkedAt: new Date().toISOString(),
};

For the whole staff at once, a batch of up to 100 documents with shared options:

curl https://api.constaia.com/v1/batches \
  -H "Authorization: Bearer $CONSTAIA_API_KEY" \
  -F "files[]=@certificate_01.pdf" \
  -F "files[]=@certificate_02.pdf" \
  -F "files[]=@certificate_03.pdf" \
  -F 'options={"expect":"es_sexual_offences_certificate","checks":{"max_age_days":90},"storage":"none","export":["xlsx"]}'

Batches are asynchronous: each file is stored encrypted only until its analysis finishes and is then deleted. You're notified when the batch completes and get a spreadsheet with one row per certificate, with its fields and verdict, to build your record from.

What Constaia does not do:

• It doesn't query the Ministry's e-office or bypass its CAPTCHA.
• It doesn't decide whether a role involves regular contact with minors.
• It doesn't replace your protocol when a certificate shows records.

ChecklistCopy Anchor Link

• List of roles with regular contact, reviewed with your child protection officer.
• A written age policy for certificates.
• A single upload channel, no email or messaging apps.
• Type, holder, date, result and CSV checked when each certificate arrives.
• CSV verified on the e-office by a person, or authorisation through TeAutorizo.
• A minimal record per person; delete what's no longer needed when someone leaves.

To try it with your coaching staff, create a free account: 150 documents a month, enough for the coaching staff of many clubs.