Book free consultation

Legal

Privacy Policy

Last updated:

Your privacy matters. This policy explains, in clear terms, what personal data we collect, why we collect it, how we protect it and the rights you have under European and Spanish data protection law.

1. Data controller

In accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD"), the data controller of the personal data collected through this website is:

2. What personal data we collect

We only collect the personal data that is strictly necessary for the purposes described below.

2.1 Data you provide through the contact form

  • Name — to address you appropriately.
  • Email address — to reply to your enquiry.
  • Message — the content of your enquiry, including any personal data you choose to share with us.
  • Consent record — confirmation that you have read and accepted this Privacy Policy, together with the date and time of submission.

2.2 Data you provide by email or telephone

If you contact us directly by email or by telephone, we will process the contact details you share with us and the content of your communication.

2.3 Technical data

Our hosting provider may automatically collect technical information such as IP address, browser type, device type, date and time of access and pages visited, for the sole purpose of maintaining the security and proper functioning of the website. This data is not used to identify you personally.

3. Purposes of processing

We process your personal data only for the following purposes:

  • To respond to your enquiries and to provide the information you request.
  • To send you, where applicable, a quotation and to manage the engagement of legal services.
  • To comply with our legal, accounting and tax obligations.
  • To maintain the security and integrity of the website.

We will not use your data for automated decision-making, profiling, or for sending commercial communications unrelated to your enquiry.

4. Legal basis for processing

The legal bases that allow us to process your data are:

  • Your consent (Art. 6.1.a GDPR), provided when you submit the contact form and accept this Privacy Policy.
  • The performance of a contract or pre-contractual measures taken at your request (Art. 6.1.b GDPR), where you contact us with a view to engaging our legal services.
  • Compliance with legal obligations (Art. 6.1.c GDPR), including professional, accounting and tax obligations applicable to a Spanish lawyer.
  • Legitimate interest (Art. 6.1.f GDPR), to ensure the security and proper functioning of the website.

5. Data retention

Your personal data will be retained only for as long as necessary to fulfil the purpose for which it was collected, and thereafter for the period required to comply with applicable legal obligations (in particular, professional, accounting and tax obligations).

  • Enquiries that do not result in an engagement — retained for a maximum of 12 months from the last interaction, after which they are deleted.
  • Client files — retained for the period required by professional, accounting and tax legislation (generally up to 6 years from the end of the engagement, or longer where mandatory retention periods apply).

6. Recipients and third-party processors

We do not sell or rent your personal data. We only share it with the following categories of recipients, acting as data processors under the appropriate contractual safeguards:

  • Form service provider — Formspark (operated by Trampoline Software SRL, Belgium; form submissions stored on infrastructure located in Ireland). Processes contact form submissions on our behalf.
  • Hosting provider — stores the website files and may process technical access logs.
  • Email provider — used to receive and send our professional correspondence.
  • Public authorities — where disclosure is required by law (for example, tax authorities, courts or supervisory authorities).

7. International data transfers

As a general rule, your personal data is processed within the European Economic Area ("EEA"). Our form service provider, Formspark, is established in Belgium and stores submissions in Ireland, so no transfer outside the EEA takes place in that case.

Should any of our other service providers (for example, hosting or email infrastructure) be located outside the EEA, the transfer will be protected by the appropriate safeguards required by the GDPR, such as the Standard Contractual Clauses approved by the European Commission and, where applicable, an adequacy decision or the EU–US Data Privacy Framework.

8. Your rights

You may exercise the following rights at any time, free of charge, by writing to andrea@francoabogados.com with the subject line "Data protection":

  • Access — to know what personal data we hold about you.
  • Rectification — to correct inaccurate or incomplete data.
  • Erasure — to request the deletion of your data when it is no longer necessary.
  • Restriction — to limit the processing of your data in certain circumstances.
  • Objection — to object to the processing of your data on grounds related to your particular situation.
  • Portability — to receive your data in a structured, commonly used, machine-readable format.
  • Withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.

We may ask you to provide proof of identity in order to verify your request. We will respond within one month of receipt, with the possibility of an extension of two further months in particularly complex cases, in which case we will inform you within the first month.

9. Right to lodge a complaint

If you consider that the processing of your personal data does not comply with the applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es.

10. Security measures

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, in accordance with the state of the art and the nature of the data processed, including the use of secure connections (HTTPS) and access controls.

11. Cookies and similar technologies

This website does not use advertising, marketing or analytics cookies. It does not load tracking scripts, third-party fonts or social media widgets that profile users. The hosting platform may set strictly necessary technical cookies to ensure the security and correct delivery of the website. These cookies are exempt from the consent requirement under article 22.2 of Law 34/2002 (LSSI-CE).

If, in the future, this website incorporates analytical or marketing technologies, a separate cookie banner and cookie policy will be implemented and your prior consent will be requested.

12. Minors

This website is not directed at minors under 14 years of age. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data without the consent of their parents or legal guardians, please contact us so we can delete it.

13. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. The version published on this page, together with the date last updated, shall be the version in force.

14. Contact

For any question regarding this Privacy Policy or the processing of your personal data, please contact us at andrea@francoabogados.com.