Privacy

This policy explains how we process your personal data when you visit this website, book a consultation or contact the firm by email. It applies Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Key terms: personal data is any information about an identified or identifiable natural person. Processing is any operation performed on data, such as collecting, using, storing or deleting it. A processor is a provider that processes data on behalf of the firm.

Jenny Mª. Rodríguez Castro, practising lawyer, ICAM No. 136219, NIF 70975425R, Calle de Atapuerca 5, Piso 4, 28054 Madrid, Spain. Contact: [email protected].

We have not appointed a data protection officer. [pending: confirm whether appointing one is mandatory, GDPR art. 37 and LOPDGDD art. 34]

We collect it directly from you: when you book a consultation, when you write to us or when you send us documents for a matter. Technical data is also generated when you browse the website, as described below.

• Identification and contact details: name, surname, email address and, if you provide it, phone number.
• Booking details: the date and time chosen, the type of consultation and the reason you give.
• Billing details: name or company name, NIF or identity document number and billing address, when needed to issue an invoice.
• Payment details: you enter them and Stripe manages them on its secure payment page. This website and the firm never receive or store your full card details.
• Matter documents: what you send us for your engagement, for example a passport, files or contracts.
• Browsing data: IP address, date and time, pages visited and browser type, for the operation and security of the website.

Special category data: in some matters we may need to process health data or other sensitive data, for example in family or immigration files. This website does not ask for such data when booking. It is only processed within the professional relationship, when necessary for the matter, and subject to professional secrecy.

• Managing your booking, collecting the fee and providing the service: performance of a contract or pre-contractual steps (GDPR art. 6(1)(b)). Your consent is not needed for this.
• Answering your enquiries and keeping in touch about your matter: art. 6(1)(b) GDPR.
• Complying with legal obligations, such as invoicing, keeping tax and commercial records, or checking conflicts of interest under the General Statute of the Spanish Legal Profession and its Code of Ethics: art. 6(1)(c) GDPR.
• Processing special category data when necessary for the establishment, exercise or defence of legal claims, within professional secrecy: art. 9(2)(f) GDPR.
• Keeping the website secure and working: legitimate interest in a secure and available site (art. 6(1)(f) GDPR).
• We do not use your data for marketing and we send no commercial communications. We make no automated decisions with legal effects on you.

We do not sell your data or disclose it to third parties, except to the service providers that process it on our behalf:

• Cal.com: booking calendar and appointment management.
• Stripe: payment of the consultation, on its secure payment page. Stripe may process some data as an independent controller to meet its own fraud-prevention and payment-regulation obligations. [pending: confirm roles with Stripe and Cal.com]
• Zoho Mail: hosting of the firm's mailboxes.
• Cloudflare: hosting, DNS and delivery of this website.

Data is also disclosed to authorities, courts and professional bodies where a law requires it.

Some of these providers are based in the United States. In that case, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on standard contractual clauses adopted by the European Commission. [pending: confirm the mechanism for each provider: Stripe, Cal.com, Zoho and Cloudflare]

We apply reasonable technical and organisational measures: encrypted connections (HTTPS), restricted access to mailboxes and matter files, and the lawyer's duty of professional secrecy. [pending: confirm measures with providers]

• Booking and contact data: for as long as the relationship lasts and afterwards for the statutory limitation periods. [pending: period to be confirmed by the lawyer]
• Billing data: the period set by tax and commercial rules. [pending: period to be confirmed]
• Matter documents: [pending: period to be confirmed by the lawyer, under professional rules and limitation periods]
• Browsing data: [pending: retention period for hosting and Cloudflare logs]

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability. To do so, write to [email protected] stating your name and the right you wish to exercise. We will reply within one month, which may be extended in the cases provided by law.

The right of access to documents in a matter may be limited by professional secrecy. [pending: confirm limits with the lawyer]

If you believe we have not processed your data in accordance with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain, www.aepd.es.

We may update this policy to reflect legal or service changes. The current version is the one published on this page. [pending: last-updated date]