Privacy policy
Last updated: 10 August 2026
1. Data controller
- Controller: Domenech Aviño Legal Services, S.L. («DA LEGALS»).
- Tax identification number (NIF): B22636393.
- Address: Plaza General Santes 4, bajo 2, 46160 Llíria (Valencia), Spain.
- Contact email for data protection matters: josep@dalegals.com.
- Data Protection Officer: not appointed, as the circumstances of article 37 GDPR do not apply.
All information the firm receives from its clients is additionally covered by the lawyer’s duty of legal professional privilege (article 542.3 of the Judiciary Act and the professional conduct rules of the Spanish Legal Profession), which applies independently of, and in addition to, data protection law.
2. What data we process and where it comes from
We process only the data the data subject provides to us. We do not obtain data from external sources and we do not buy databases.
- Website contact form: first name and surname, email address, telephone number, area of enquiry and the description of the case the user chooses to include.
- Email, telephone or WhatsApp: the contact details and the content of the communication.
- Technical browsing data: IP address and request data, logged by the hosting provider for security and operational purposes.
In describing their case, the user may disclose special category data (health, immigration status, criminal convictions, beliefs). We ask that at this first contact you limit yourself to the essentials: the detail is collected afterwards, within the framework of the engagement and through a secure channel.
3. Why we process the data and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| To deal with the enquiry received and send an initial assessment or quote. | Article 6(1)(b) GDPR: pre-contractual steps requested by the data subject. | One year from the last contact if no engagement is entered into. |
| To provide the legal services engaged and conduct the file. | Article 6(1)(b) GDPR (performance of the contract) and, for special categories, article 9(2)(f) GDPR (establishment, exercise or defence of legal claims). | For the duration of the professional relationship and, thereafter, for as long as liability may arise from the engagement. |
| To comply with accounting, tax and invoicing obligations. | Article 6(1)(c) GDPR: compliance with legal obligations. | The periods laid down by tax and commercial legislation. |
| To comply with anti-money-laundering legislation where the firm acts as an obliged entity. | Article 6(1)(c) GDPR, in relation to Act 10/2010, of 28 April. | Ten years from the end of the business relationship. |
| To secure the site and prevent automated or abusive submissions. | Article 6(1)(f) GDPR: legitimate interest in the security of our systems. | Strictly as long as necessary for that purpose. |
| To measure use of the website in aggregate in order to improve its content. | Article 6(1)(a) GDPR: the user’s consent, given through the cookie notice. You may withdraw it at any time without affecting the lawfulness of prior processing. | Up to 24 months, or until consent is withdrawn. |
[PENDIENTE: confirm with Josep whether the firm is an obliged entity under article 2.1 of Act 10/2010 for the services it provides; if it is not, the fourth row is deleted]
We do not send marketing communications or newsletters, and we do not carry out profiling or take automated decisions producing legal effects concerning the data subject.
4. Who else has access to the data
We do not transfer data to third parties save where required by law or necessary for the engagement itself (filing documents with courts and public authorities, court agents, experts or other professionals involved, always with the client’s knowledge).
Providers acting as processors are involved, under a contract complying with article 28 GDPR:
| Provider | Service | Location of the data |
|---|---|---|
| Vercel Inc. | Website hosting. | United States and distribution network. |
| Supabase | Database receiving the contact form and internal management of the file. | European Union (Ireland). |
| Google Ireland Ltd. | Corporate email and calendar. | European Union, with possible access from the United States. |
| Google Ireland Ltd. (Google Analytics) | Aggregate measurement of website visits. Only involved if the user accepts analytics cookies; if they are rejected, it does not apply. | European Union, with possible access from the United States. |
| Hostinger | Domain registration and associated services. | European Union [PENDIENTE: confirm in the Hostinger panel] |
Transfers to the United States rely on the safeguards in Chapter V GDPR: the adequacy decision under the EU-US Data Privacy Framework where the provider is certified and, failing that, standard contractual clauses with supplementary measures.
If the user chooses to contact us via WhatsApp, the conversation takes place on Meta’s platform, subject to its own terms. For particularly sensitive matters we recommend email or an in-person visit.
5. Rights of the data subject
The data subject may exercise the rights of access, rectification, erasure, restriction of processing, objection and portability, and may withdraw consent given, without this affecting the lawfulness of prior processing.
To exercise them, simply write to josep@dalegals.com or to the postal address given, identifying yourself adequately and stating the right being exercised. We will reply within one month.
The exercise of these rights may be limited where the data must be retained under a legal obligation or is necessary for the defence of claims.
If you consider that the processing does not comply with the legislation, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es), without prejudice to contacting us first.
6. Security and minors
We apply technical and organisational measures appropriate to the risk: encryption in transit, per-user access control, hosting with providers holding security certifications, and a duty of confidentiality binding all the firm’s personnel.
The contact form is not addressed to children under fourteen. If we detect that a minor has used it without the assistance of their legal representatives, we will delete the data.
7. Cookies and changes to this policy
The use of cookies is set out in the cookie policy.
This policy may be updated to reflect legislative changes or new services. The date of the latest version appears at the top of the document.