Privacy Policy

Last updated: 5 May 2026

This Privacy Policy explains how María Teresa Velasco Gómez, trading as Velasco Lawyers, processes personal data in connection with this website (www.velascolawyers.com) and the legal services we provide. It is issued in accordance with Regulation (EU) 2016/679 (the GDPR), Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

1. Data Controller

  • Identity: María Teresa Velasco Gómez (Velasco Lawyers)
  • NIF: 24237572B
  • Registered address: Calle Arco del Teatro nº 3, 18690 Almuñécar, Granada, Spain
  • Bar registration: Ilustre Colegio de Abogados de Granada nº 3676
  • Contact: [email protected]

For any privacy-related query — including the exercise of the rights described below — please write to [email protected] with the subject line “Data Protection”.

2. Data Protection Officer

Velasco Lawyers has not appointed a formal Data Protection Officer (DPO), as our processing activities do not meet the mandatory thresholds set out in Article 37 GDPR. Privacy matters are handled directly by the Data Controller at the contact address above.

3. Personal Data We Process Through This Website

This website does not collect personal data through forms, registrations, comments or accounts. The website does not include a contact form, newsletter sign-up or client portal.

The only personal data processed in connection with the website is:

  • Communications you initiate. If you write to us at [email protected] (or by phone, post or other channels published on the site), we process the contact details and the content of your communication. Once you become a client, your data is processed under our general client-engagement processing activities, which are governed by professional secrecy under the Estatuto General de la Abogacía Española.
  • Web analytics and tag management data. When you give consent through the cookie banner, Google Analytics 4 and Google Tag Manager process certain technical identifiers (cookies, IP address — truncated, device and browser data, page URLs viewed). See section 8 (Cookies) and our separate Cookie Policy for full details.
  • Server access logs. Our hosting provider records standard technical logs (IP address, timestamp, requested URL, user agent) for security, troubleshooting and abuse prevention. These logs are retained for a maximum of 12 months.

4. Purposes and Legal Bases

Purpose Legal basis (GDPR Art. 6)
Responding to enquiries received by email/phone Art. 6(1)(b) — steps prior to entering into a contract, at the data subject’s request
Provision of legal services to clients Art. 6(1)(b) — performance of contract; Art. 9(2)(f) — establishment, exercise or defence of legal claims, where special-category data is involved
Compliance with anti-money-laundering obligations (KYC / customer due diligence) Art. 6(1)(c) — legal obligation under Law 10/2010 of 28 April
Invoicing, accounting and tax obligations Art. 6(1)(c) — legal obligation under the Spanish Commercial Code and the General Tax Law
Security of the website and prevention of abuse (server logs) Art. 6(1)(f) — legitimate interest in keeping the service secure
Web analytics (Google Analytics 4) and tag management (Google Tag Manager) Art. 6(1)(a) — your consent, given through the cookie banner

5. Recipients and Processors

We disclose personal data only where strictly necessary, and only to the following categories of recipients:

  • Hosting and on-server backups: SiteGround Spain S.L. (servers located in the European Union).
  • Email service: Microsoft Ireland Operations Ltd. — Microsoft Exchange Online (Microsoft 365), with EU data residency under Microsoft’s EU Data Boundary commitments.
  • Web analytics and tag management: Google Ireland Ltd. (Google Analytics 4, Google Tag Manager). Processed on the basis of your consent only.
  • Public authorities, courts and counterparties where disclosure is required for the conduct of a legal matter, by court order, or by law (e.g., AEAT, AEPD, SEPBLAC, Spanish courts).
  • Professional advisors (e.g., external accountants), bound by professional secrecy and a written processing agreement where applicable.

6. International Transfers

Hosting, on-server backups and email are kept within the European Economic Area. Google Analytics 4 and Google Tag Manager involve transfers to Google LLC (United States); these transfers rely on the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) and on Standard Contractual Clauses where applicable. No transfers to third countries occur without an adequate legal basis under Chapter V GDPR.

7. Retention Periods

  • Pre-contractual enquiries that do not lead to engagement: up to 1 year from the last contact.
  • Active client files: for the duration of the engagement and the applicable statute of limitations thereafter (general civil claims: 5 years under Article 1964 of the Spanish Civil Code).
  • Anti-money-laundering documentation: 10 years from the end of the business relationship (Art. 25 of Law 10/2010).
  • Accounting and tax records: 6 years (Art. 30 of the Spanish Commercial Code) and up to 4 years for tax records (Art. 66 General Tax Law), whichever is longer.
  • Server access logs: a maximum of 12 months.
  • Web analytics data: 14 months (Google Analytics 4 default retention).

Once the applicable retention period expires, data is deleted or, where required by law, blocked and kept solely available to the competent authorities until the relevant limitation periods expire.

8. Cookies

This website uses cookies, including third-party analytics cookies set by Google. No non-essential cookie is set before you give consent through the cookie banner. Detailed information about each cookie — name, provider, purpose, duration and category — is provided in our Cookie Policy, which also lets you withdraw or modify your consent at any time.

9. Special Category and Criminal-Offence Data

In the course of providing legal services, we may necessarily process data revealing health, family circumstances, financial situation, or alleged or proven criminal offences (Articles 9 and 10 GDPR). Such data is processed strictly for the establishment, exercise or defence of legal claims (Art. 9(2)(f) GDPR) and is at all times subject to the duty of professional secrecy of the legal profession.

10. Your Rights

Under the GDPR and the LOPDGDD you have the right to:

  • Access the personal data we hold about you (Art. 15);
  • Rectify inaccurate or incomplete data (Art. 16);
  • Erase your data, where applicable (Art. 17) — note that legal, AML and accounting retention obligations may prevent immediate deletion;
  • Restrict processing in the cases listed in Art. 18;
  • Object to processing carried out on the basis of legitimate interest (Art. 21);
  • Data portability for data processed by automated means on the basis of consent or contract (Art. 20);
  • Withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3));
  • Not be subject to decisions based solely on automated processing (Art. 22) — we do not carry out such decisions.

You can exercise any of these rights by writing to [email protected]. We may ask you to provide proof of identity. We will respond within one month, extendable by two further months for complex requests.

11. Right to Lodge a Complaint

If you believe your data protection rights have been infringed, you may lodge a complaint with the Spanish Data Protection Authority:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
www.aepd.es

We would, however, appreciate the opportunity to address your concern first by writing to [email protected].

12. Confidentiality and Professional Secrecy

As Spanish lawyers, we owe a duty of confidentiality to our clients and prospective clients in respect of any information they disclose to us. This duty derives from Article 542.3 of the Organic Law on the Judiciary (LOPJ) and from the Estatuto General de la Abogacía Española, and applies in addition to — and is not limited by — the obligations under data protection law.

13. Changes to this Policy

We may update this Privacy Policy to reflect changes in our processing activities or in applicable law. The “Last updated” date at the top of the document reflects the date of the most recent material change. Where changes are substantial, we will give reasonable advance notice on this website.