Privacy policy

1. Data controller

• Controller Noemí Ampurdanés Parés (Ajuridic)
• NIF 46128288V
• Address Carrer del Freser, 104
  El Clot (Sant Martí)
  08026 Barcelona, Spain
• Telephone 614 26 26 92
• Email [email protected]

The firm is not required to appoint a data protection officer, so enquiries on this subject are dealt with at the addresses above.

2. What data is processed and where it comes from

Contact details and information about the matter sent to the firm come from the person concerned. The website also measures technical page performance with Cloudflare Web Analytics: it collects browser performance metrics and sends them to Cloudflare's measurement service. Cloudflare states that Web Analytics does not collect personal data; this measurement is separate from the content of an enquiry. The site does not buy databases or obtain third-party personal information to build profiles.

The website's contact form

• First name and surname.
• Email address.
• Telephone number, if provided.
• The free text of the message: the description of the matter the person chooses to write.
• The record of acceptance of this policy and the date on which it was sent.

Email

When someone writes to [email protected] we process the email address, the name shown as sender, the content of the message and any documents attached.

Telephone and WhatsApp

When you call or write to 614 26 26 92 we process the telephone number and the information the person provides during the conversation. Calls are not recorded. In the case of WhatsApp, the message is transmitted by that application's provider under its own terms, which have nothing to do with the firm; anyone who prefers not to use it can write by email or telephone.

Requesting an appointment from the website

Anyone using the calendar at /cita/ provides their first name and surname, an email address, a telephone number if they wish, the area the enquiry relates to, the day and time they propose and, if they write one, a short note. Also saved are the record of acceptance of this policy, the date it was sent and, for a few hours, a fingerprint of the IP address, for the sole purpose of preventing anyone from flooding the calendar with false requests.

What is sent that way is a proposed day and time, not a booking: the time is not set aside until the firm replies accepting it or proposing another. Requests that nobody answers expire by themselves and their record is deleted.

Reminders and managing the appointment. When an appointment is confirmed, the firm sends a reminder by email, to the address the person provided, 24 hours and 2 hours beforehand. The appointment emails include a personal link, valid only for that appointment and until the end of the day after its date, from which the person can suggest another date (which the firm must confirm), cancel the appointment or change it from in person to telephone. The link is renewed with each action. Each of these actions is notified by email to the firm and to the person. This processing has the same purpose and legal basis as the appointment request (Art. 6(1)(b) GDPR) and involves no commercial communications.

How you reached the website. Links to this website in the firm's emails carry a label that shows only the type of email (for example, «appointment confirmed»), the same for everyone, without your name, your email address or any identifier. If you come in through one of those links, or from another part of the website (for example, the «Your case» guide), and request an appointment, the request keeps that label together with your details; the firm sees it in the notice of the request and in its internal panel, so that it knows which routes bring in enquiries. In the contact form it appears only in the email the firm receives. Nothing is stored on your device and there is no tracking of whether you open the emails. The label is deleted together with the request (section 5). You may object by writing to [email protected].

Appointment calendar. Confirmed appointments are entered in a Google calendar of the firm or of the lawyer who handles the area of the enquiry, with their date, time, format, area and an internal number, without name, telephone, email or note. Google provides the service as processor. When the appointment is cancelled or changed, the event is updated or deleted.

Monthly newsletter

Anyone who subscribes to the newsletter, either from the form in the website footer or by ticking the optional box on the contact and appointment forms, provides their email address. We also keep the language, the date and time of the request and of the confirmation, the form used, a shortened IP address (without its last digits) and the version and fingerprint of the text accepted. We do not keep the browser or the page from which the person subscribed, and the subscription is not linked to the content of any enquiry or appointment. The subscription only becomes active when the person confirms it from a personal link sent to their email; if someone gives another person’s address and it is not confirmed, no newsletter is sent and the address is deleted. To prevent misuse of the form, in addition to the honeypot anti-spam field and the Cloudflare check, a non-reversible fingerprint of the IP address is used for a few hours. The newsletter contains no tracking pixels and does not record who opens it or which links they click; its links to ajuridic.com carry a campaign tag that is the same for all recipients.

Special category data

Some matters (medical negligence, accidents involving injuries, immigration, family) involve health data or other specially protected data under article 9 of the GDPR. Where the person provides it voluntarily so that their case can be assessed, it is processed under article 9(2)(f) of the GDPR: it is necessary for the establishment, exercise or defence of legal claims. It is handled with the discretion that legal professional privilege requires.

3. What it is used for

• Dealing with the enquiry and replying through the same channel it came in on, or through whichever the person indicates.
• Assessing whether the firm can take the matter on and explaining which route is appropriate and within what time limits.
• Providing the professional services instructed, if the enquiry leads to an instruction, including steps before courts, tribunals and public authorities.
• Complying with the firm's legal obligations : accounting, tax, professional conduct and those arising from anti-money-laundering rules where applicable.
• Preventing abuse of the form by means of a honeypot anti-spam field, which collects no personal data at all. On the subscription form the number of attempts per IP address is also limited, for a few hours.
• Arranging the appointment proposed from /cita/: reviewing it, accepting the time or proposing another, and notifying the outcome by email.
• Referring your enquiry to another lawyer, when the firm will not deal with it and you expressly agree that your request is passed to that lawyer.
• Sending the monthly newsletter to people who have asked for it and confirmed it: at most one email a month, with legal news, things worth knowing, website tools, deadlines, tips and the option to book an appointment. It includes advertising of the firm’s services.
• Proving the consent of subscribers and respecting their unsubscription.

The firm only sends marketing communications to people who have asked for them and confirmed it: the monthly newsletter described in section 2. No profiles are built and no automated decisions with legal effects are taken, and the newsletter is the same for everyone subscribed in the same language: it is not tailored to the matter someone has enquired about or to their appointment.

4. Legal basis for processing

Providing the data is voluntary, but without it no reply is possible: a form with no name and no means of contact does not allow any answer to be given.

Subscribing to the newsletter is voluntary and is not a condition for any enquiry or service.

5. How long it is kept

• Appointment requests: one that expires without a reply, is declined, is cancelled or is replaced by another is deleted after 30 days; a confirmed appointment is deleted 12 months after its date.
• Referral to an associate lawyer: if the person does not reply or declines the proposal, their request is deleted after 30 days and nothing is passed on. If they accept, the firm deletes the request 30 days after passing it on and keeps, blocked for three years, a record of the acceptance (name, email, date, lawyer and text accepted) so that it can be evidenced.
• Enquiries that do not lead to an instruction: they are kept for as long as is needed to reply and, afterwards, for a reasonable period in case the person returns to the matter. Once that period has passed they are deleted.
• Client files: for the duration of the professional relationship and, once it has ended, for the limitation periods of any claims that might arise from the instruction and from professional liability.
• Accounting and tax documents: for the periods imposed by commercial and tax legislation.
• Newsletter. A subscription that is not confirmed is deleted after 30 days at most. A confirmed subscription is kept until the person unsubscribes (or their address stops existing). On unsubscription their email address is deleted; the firm keeps only, blocked and for three years from the unsubscription, the minimum data that proves their consent (dates, language, form, version and fingerprint of the accepted text, shortened IP address, and a non-reversible fingerprint of the email address), available only to judges, courts, the Public Prosecutor, the competent authorities and the data protection authority, and then destroys it. For as long as the firm sends the newsletter, it also keeps the non-reversible fingerprint of the email address, with no other data, so as not to write again to anyone who has unsubscribed unless they subscribe again. The sending log (only an internal number, the date and the result) is kept for three years. The IP fingerprints used to limit attempts are deleted within a few hours.

While they must be kept by legal obligation, the data is blocked: it is made available only to judges, courts, the public prosecutor or the competent authorities.

6. Who it is disclosed to

The data is not sold, rented or transferred for commercial purposes. It is disclosed only where the matter itself requires it or where a rule imposes it:

• Courts, tribunals, the public prosecutor and public authorities, where the matter we are instructed on requires it.
• Court agents, notaries, experts and specialist lawyers from the firm's network of associates, only to the extent that their involvement is necessary for the matter and subject to their own duty of confidentiality. This refers to matters already entrusted to the firm; referring an enquiry is governed by what is explained below.
• An associate lawyer to whom your enquiry is referred, only if you expressly agree, and only with your name, telephone, email, the area of the enquiry and the note you wrote, if any. That lawyer does not act as Ajuridic's processor: once they receive the data they are the controller and will tell you how they process it.
• Google (Calendar), as processor, for the appointment calendar described in section 2.
• Filipino interpreting support. When a person is assisted by a Filipino-speaking person, that person will have access to what is said at the appointment. They may be staff of the firm or an external professional; in both cases they are bound by professional secrecy and, if external, act as a processor under a contract that meets Article 28 GDPR. You are told in advance who will assist you. If they provided the support from outside the European Economic Area, the same safeguards as for professionals in the Philippines would apply.
• Insurance companies and their legal departments, in the claims they are involved in.
• The Ilustre Colegio de la Abogacía de Barcelona, where Bar rules require it.
• The tax authorities and banks, in order to comply with tax obligations and to manage payments.
• Technology providers serving the firm (web hosting, email), which act as processors under a contract complying with article 28 of the GDPR and do not use the data for their own purposes, including storing the newsletter subscriber list and sending the newsletter.
• Cloudflare, which provides the anti-bot verification system for the contact, appointment and subscription forms. It acts as a processor and, in order to check that the sender is a person and not an automated program, processes the IP address and technical data about the connection. It does not access the content of the enquiry.
• Cloudflare Web Analytics, to measure technical page performance using browser metrics, without cookies. Cloudflare states that the service does not collect personal data. Information about data collection.
• Google, through the Gemini API, to generate the replies of the GorIA assistant and to transcribe voice messages. It acts as a data processor and may process the content of the conversation, including audio, outside the European Economic Area; that transfer relies on the safeguards in Chapter V of the GDPR.

The newsletter is sent with the firm’s own email service; no external mass-mailing platform is used.

International transfers. Cloudflare's anti-bot system may process the IP address and that technical data outside the European Economic Area. That transfer relies on the safeguards in Chapter V of the GDPR. Google, through the Gemini API, may process the assistant's text and voice messages in any country where it has facilities, with the safeguards in Chapter V of the GDPR. The firm's other providers, hosting and email, process the data within the European Economic Area. Disclosure of data to professionals in the Philippines, which only takes place with your express written authorisation, is explained below.

Disclosure of data to professionals in the Philippines. Where a matter requires steps to be taken in the Philippines (for example, obtaining or processing documents, property matters or visa formalities), Ajuridic may commission them from a trusted professional established in the Philippines, who acts on Ajuridic's behalf and follows its instructions. Only the personal data needed for that step will be disclosed to them. This will be done only with your express authorisation, given in writing before any data is sent; before asking for it, we will tell you who the recipient is, why it receives the data and which data it is. The professional will process the data as Ajuridic's processor: only for that step, under a duty of confidentiality and without using it for their own purposes, under a contract that meets Article 28 GDPR. If they needed to use another person in the Philippines (a sub-processor), they may do so only with Ajuridic's prior authorisation and subject to the same obligations. The Philippines has no adequacy decision from the European Commission, so its data protection may not be equivalent to European protection, and it may be harder to exercise your rights or bring a complaint. For that reason Ajuridic will not send data until it has signed with the professional the Commission's standard contractual clauses for controller-to-processor transfers (Commission Implementing Decision (EU) 2021/914, Module Two; Article 46(2)(c) GDPR); you may ask for a copy. Only if, exceptionally, there are none, would the transfer rely on your explicit consent, given after being informed of those risks (Article 49(1)(a) GDPR). If special-category data (for example, health data) had to be disclosed, your explicit consent will also be requested (Article 9(2)(a) GDPR). You may revoke your authorisation or withdraw your consent at any time, without affecting the lawfulness of what has already been disclosed; Ajuridic will stop sending data, ask the professional to return or delete it, and tell you whether that part of the service can continue. You may exercise your rights as set out in section 8 of this policy.

7. Legal professional privilege

Quite apart from data protection rules, all the information a client or a potential client communicates to the firm is protected by legal professional privilege, a duty imposed by the Estatuto General de la Abogacía Española (the Spanish Bar's General Statute) and the Code of Conduct, which does not fall away even if the enquiry never becomes an instruction, or when the professional relationship ends.

That obligation goes beyond the GDPR: it covers facts, documents and conversations, and breaching it is a disciplinary offence.

8. The rights of the person concerned

Anyone may exercise the following rights, free of charge:

• Access: to know what data about them is being processed.
• Rectification: to correct data that is inaccurate or incomplete.
• Erasure: to ask for data to be deleted when it is no longer needed.
• Restriction: to ask for data to be kept but not used, while a challenge is being resolved.
• Objection: to object to processing based on legitimate interest.
• Portability: to receive the data in a structured, commonly used format.
• To withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

Newsletter. Anyone who receives it can unsubscribe at any time with the unsubscribe link in any newsletter (unsubscription is immediate) or by writing to [email protected]. Unsubscribing does not affect emails already sent.

If you have accepted a referral, you can withdraw your acceptance before your details are passed on. Once they have been passed on, exercise your rights with the associate lawyer, who is the controller, and with Ajuridic regarding anything the firm keeps.

To exercise them, simply write to [email protected] or to Carrer del Freser, 104, 08026 Barcelona, stating which right is being exercised and enclosing a copy of a document proving identity. A reply is given within one month, extendable to two if the request is complex.

These rights have one limit: they do not allow the deletion of documents the firm must keep by legal obligation or for the defence of claims. In those cases the reason will be explained in writing.

9. Complaint to the supervisory authority

If someone considers that their request has not been dealt with properly, they may lodge a complaint with the Agencia Española de Protección de Datos (the Spanish data protection authority) (C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es). They can also come to the firm first: almost everything is resolved with an explanation.

10. Data security

The firm applies technical and organisational measures proportionate to the risk: an encrypted HTTPS connection across the whole site, access control over case files, backups and the duty of confidentiality of those who work with the firm. No measure removes the risk entirely, but they are reviewed periodically.

11. Minors

This site is not aimed at children under fourteen and does not deliberately collect their data. Where a matter concerns a minor, which is common in family law, the data is provided by the person with legal responsibility for them.

Only people aged 14 or over may ask for the newsletter.

12. Changes to this policy

This policy may be updated if the firm's services or the rules change. The version in force is always the one published on this page, with the date shown at the top. You can also consult the legal notice and the cookie policy.