This Privacy Policy governs the processing of the personal data of users of the website alejolm.com (hereinafter, “the Website”), in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

2. Data processed and purposes

We process the personal data you provide to us directly, as well as data generated by your browsing of the Website. The categories of data, the purposes and the legal basis for each are as follows:

Purpose	Data processed	Legal basis
Responding to professional enquiries received by email or telephone.	Name, email address, telephone number and any data voluntarily included in the message.	Pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
Managing the professional relationship and providing any legal services engaged.	Identification, contact and tax data, and any data required for the matter entrusted.	Performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
Responding to invitations for academic, teaching or editorial collaboration.	Name, organisation and contact details.	Legitimate interest in developing professional and academic activity (Art. 6(1)(f) GDPR).
Ensuring the security, availability and proper functioning of the Website.	IP address, access logs and technical browser data.	Legitimate interest in systems security (Art. 6(1)(f) GDPR).
Use of non-essential cookies and similar technologies.	Device identifiers and browsing data.	User consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE).
Complying with legal obligations in tax, accounting and anti-money-laundering matters, where applicable.	Identification and tax data.	Compliance with a legal obligation (Art. 6(1)(c) GDPR).

The Website offers no user registration, private area or payment gateway. Data are not processed for profiling purposes, and no automated decisions producing legal effects for the user are taken.

3. Retention periods

• Enquiries not followed by an engagement: up to one year from the last contact, unless longer retention is necessary.
• Professional files: for the duration of the engagement and, once it has ended, for the limitation periods applicable to any resulting actions and liabilities (as a general rule, five years) and those laid down by the professional conduct rules of the Spanish legal profession.
• Tax and accounting records: six years (Spanish Commercial Code) and four years for tax purposes, counted from the end of the relevant financial year.
• Technical and security logs: twelve months at most.
• Cookie consent: see the Cookie Policy.

4. Data recipients (processors)

Data are not disclosed to third parties except where required by law. Certain providers access the data as processors under a contract entered into in accordance with Article 28 GDPR:

Provider	Service	Location
Hostinger International Ltd.	Web hosting and email associated with the domain.	European Union
Google Ireland Ltd. (Gmail / Google Workspace)	Email service used for communication with users.	EU, with possible transfers to the USA.
Google Ireland Ltd. (Google Fonts)	Web font service used in the presentation of the Website.	EU, with possible transfers to the USA.

In addition, data may be disclosed to courts and tribunals, public authorities, law enforcement agencies and the relevant Bar Association where there is a legal obligation to do so.

5. International data transfers

Some providers may process data outside the European Economic Area. In such cases, transfers are covered by the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) or, failing that, by the Standard Contractual Clauses approved by the European Commission, together with any additional safeguards that may be necessary.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, without affecting the lawfulness of processing carried out beforehand.

To do so, write to lealmartinalejo@gmail.com stating the right you wish to exercise and enclosing a copy of a document evidencing your identity. Requests are answered within a maximum of one month, which may be extended by two further months in complex cases.

If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es).

7. Data security

Appropriate technical and organisational measures are applied to ensure a level of security appropriate to the risk, including: encryption of communications by means of a TLS certificate, access control, strengthened authentication in the tools used, regular backups and software updates. The controller is also bound by the duty of professional secrecy applicable to the legal profession.

8. Minors

The Website is addressed to adults. Data concerning children under 14 are not knowingly collected. If it is detected that data on a minor have been obtained without the consent of those holding parental authority or guardianship, such data will be deleted.

9. Commercial communications

The Website does not send mass commercial communications. Should a newsletter be introduced, subscription will require express consent and may be withdrawn at any time through the unsubscribe link or by writing to the contact address, in accordance with Article 21 LSSI-CE.

10. Changes to this Privacy Policy

This Policy may be updated to reflect regulatory developments or changes to the Website. The version in force is always the one published on this page, stating the date on which it was last updated.

11. Contact

For any question relating to this Privacy Policy, you may write to lealmartinalejo@gmail.com.