Back to home

GDPR · Spanish Data Protection Act

Privacy policy

Data controller

Richard Edo Gómez, professional address at Avinguda l'Aigüera 5 (Ed. Anfiteatro C) Entresuelo 2, 03501 – Benidorm (Alicante), Spain, trading as Veredum Legal & Investment. Contact channel for data protection matters: the contact form on this site, stating “Data protection” in the description of the matter.

What data we process

Only what you give us when completing the enquiry form or writing to us: full name, company, email address, phone, the area you are enquiring about and the description of the matter. We do not collect data by hidden means and we do not build profiles.

We ask that this first description not include special categories of data or sensitive documents: if the matter progresses, we will point you to a secure channel to send them.

Why and on what legal basis

  • To answer your enquiry and assess whether we can take the matter on, on the basis of pre-contractual steps at your request (article 6.1.b GDPR).
  • To provide the legal service if the engagement is formalised, on the basis of performance of the contract (article 6.1.b).
  • To comply with our legal obligations in commercial, tax and anti-money-laundering matters (article 6.1.c).

How long we keep it

If the enquiry does not lead to an engagement, your data is deleted within one year at most. If it does, it is kept for the duration of the relationship and afterwards, duly blocked, for the limitation periods of any actions and those imposed by anti-money-laundering rules.

Who it is shared with

We do not pass your data to third parties except where legally required or where it is essential to defend your interests before courts or public authorities. The technology providers serving us act as processors, under signed contract and within the European Economic Area or with equivalent safeguards.

Private client area

If you are a client of the firm and we give you access to our private area, we also process the data needed for it to work securely: your username and email address, your password (stored irreversibly, so that nobody at the firm can know it), the access codes we send you by email, the record of sign-ins and activity (date and time, browser and a pseudonymised fingerprint of the IP address) and the documents you send us that way.

The purpose is to let you follow your matter, read the documents we share with you and send us documents securely, on the basis of the performance of the contract for professional services (article 6.1.b GDPR). The access record is also kept on the basis of our legitimate interest in protecting the confidentiality of your information against unauthorised access (article 6.1.f).

All information in the private area is stored encrypted on the server, and the documents you send us are encrypted so that only the firm can open them. The website's hosting provider acts as a data processor.

The activity record is kept for twelve months. Your account is closed when the professional relationship ends or when you ask us to; the documents in your file are kept as described in the previous section.

Blog newsletter

If you subscribe to receive our articles by email, we process your email address, the language in which you prefer to receive them, and the date and IP address from which you confirmed the subscription, which we keep as proof of your consent.

The purpose is to send you each new article we publish on the blog, on the basis of your consent (Article 6(1)(a) GDPR). You may withdraw it at any time using the unsubscribe link included in every email, without affecting the lawfulness of earlier sends.

The subscription only becomes active once you confirm it from the email we send you; if you do not confirm it, your details are deleted within a week. The data is stored on the website's server, whose hosting provider acts as data processor, and the emails are sent from that same server, without third-party mailing services. When you unsubscribe, we delete your address.

Your rights

You may request access to your data, its rectification or erasure, the restriction of or objection to processing, and portability, through the contact form on this site or in writing to our registered office, providing suitable identification. If you consider that we have not dealt with your request properly, you may complain to the Spanish Data Protection Agency.

Security and professional privilege

We apply technical and organisational measures appropriate to the risk. Independently of data protection law, whatever you tell us is covered by the lawyer's duty of professional secrecy.