Last updated: 11 October 2026
At Ramallo Abogados we take the protection of your personal data and professional secrecy very seriously. This policy explains what data we process, for what purposes, for how long and what rights you have, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: RamalloAbogados SL (Ramallo Abogados)
- Tax ID (NIF/CIF): B44631521
- Address: C. de Don Juan Díaz, 2, 3rd Floor, 29005 Málaga, Spain
- Phone: (+34) 666 72 49 70
- Email: carlos@ramalloabogados.com
2. What data we process
Depending on how you interact with us, we may process the following categories of data:
- Identification and contact data: first name, surname, email address, phone number and, where applicable, postal address.
- Content of your enquiry: subject, message and any information about your case that you voluntarily provide.
- Data needed to provide legal services (if you instruct us): ID card or passport, NIE, tax, banking and financial data, details of the properties or companies concerned, case documents and, where the matter requires it, health data (for example, in road traffic accident claims).
- Browsing data: IP address, browser and device type, pages visited, language and data obtained through cookies, as explained in the Cookie policy.
If you provide us with data relating to third parties, you confirm that you have informed them and obtained their consent to share it with us.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering the enquiries you send us through the contact form, email, phone or WhatsApp, and sending you quotes. | Your consent when you send us the enquiry and steps taken at your request prior to entering into a contract (art. 6.1.a and 6.1.b GDPR). |
| Providing the legal services you have engaged, managing your file, invoicing and the client relationship. | Performance of the professional services contract (art. 6.1.b GDPR). |
| Processing health data or other special categories of data when needed for your matter. | Establishment, exercise or defence of legal claims and your explicit consent (art. 9.2.f and 9.2.a GDPR). |
| Complying with the firm’s legal obligations: tax, accounting, professional ethics and anti-money laundering (Spanish Law 10/2010), which requires lawyers to identify clients in certain transactions, for example property purchases or company incorporations. | Compliance with legal obligations (art. 6.1.c GDPR). |
| Producing anonymous statistics on the use of the website (Google Analytics / Google Tag Manager) in order to improve it. | Your consent through the cookie panel, which you may withdraw at any time (art. 6.1.a GDPR). |
| Ensuring the security of the website and preventing fraud and spam. | Legitimate interest of the controller (art. 6.1.f GDPR). |
We do not make automated decisions or carry out profiling with legal effects on you. We will not use your data to send you commercial communications without your prior consent.
4. Mandatory data
The fields required in the contact form (first name, surname, email and message) are needed to deal with your request. If you do not provide them, we will not be able to reply. You confirm that the data are accurate and undertake to inform us of any changes.
5. Retention period
- Enquiries that do not lead to an engagement: for as long as needed to answer them and, at most, one year from the last contact.
- Clients: for the duration of the professional relationship and, afterwards, for the limitation periods of any legal and professional liability (generally five years under article 1964 of the Spanish Civil Code; six years for accounting and commercial records; and ten years for anti-money laundering records).
- Browsing data and cookies: for the periods stated in the Cookie policy.
Once these periods have expired, the data will be securely deleted or anonymised.
6. Recipients
Your data are protected by the lawyer’s professional secrecy. They will only be disclosed to third parties where necessary to provide the service you have engaged or where required by law, for example to:
- Courts, notaries, land and commercial registries, the Spanish Tax Agency, the National Police, Immigration Offices and other public authorities.
- Court representatives (procuradores), experts, translators, banks, insurance companies and the opposing party when necessary for your matter.
- The Executive Service of the Commission for the Prevention of Money Laundering (SEPBLAC), in the cases provided for by law.
The following technical service providers also have access to the data as data processors, under contracts that guarantee confidentiality:
- Web hosting: SiteGround Spain S.L., with servers in the European Union.
- Email: SiteGround Spain S.L. (ramalloabogados.com mail server).
- Web analytics: Google Ireland Ltd. (Google Analytics and Google Tag Manager), only if you accept analytics cookies.
- Maps: Mapbox Inc., which displays the maps of our offices and receives the visitor’s IP address.
- Calculators: Supabase Inc., which hosts the calculation parameters (it does not receive the figures you enter, which are processed in your browser).
- Fonts: Google Fonts and other content delivery networks (CDNs) serving the website’s fonts and stylesheets, which receive the visitor’s IP address.
- Consent management: CookieYes Limited, which records your cookie preferences.
- Messaging: if you contact us via WhatsApp, the service is provided by WhatsApp Ireland Ltd. under its own terms.
7. International transfers
Some of the above providers (Google, Mapbox, Supabase, Meta/WhatsApp) may process data outside the European Economic Area, mainly in the United States. In such cases, transfers are based on the EU-US Data Privacy Framework, where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission, with any additional safeguards required.
8. Your rights
You may exercise the following rights at any time:
- Access: find out whether we process your data and obtain a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when they are no longer needed, unless we are legally required to keep them.
- Objection: object to certain processing based on legitimate interest.
- Restriction: ask us to suspend processing in certain cases.
- Portability: receive your data in a structured, commonly used format, or have them transmitted to another controller.
- Withdraw your consent at any time, without affecting the lawfulness of prior processing. For cookies, you can do so from the “Cookie settings” link at the bottom of every page.
To exercise these rights, write to carlos@ramalloabogados.com or to our postal address, stating the right you wish to exercise and proving your identity. We will reply within one month, which may be extended by two further months in complex cases.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid — https://www.aepd.es) or with the supervisory authority of your country of residence in the European Union.
9. Minors
This website is not intended for children under 14. If you are under that age, please do not provide us with personal data without the consent of your parents or guardians. If we discover that we have received data from a minor without such consent, we will delete them.
10. Security
We apply technical and organisational measures appropriate to the risk to protect your data against loss, misuse, unauthorised access, alteration or destruction: encrypted connection (HTTPS), restricted access to information, backups, strong passwords and a duty of confidentiality for all staff of the firm and its providers.
11. Changes to this policy
We may update this policy to reflect changes in the law or in our services. The current version will always be published on this page, with its date of update. If the changes are significant, we will inform you by appropriate means.
In the event of any discrepancy between the language versions of this policy, the Spanish version shall prevail.