PRIVACY POLICY  

www.lexpat-hispania.com 

Last updated: 20 November 2025 

1. DATA CONTROLLER  

In compliance with Regulation (EU) 2016/679 (General Data Protection Regulation,  GDPR) and Organic Law 3/2018, of 5 December, on Personal Data Protection and  Guarantee of Digital Rights (LOPDGDD), we inform you that the Data Controller of  the personal data processed on this website is:  

ExpatLex-Hispania S.L. 

NIF: B87126587  

Registered OƯice: Calle Juan de Arratia 31, 11540 Sanlúcar de Barrameda (Cadiz)  Spain  

Email: fas@lexpat-hispania.com 

Telephone: 613 224 296 

For the purposes of this Policy, “Website” means www.lexpat-hispania.com.  

2. PERSONAL DATA WE COLLECT  

Depending on the form you use, the services you request, or your interaction with  the Website, we may collect the following categories of data:  

2.1. Data provided directly by the User  

• Identification data: name, surname(s).  

• Contact data: email address, telephone number.  

• Information voluntarily included in contact forms or email  

communications.  

• Billing and professional data (when requesting legal services).  2.2. Data collected automatically  

• Browsing data (IP address, device ID, browser type, operating system).  • Technical cookies required for the functioning of the site.  

• Analytics cookies (only if accepted by the User).  

2.3. Data from third parties 

• Only when necessary for the provision of legal services and always with the  User’s authorization.  

3. PURPOSES OF PROCESSING AND LEGAL BASIS  

Purpose of Processing Legal Basis (GDPR)  

Respond to contact requests submitted through the  Website  

Art. 6(1)(b) – Pre contractual steps  

Provide legal services contracted by the User Art. 6(1)(b) – Contract  performance  

Manage billing, payments, and accounting Art. 6(1)(c) – Legal  obligation  

Send commercial communications related to legal  

services (only with consent) Art. 6(1)(a) – Consent  

Improve Website performance, security, and user  experience  

Comply with legal, administrative, or judicial  requirements  

Art. 6(1)(f) – Legitimate  interest  

Art. 6(1)(c) – Legal  obligation  

We do not make automated decisions or profiling that produces legal eƯects on  the User.  

4. DATA RETENTION  

Personal data will be kept for the following periods:  

• Contact forms: until the inquiry is resolved (maximum 12 months).  

• Client data: for the duration of the contractual relationship and 6 years  thereafter, as required by commercial law.  

• Billing information: 10 years, per tax legislation.  

• Marketing data: until withdrawal of consent.  

• Cookies: as specified in the Cookies Policy.  

Once the retention period ends, data will be securely deleted or anonymized. 

5. RECIPIENTS OF DATA  

Your data may be communicated to:  

• Public Administrations, Courts, and Authorities when required by law.  • Banks and payment service providers (for billing).  

• Professional collaborators of ExpatLex-Hispania S.L., only when strictly  necessary for service provision (e.g., other legal professionals, translators,  or administrative agents).  

• IT service providers (hosting, email services, analytics providers), under  duly regulated data processor agreements.  

We do not transfer personal data outside the European Economic Area unless  appropriate safeguards (e.g., Standard Contractual Clauses) are in place.  

We never sell personal data.  

6. USER RIGHTS  

You have the following rights under GDPR:  

• Right of access to your personal data.  

• Right to rectification of inaccurate or incomplete data.  

• Right to erasure (“right to be forgotten”).  

• Right to restrict processing of your data.  

• Right to data portability in a structured, machine-readable format.  • Right to object to processing based on legitimate interest.  • Right to withdraw consent at any time (for consent-based processing).  

• Right to lodge a complaint with the Spanish Data Protection Authority  (AEPD): www.aepd.es.  

To exercise these rights, contact us at:  

긼긽긾긿김깂깁fas@lexpat-hispania.com 

You must include proof of identity (DNI/NIE/passport or equivalent).  7. SECURITY MEASURES 

ExpatLex-Hispania S.L. applies technical and organizational measures appropriate  to the nature of the data processed, including:  

• SSL encryption  

• Secure servers  

• Access control and authentication  

• Regular security audits  

• Confidentiality obligations for staƯ and collaborators  

Despite these measures, online security cannot be guaranteed 100%.  

8. COOKIES  

The Website uses cookies necessary for its operation and may use analytics or  preference cookies if authorized by the User.  

Details of cookie types, purposes, and retention periods are found in the Cookies  Policy, which forms part of this Privacy Policy.  

9. CHILDREN’S DATA  

This Website is not directed at minors.  

We do not knowingly process data from individuals under 18 years of age.  If you believe a minor has provided data, please contact us to have it deleted.  

10. CHANGES TO THIS PRIVACY POLICY  

ExpatLex-Hispania S.L. reserves the right to modify this Privacy Policy to adapt it to  legal or technological developments.  

Updates will be published on this page, and the date of the latest revision will be  indicated.  

11. CONTACT  

For any questions regarding this Privacy Policy:  

ExpatLex-Hispania S.L. 

Email: fas@lexpat-hispania.com 

Address: Calle Juan de Arratia 31, 11540 Sanlúcar de Barrameda (Cadiz), Spain