Privacy Policy
Last updated: 31 October 2026
This policy explains how we handle the personal data of people who contact us through the forms, booking pages, quotes and invoices, chat and email of letrado.eu, mobilitylaw.es, delegadoprotecciondatos.es, and of the team members who use our management panel, in line with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).
1. Data controller
- Controller: Adan Jow Dampha
- Email: contacto@letrado.eu
What you tell us in connection with an engagement is also protected by legal professional secrecy (art. 542.3 of the Spanish Organic Law of the Judiciary) and by the duty of confidentiality (art. 5 LOPDGDD).
2. The data we process
- Identity and contact details: name, email, phone number, company and anything you write in a form.
- Appointments: date, time and the answers you give when booking.
- Communications: the content of your chat or email messages and of our replies.
- Paid appointments: amount, date and status of the payment, and your request that the consultation takes place within the withdrawal period. Stripe receives the card details directly; we can only see partial details, such as the last digits. If you pay by bank transfer, we see your name, your account and the reference on the bank statement.
- Quotes and invoices: items, amounts, billing details and, where applicable, whether you accept or decline them and why.
- Technical data: your IP address. In the chat we store it with the conversation, along with your browser and the page you are writing from. In forms and bookings we use it to prevent abuse and do not store it, unless you tick a consent box for SMS messages, as proof. In forms our hosting provider also works out your approximate location from it. From forms we store that location (city and country or, if it cannot be obtained from the IP address, the country from your phone prefix), the source page and the campaign parameters in the link (utm, fbclid, gclid).
- Team members: name, email, sign-in credentials and activity in the panel.
We do not ask for special categories of data, such as health data or trade union membership, or for criminal records data. If your matter requires them, we will process them only to establish, exercise or defend your legal claims (art. 9.2.f GDPR) and, for criminal records data, on the terms of art. 10 LOPDGDD.
If processing is based on your consent and you are under 14, we need the consent of whoever holds parental authority or guardianship (art. 7 LOPDGDD).
If your data did not come from you (for example, your company or someone else gave it to us), we will tell you where it came from when required, unless professional secrecy prevents it (art. 14.5 GDPR).
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Handling your enquiry, managing your appointment and preparing quotes | Steps taken at your request before a contract (art. 6.1.b GDPR) |
| Providing the service you engage us for and billing it | Performance of a contract (art. 6.1.b GDPR) |
| Meeting tax, accounting and professional obligations | Legal obligation (art. 6.1.c GDPR) |
| Sending you marketing communications | Your consent (art. 6.1.a GDPR) or, if you are already a client and for similar services, legitimate interest (art. 6.1.f GDPR and art. 21.2 of Spanish Law 34/2002, LSSI). You can unsubscribe at any time |
| Protecting our systems and preventing spam and abuse | Legitimate interest (art. 6.1.f GDPR) |
| Knowing where enquiries come from (campaign source and approximate location) | Legitimate interest (art. 6.1.f GDPR). You can object |
| Managing team access to the panel | Relationship with the team member (art. 6.1.b GDPR) and legitimate interest (art. 6.1.f GDPR) |
Fields marked as required are needed to handle your request; without them we cannot do so.
4. AI chat assistant
Some of our websites offer a chat that replies automatically using an artificial intelligence model, and the chat itself tells you so (art. 50 of Regulation (EU) 2024/1689 on artificial intelligence). Your messages, and the data we hold about you if we have already identified you, are sent to the provider listed in section 5 to generate the reply. A team member can read the conversation and take it over.
The assistant gives general information and collects your contact details. It does not give legal advice. We do not make automated decisions with legal effects on you or build profiles for that purpose (art. 22 GDPR). Please do not include sensitive data or details of your matter in the chat.
5. Who receives the data
We do not sell your data. We only disclose it to public authorities and courts when the law requires it or your matter calls for it. These providers process it on our behalf, as data processors (art. 28 GDPR):
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Google Ireland Ltd. (Firebase, Google Workspace) | Database, access to the management panel, and the firm's email and video calls | EU (database in Madrid); panel sign-in and support may be handled from the US | EU-US Data Privacy Framework |
| Vercel Inc. | Application hosting, and working out an approximate city and country from the IP address when a form is sent | EU (Paris); US company | EU-US Data Privacy Framework |
| Plus Five Five, Inc. (Resend) | Sending emails | US (emails may be sent from the EU) | EU-US Data Privacy Framework |
| Upstash, Inc. | Scheduling background tasks such as reminders and automations | EU (Frankfurt); US company | European Commission standard contractual clauses |
| OpenRouter, Inc. | Generating the chat assistant's replies from the conversation, through the AI model provider (by default, Anthropic models) | US | European Commission standard contractual clauses |
| Stripe Payments Europe, Ltd. (Stripe) | Taking card payments for paid appointments. Stripe receives the card details directly | EU (Ireland); may transfer data to its parent company in the US | EU-US Data Privacy Framework |
| Mapbox, Inc. | Map in the management panel (team only) | US | EU-US Data Privacy Framework |
| 20i Ltd | Hosting the letrado.eu website | United Kingdom | European Commission adequacy decision for the United Kingdom |
| Koofr d.o.o. | Storing backups, encrypted before they leave our computers | EU (Slovenia; servers in Germany) | Not needed |
Stripe also handles some data on its own account, as a controller, for example to prevent fraud and meet its legal obligations. It explains this in its privacy policy.
6. International transfers
The table above shows which providers are outside the European Economic Area or may access the data from there, and the safeguard for each transfer. The EU-US Data Privacy Framework is based on European Commission Implementing Decision (EU) 2023/1795, and the standard contractual clauses on its Implementing Decision (EU) 2021/914. The adequacy decision for the United Kingdom is Implementing Decision (EU) 2021/1772, as amended by (EU) 2025/2574. You can ask us for more information or a copy of these safeguards at contacto@letrado.eu.
7. How long we keep it
- Enquiries that do not lead to an engagement, including chat conversations: 12 months.
- Clients: for the duration of the engagement and then for the statutory periods: 5 years for personal claims (art. 1964.2 of the Spanish Civil Code), 4 years for tax purposes (art. 66 of the General Tax Act), 6 years for accounting records (art. 30 of the Commercial Code) and, where applicable, 10 years for anti-money-laundering purposes (art. 25 of Law 10/2010).
- Unsubscribes: we keep your contact marked as unsubscribed so that we can honour it.
- Team members: while they have access and then for the applicable limitation periods.
- Encrypted backups: 90 days, plus up to 30 days in the provider's trash.
When data is due to be erased but liability can still be claimed, we keep it blocked, available only to judges, courts, public prosecutors and the competent authorities (art. 32 LOPDGDD).
8. Your rights
You can ask, free of charge, for access to, rectification or erasure of your data, object to its processing, request its restriction or portability, and withdraw your consent at any time, without affecting the lawfulness of earlier processing (arts. 15 to 22 GDPR and 12 to 18 LOPDGDD). Write to us at contacto@letrado.eu. We will reply within one month and, if we have reasonable doubts about your identity, we may ask you to prove it.
If you are not satisfied, you can complain to the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid, Spain).
9. Cookies and browser storage
We only use what is technically necessary, which does not require your consent (art. 22.2 of Spanish Law 34/2002, LSSI): a session cookie (__session) for people who sign in to the panel and, in your browser, an identifier for the chat conversation and your display preferences. We do not use advertising or analytics cookies.
10. Security
We apply technical and organisational measures suited to the risk (art. 32 GDPR): encryption in transit and at rest, authenticated access with permissions separated by firm, and encrypted backups.
11. Changes to this policy
We will post any changes here and show the date of the last update.