Skip to content
Alonso Sala
CRIMINAL LAWYERS
ES
Data & Privacy

Privacy Policy

At Alonso Sala Abogados, we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, share and protect your information in accordance with the European Union General Data Protection Regulation (GDPR) and Organic Law 3/2018, of 5 December, on Personal Data Protection and the guarantee of digital rights (LOPDGDD). It applies to both versions of the site, Spanish and English.

1. Data Controller

The personal data you provide to us will be processed by:

  • Identity: Alonso Sala Abogados
  • Postal address: Velázquez 27, 1ª Planta, 28001 Madrid, Spain.
  • Telephone: +34 91 078 65 74
  • Email: info@alonsosala.com

Data Protection Officer. The firm has not appointed a Data Protection Officer, because none of the circumstances in Article 37(1) GDPR applies —we are not a public authority, we do not carry out regular and systematic monitoring of individuals on a large scale, and we do not process on a large scale the special categories of data of Article 9 or the criminal-offence data of Article 10— and we are not among the entities listed in Article 34(1) LOPDGDD. Any data protection question may be sent to info@alonsosala.com, marking the subject line "Data protection".

2. What Data We Process and Where It Comes From

This website does not use forms: there is no user registration, no private area and no client database reachable from the internet. We process only:

  • The data you give us when you contact us by telephone, by email or in person (name, contact details and whatever you choose to tell us about your matter).
  • The data required for the defence or advice entrusted to us, including the data on the case file.
  • The technical connection data the server automatically records in its access logs: IP address, date and time, page requested, browser and operating system.
  • The web analytics data described in section 3, only if you accept it.

We do not obtain your data from outside sources and we do not build profiles from it. The site's calculation tools (calculators and time-limit look-ups) run entirely in your browser: what you type into them is not sent to our servers or to any third party. In the internal search tool the term you look up appears in the page address; if you have accepted analytics, that address is sent to Google Analytics 4 along with the rest of the measurement.

3. Purposes and Legal Bases

  • Handling your enquiry or appointment request: managing and answering the enquiries and contact requests you send us by telephone or email.
    Legal basis: steps taken at your request prior to entering into a professional engagement (Art. 6(1)(b) GDPR). Where the enquiry reveals criminal-offence data, section 4 also applies.
  • Provision of legal services: taking on and conducting the defence or advice and managing the professional relationship.
    Legal basis: performance of the legal services contract (Art. 6(1)(b) GDPR) and, for invoicing and accounting and tax obligations, compliance with legal obligations (Art. 6(1)(c) GDPR).
  • Site security and operation: server access logs, needed to keep the service available and protected against abuse and attack.
    Legal basis: the controller's legitimate interest in the security of its systems (Art. 6(1)(f) GDPR). You may object to this processing by the means set out in section 7.
  • Web analytics: aggregate, statistical measurement of site usage through Google Analytics 4, for the sole purpose of improving it, and only if you accept the analytics category in the cookie banner. See the details in the Cookie Policy.
    Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

4. Criminal-Offence Data and Professional Secrecy

This firm practises criminal law exclusively: the mere fact of contacting us may reveal data relating to criminal offences, proceedings or precautionary measures. That processing is expressly covered by Article 10 GDPR read together with Article 10(3) LOPDGDD, which permits the processing of data relating to criminal convictions and offences, and to related proceedings and precautionary and security measures, where it is carried out by lawyers and court agents (procuradores) and its purpose is to gather the information supplied by their clients for the exercise of their functions.

That information is further covered by the professional secrecy of the legal profession (Art. 542(3) of the Organic Law on the Judiciary, the General Statute of the Spanish Legal Profession approved by Royal Decree 135/2021, and the Code of Conduct of the Spanish Legal Profession). The duty of secrecy does not lapse when the engagement ends.

This data is not used for any purpose other than the defence or advice entrusted to us: it does not feed the site's analytics, it is not used for advertising, and it is not disclosed to third parties beyond what the defence itself or a legal obligation requires.

5. Retention Periods

We keep each item of data for as long as the purpose that justifies it requires and, after that, only while liabilities may still arise:

  • Enquiries that do not lead to an engagement: kept only for as long as necessary to deal with them and, where applicable, to evidence due diligence (for example, to record a conflict-of-interest check), and deleted once they are no longer needed.
  • Client files: throughout the professional relationship and, once it ends, for as long as liabilities arising from it may be claimed: five years for personal actions (Art. 1964(2) of the Civil Code), four years in tax matters (Art. 66 of the General Tax Act) and six years for accounting and invoicing records (Art. 30 of the Commercial Code). The profession's conduct rules also require us to keep the case documentation safe and to return it to the client on request. Once those periods have elapsed, the file is returned or securely destroyed.
  • Email correspondence: kept with the file of the matter it relates to and subject to the same period; correspondence that belongs to no file follows the period for enquiries.
  • Server access logs: retained for a limited period under the rotation and purge cycle configured on the hosting server. They are not used to build profiles and are not combined with case-file data.
  • Web analytics: analytics cookies expire after two years at most and the reports we consult are aggregate. See the Cookie Policy.
  • Record of your cookie choice: stored in your own browser; we ask you again after 24 months at most.

6. Recipients and Processors

We do not sell your data and we do not disclose it for commercial purposes. The following may have access to it:

  • IONOS — provider of the website hosting (a server managed through the Plesk panel) and of the firm's email. It acts as a data processor (Art. 28 GDPR), with servers in the European Union.
  • Google — provides the Google Analytics 4 service, only if you accept the analytics category.
  • Third parties needed for the matter entrusted to us — court agents (procuradores), expert witnesses, notaries, translators or other instructed lawyers, as well as the courts, the Public Prosecutor's Office and the law-enforcement authorities within the proceedings.
  • Public authorities — where a legal rule so requires, notably the Tax Administration.

International transfers. Site hosting and email remain within the European Union. The only transfer outside the European Economic Area is the one linked to Google Analytics 4 (Google LLC, United States), covered by the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework. In the interests of transparency: Google's measurement tag loads on every page of the site; until you accept the analytics category it writes no cookies and does not identify you, but the very act of requesting that file sends Google technical connection data (IP address, browser and page visited). You can prevent this by blocking the googletagmanager.com domain in your browser or through a blocking extension. The details are in the Cookie Policy.

7. Your Rights

As the data subject, you have the following rights:

  • Access: the right to know whether we are processing your data and to obtain access to it.
  • Rectification: the right to have inaccurate or incomplete data corrected.
  • Erasure: the right to request deletion of your data when it is no longer necessary.
  • Objection: the right to object to the processing of your data in certain circumstances.
  • Restriction: the right to request restriction of the processing of your data.
  • Portability: the right to receive your data in a structured format and to transmit it to another controller.
  • Withdrawal of consent: where processing is based on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

How to exercise them. A message to info@alonsosala.com, or to the postal address in section 1, stating which right you are exercising, is enough. You do not need to send a copy of your identity document: we identify you from the data already in our possession and from the channel you use to contact us. Only if there were reasonable doubts as to your identity could we ask for additional information, and only the minimum necessary (Art. 12(6) GDPR). We will reply within one month of receiving the request, extendable by two further months where the request is complex or several requests are received, in which case we would tell you within that first month (Art. 12(3) GDPR).

Complaints. If you believe the processing does not comply with the applicable rules, or that we have not dealt with your request properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), without prejudice to contacting us first.

8. Security Measures

Alonso Sala has adopted the technical and organisational measures needed to safeguard the security of your personal data and prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed. The whole site is served encrypted over HTTPS and, by design, has no database, no user accounts and no forms, which keeps the exposed surface to a minimum.

9. Changes to the Privacy Policy

We reserve the right to amend this policy to reflect legislative or case-law developments, or changes to the tools used on the site. In such cases, we will announce the changes on this page reasonably in advance of their implementation.

Last reviewed: 2 August 2026.