1. Data controller
- Controller: APLIDER CONSULTING, S.L.
- Tax ID (NIF): B18784751
- Registered address: Calle Reina Fabiola, 2, 18220 Albolote (Granada), Spain
- Email: contacto@abogadosdegranada.com
APLIDER CONSULTING, S.L. owns three lawyer directories: abogadosdegranada.com, abogadosdemalaga.es and abogadosdesevilla.es. In this policy they are referred to together as “the Directories”. This policy applies to abogadosdegranada.com (hereinafter, “the Directory”).
No data protection officer has been appointed, as one is not required for this activity.
This is an English translation of the Spanish privacy policy. In case of discrepancy, the Spanish version prevails.
2. Who processes the data at each stage
- APLIDER CONSULTING, S.L. is responsible for collecting the data through the Directory’s forms, storing it and passing it on to the law firms when the user requests or consents to it.
- Each law firm that receives an enquiry becomes an independent controller of that data from the moment it receives it, in order to deal with the enquiry. It processes the data with its own means and under its own privacy policy. Advertising law firms undertake by contract to use that data only to reply to the enquiry.
3. Processing activities, purposes and legal bases
A) Enquiry sent from a law firm’s profile
- Data: name, email address, telephone number (optional) and the text of the enquiry.
- Purpose: to deliver the enquiry to the law firm chosen by the user, and to no other.
- Legal basis: taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR). The user asks to contact a specific professional, and passing on the enquiry is the way to do so.
- Recipient: only the law firm of that profile.
- Retention: the Directory does not keep a copy of these enquiries. It only forwards them by email to the law firm.
B) Enquiry sent from the general form
- Data: name, email address, telephone number (optional) and the text of the enquiry.
- Purpose: to make the enquiry available to the Premium law firms of the three Directories, so that they can offer the user their assistance.
- Legal basis: the data subject’s consent (Art. 6(1)(a) GDPR). Consent is given by ticking a specific box, which is not ticked by default and is separate from accepting this policy. If the box is not ticked, the system neither stores nor sends the enquiry.
- Recipients: all law firms with a Premium profile on abogadosdegranada.com, abogadosdemalaga.es or abogadosdesevilla.es at that time that have access to the portal enquiries. There may be several of them, and they may be based in any of the three provinces. Any of them may contact the user. Enquiries written in English are also sent to all of them, so the reply may come in Spanish. The up-to-date list can be requested at contacto@abogadosdegranada.com.
- What the law firms see: in their private area, the date, the Directory through which the enquiry arrived, the beginning of the text and the email address. The full text and the telephone number, if given, only appear when the enquiry is opened. The system does not record which law firm opens each enquiry.
- Retention: the enquiry remains in the private area for a maximum of three months from the date it was sent, or less if it is replaced by more recent enquiries. It is then deleted. Any copies already obtained by each law firm are governed by that firm’s own policy.
- Withdrawal of consent: consent may be withdrawn at any time by writing to contacto@abogadosdegranada.com. The enquiry is then removed from the private area. Withdrawal does not affect contacts that the law firms have already made.
C) Special categories of data within the enquiry
By its nature, a legal enquiry may contain health data or data relating to criminal offences, concerning the user or third parties. The form asks users to describe their case with only what is strictly necessary for a law firm to assess it, and without attaching documents. If the user voluntarily includes this type of data in the general form, the consent given by ticking the box extends to it (Art. 9(2)(a) GDPR). We recommend not including data that identifies other people.
D) Request to be listed, from a lawyer or law firm
- Data: name of the lawyer or law firm, address, telephone number and email address.
- Purpose: to contact the applicant to explain how to advertise in the Directory.
- Legal basis: the data subject’s consent (Art. 6(1)(a) GDPR) and taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).
- Retention: 6 months from the request. After that period it is deleted automatically, unless a contract is signed. In that case, processing activity E applies.
E) Advertising law firms and users of the private area
- Data: the contact and professional details in the profile; billing details; the law firm’s contact person; the credentials for accessing the private area (the password is stored encrypted and the controller cannot see it; a one-time code, valid for 15 minutes, can also be requested by email to log in); the visit statistics of its profile; and any requests to change its profile or plan, with the photos attached.
- Purpose: to publish the profile, manage the contract, invoice, give access to the private area, show the law firm the statistics of its profile, handle its requests to change its profile or plan, and send notices of new enquiries and service emails (private area activation, renewals and monthly summary).
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal, tax and accounting obligations (Art. 6(1)(c) GDPR).
- Retention: for as long as the contract lasts. Afterwards, for the limitation periods of any claims that may arise from it. Billing data, for the periods required by tax and commercial law.
F) Contact by email
If someone writes to the Directory’s email addresses, their data is used to reply to them. The legal basis is the legitimate interest in dealing with the communication (Art. 6(1)(f) GDPR). The data is kept for as long as the conversation lasts and, afterwards, for one year.
G) Security and technical operation
The server records technical data about visits (IP address, date and page visited) to protect the site against attacks and mass submissions. The legal basis is the legitimate interest in the security of the site (Art. 6(1)(f) GDPR). These records are kept for the time strictly necessary for that purpose.
The visit and click counters of each profile only add up totals. They do not identify the visitor and do not use cookies.
4. Processors
To provide the service, the controller uses web hosting and email providers. They access the data only for that purpose, following the controller’s instructions and under a data processing agreement (Art. 28 GDPR). The up-to-date list of these providers can be requested at contacto@abogadosdegranada.com.
International transfers: none take place. All providers process the data within the European Economic Area.
5. Automated decision-making
No automated decisions are taken and no profiles are created. The order of the listings depends on the type of profile and on a periodic rotation, not on users’ data.
6. Mandatory data
Each form indicates which fields are mandatory. Without them, the enquiry or request cannot be processed. The telephone number is always optional.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time. To do so, write to contacto@abogadosdegranada.com, stating which right you are exercising. If there are reasonable doubts about your identity, you may be asked to prove it.
If the enquiry has already reached a law firm, the rights over that copy must be exercised before the law firm itself. The controller will provide you with its contact details on request.
If you consider that your rights have not been properly respected, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
8. Security
Communications with the site are encrypted (HTTPS). The private area of the law firms can only be accessed with a username and password, or with a one-time code sent by email, which expires after 15 minutes. Email notices to the law firms do not include the user’s data.
9. Minimum age
The forms are not intended for children under 14.
10. Changes to this policy
If this policy changes, the new version will be published with its date. If any change requires new consent, it will be requested.
Last updated: 17 October 2026