At Welllaw Abogados we process your personal data with the confidentiality inherent in lawyers’ professional secrecy and in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). This policy explains who processes your data, for what purposes, on what legal basis, to whom it is disclosed and what rights you have.

1. Data controller

  • Controller: PEREZ-PADILLA PEREZ DE LA BLANCA & LAQUE ABOGADOS, S.L.P. (Welllaw Abogados)
  • Tax ID (NIF): B93395119
  • Address: C/ San Juan de los Reyes, 2, 2.º dcha., 29005 Málaga (Spain)
  • Telephone: (+34) 952 225 199
  • Privacy contact email: admin@welllaw.es

Welllaw Abogados is not among the entities required to appoint a Data Protection Officer under Article 34 of the LOPDGDD. For any privacy matter, please contact us at the address above.

2. What data we process, why and on what legal basis

a) Enquiries received through the contact form, by email or by telephone

  • Data: name, email address, telephone number (where applicable) and the information you provide in your message.
  • Purpose: to respond to your enquiry or request for information and, if you so request, to prepare a fee proposal.
  • Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in replying to those who contact us (Art. 6(1)(f) GDPR).
  • Retention: for as long as necessary to deal with the enquiry. If no engagement follows, the data are deleted within one year at the latest, unless they must be kept to address potential liabilities.

b) Clients and professional engagements

  • Data: identification and contact details, and the data needed to provide the legal service, invoice and comply with our legal obligations.
  • Purpose: to provide the professional services engaged, manage the client relationship, invoice, and comply with applicable legal obligations (including tax, accounting and anti-money laundering obligations).
  • Legal basis: performance of the contract for professional services (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
  • Retention: for the duration of the professional relationship and thereafter for the periods required by law and the limitation periods for any claims that may arise.

c) Marketing communications and newsletters

  • Data: name and email address.
  • Purpose: to send you, by email, newsletters, legal updates and information about our services and activities.
  • Legal basis: your consent (Art. 6(1)(a) GDPR) or, if you are a client of the firm, our legitimate interest in informing you about services similar to those you have engaged, as permitted by Article 21.2 of the LSSI-CE (Art. 6(1)(f) GDPR).
  • Retention: until you withdraw your consent or object to receiving these communications. You can unsubscribe at any time, easily and free of charge, using the link or instructions included in each communication, or by writing to admin@welllaw.es.

d) Job applications and CVs

  • Data: the information included in your CV and any documents you send us.
  • Purpose: to assess your application for the firm’s recruitment processes.
  • Legal basis: your consent when sending us your application (Art. 6(1)(a) GDPR) and, where you take part in an open recruitment process, steps prior to entering into a contract (Art. 6(1)(b) GDPR).
  • Retention: for the duration of the recruitment process and, with your consent, for up to one year for future processes. Please do not include in your CV special categories of data (for example, health data) that are not necessary.

e) Browsing the Website

The server records technical connection data (such as your IP address) for security and operational purposes. The use of cookies and embedded third-party content is explained in our Cookie Policy.

Fields marked as mandatory in the forms are necessary to deal with your request; if they are not completed, we will not be able to respond. You warrant that the data you provide are accurate and that, if you provide third parties’ data, you are entitled to do so and have informed them.

3. Recipients

Your data will not be disclosed to third parties except where required by law (for example, to the tax authorities or the courts) or where necessary to provide the service engaged (for example, to court agents (procuradores), notaries, registries or judicial and administrative bodies). No automated decision-making or profiling takes place.

We use providers that process data on our behalf as processors, in accordance with Article 28 GDPR:

  • Arsys (Spain): website hosting.
  • Microsoft (Microsoft 365): email, office software and sending of communications.

In addition, if you consent through the cookie panel, content from Google (map on the contact page) and X (posts on the blog) is loaded; these providers process data in accordance with their own privacy policies.

4. International transfers

Some of these providers may process data outside the European Economic Area, in particular in the United States. In that case, transfers are based on Commission Implementing Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework, for entities certified under it (such as Microsoft Corporation and Google LLC), or on the standard contractual clauses approved by the European Commission.

5. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 22 GDPR), and withdraw any consent you have given, without affecting the lawfulness of prior processing. To do so, write to admin@welllaw.es or to our postal address, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

If you consider that we have not processed your data properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, Paseo de la Castellana, 141, 28046 Madrid; www.aepd.es; e-office: sedeaepd.gob.es).

6. Minors

The Website is not directed at children under 14. If you are under that age, please do not provide us with personal data without the authorisation of your parents or guardians (Art. 7 LOPDGDD).

7. Security and confidentiality

We apply technical and organisational measures appropriate to the risk to protect your data against loss, alteration or unauthorised access. All firm personnel are bound by a duty of confidentiality and, with regard to client information, by lawyers’ professional secrecy.

8. Changes to this policy

We may update this policy to reflect changes in the law or in our processing activities. The version in force is always the one published on this page.

This English version is provided for convenience. In the event of any discrepancy, the Spanish version shall prevail.

Last updated: October 2026.