1. Identity of the Data Controller
Data Controller: Kinga Zgórska
Professional Address: Avenida de Burjassot 206, Door 5, 46025 Valencia, Spain
NIE: Y6027223H
Contact Email: legal@kingazgorska.com
For the purposes of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), the data controller responsible for processing the personal data collected through this website is the lawyer identified above.
2. Personal Data Processed, Sources and Categories of Data Subjects
Through this website and its associated communication channels (email, telephone and messaging services), personal data relating to the following categories of individuals are processed:
- Individuals who submit enquiries or requests for information about the services.
- Individuals who book paid legal consultations.
- Clients and prospective clients.
- Suppliers, collaborators and other professional contacts.
The categories of personal data processed generally include:
- Identification data: first name, surname, tax identification number (NIF), signature, NIE and, where applicable, national identity document number.
- Contact details: postal address, email address and telephone number.
- Data relating to the legal matter: information regarding the facts of the case, documents, data relating to third parties involved, etc.
- Billing and payment data.
In the course of providing legal services, special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, data concerning a person’s sex life or sexual orientation) and data relating to criminal convictions and offences may also be processed where necessary for legal advice or legal representation, in accordance with Articles 9 and 10 of the GDPR and Article 10 of the LOPDGDD.
The personal data originate from:
- The data subject, when they provide the data while contacting the law firm or engaging its services.
- Third parties who provide the data in connection with a legal matter (opposing parties, other professionals, judicial or administrative authorities).
3. Purposes of Processing and Legal Bases
3.1. Enquiries and Requests for Information About Services (Without Consultation or Engagement)
When an individual contacts the lawyer through the website forms, email, telephone or WhatsApp and explains their situation in order to request information regarding the conditions under which services are provided, their personal data (identification data, contact details and, where applicable, basic information relating to the legal matter) are processed solely for the following purposes:
- To respond to the enquiry.
- To provide information about the services offered and the conditions applicable to them (consultation fees, working methods, appointment requirements, etc.).
At this stage, only information regarding the conditions under which professional services are provided is supplied. Communications exchanged prior to engagement do not constitute personalised legal advice and do not imply acceptance of the professional engagement.
The legal basis for this processing is:
- The implementation of pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR).
- The legitimate interest of the lawyer in maintaining, for a reasonable period, a record of the communications and the information necessary to prevent conflicts of interest and address potential liabilities (Article 6(1)(f) GDPR).
If no paid consultation or professional engagement is ultimately formalised, the personal data will be retained only for the time necessary to deal with the request and, subsequently, for the limitation periods strictly necessary for the establishment, exercise or defence of legal claims and for conflict of interest checks, applying the principles of data minimisation and, where appropriate, restriction of processing or blocking of the data, in accordance with Articles 5, 18 and 32 of the GDPR.
The information provided by the data subject is protected by the legal professional privilege applicable to the legal profession and will not be used for purposes incompatible with those described above.
Documentation submitted by prospective clients shall be used exclusively for the purpose of assessing whether to accept the proposed professional engagement. If no paid consultation or professional engagement is ultimately formalised, such documentation shall not be used for any other purpose and shall be retained only for the time strictly necessary to deal with the request, verify the absence of conflicts of interest and address any potential legal liabilities that may arise. Thereafter, it shall be erased or, where legally required, blocked in accordance with the applicable legislation.
3.2. Paid Legal Consultations and Professional Engagements
Where the data subject books a paid legal consultation or formally engages the lawyer’s professional services, personal data are processed for the following purposes:
- To provide legal advice and, where applicable, legal representation in judicial proceedings.
- To analyse the legal matter and prepare the client’s file.
- To communicate with the client, opposing parties, other professionals, and judicial or administrative authorities.
- To manage invoicing, collection of professional fees and accounting matters.
The legal basis for the processing is:
- The performance of a contract to which the data subject is a party (Article 6(1)(b) GDPR).
- Compliance with legal obligations applicable to the lawyer (including tax, accounting, anti-money laundering and procedural legislation, among others) (Article 6(1)(c) GDPR and Article 8 LOPDGDD).
Where special categories of personal data and criminal data are processed, the additional legal basis is the necessity for the establishment, exercise or defence of legal claims or where courts are acting in their judicial capacity (Articles 9(2)(f) and 10 GDPR, Article 10 LOPDGDD), together with any applicable sector-specific legal provisions (for example, in relation to health or insurance matters).
3.3. Management of Professional Contacts, Suppliers and Collaborators
The contact details of natural persons acting on behalf of legal entities, sole traders and independent professionals are processed in order to maintain professional and business relationships and to manage professional engagements and communications.
The legal basis for this processing is the legitimate interest of the data controller (Article 6(1)(f) GDPR and Article 19 LOPDGDD).
3.4. Informational Communications
Where applicable, contact details may be used to send information regarding legal developments or professional services:
- Where there is a pre-existing contractual relationship and the communications relate to similar services, the legal basis may be the legitimate interest of the data controller, without prejudice to the data subject’s right to object (Articles 6(1)(f) and 21 GDPR).
- In all other cases, the data subject’s consent will be required (Article 6(1)(a) GDPR).
The data subject may object at any time to the processing of their personal data for direct marketing purposes.
4. Data Retention
In accordance with the principle of storage limitation (Article 5(1)(e) GDPR), personal data shall be retained as follows:
- Enquiries without a paid consultation or professional engagement: for the time necessary to deal with the request and, subsequently, for the limitation periods strictly necessary, including, where appropriate, to verify the absence of conflicts of interest arising from the practice of the legal profession, applying, where appropriate, the restriction of processing or the blocking of the data.
- Paid legal consultations and clients: for the duration of the professional relationship and, once it has ended, for the limitation periods applicable to any civil, professional, tax or criminal liabilities that may arise.
- Billing and accounting data: for the periods required under applicable tax and commercial legislation.
- Professional contacts and suppliers: for as long as the professional relationship is maintained and, where applicable, for the limitation periods relating to potential liabilities.
Once those periods have expired, the personal data shall be erased or, where necessary, blocked for restricted retention, in accordance with the LOPDGDD.
5. Recipients and Disclosure of Personal Data
As a general rule, personal data shall not be disclosed to third parties, except in the following cases:
- Judicial and administrative authorities or other public authorities, where necessary for the defence or management of the legal matter or where disclosure is required by law.
- Other lawyers, court representatives (procuradores), expert witnesses or other professionals involved in the matter, where necessary for the provision of the legal services and subject to the duty of legal professional privilege.
- Tax advisers, accountants, banking institutions and service providers necessary for the internal management of the law firm (such as IT service providers, web hosting providers, email service providers, etc.), who shall act as data processors under agreements complying with Article 28 GDPR.
- Tax authorities and any other competent public authorities where disclosure is required by law.
No international transfers of personal data outside the European Economic Area are envisaged. Should services involving transfers to third countries or international organisations be used, compliance with Articles 45 to 49 GDPR shall be ensured (including adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules or, where applicable, specific derogations), and the data subject shall be informed of the applicable safeguards and any associated risks.
6. Rights of Data Subjects
The data subject may exercise the rights recognised under Articles 15 to 22 GDPR and Articles 12 to 18 LOPDGDD against the lawyer, including:
- Right of access: to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, to access those data and the related information.
- Right to rectification: to request the correction of inaccurate or incomplete personal data.
- Right to erasure (“right to be forgotten”): to request the deletion of personal data in the cases provided for in Article 17 GDPR.
- Right to restriction of processing: to request that the processing of personal data be restricted in the cases provided for in Article 18 GDPR.
- Right to object: to object to processing based on the legitimate interest of the data controller or on the performance of a task carried out in the public interest.
- Right to data portability: to receive the personal data provided by the data subject in a structured, commonly used and machine-readable format and to transmit those data to another data controller where the processing is based on consent or on a contract and is carried out by automated means.
To exercise these rights, the data subject may submit a written request to the data controller at the postal address indicated above or by email to legal@kingazgorska.com, specifying the right they wish to exercise and enclosing a copy of their identity document.
The exercise of these rights shall be free of charge unless the requests are manifestly unfounded or excessive, in which case a reasonable fee may be charged or the request may be refused, in accordance with Article 12 GDPR and Article 12 LOPDGDD.
The data subject also has the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) if they consider that the processing of their personal data infringes the applicable data protection legislation.
Data of Deceased Persons
Persons related to the deceased by family ties or de facto relationship, as well as their heirs, may request access to, rectification or erasure of the deceased person’s personal data, unless the deceased expressly prohibited this or such restriction is established by law, in accordance with Article 3 LOPDGDD.
7. Processing Based on Consent
Where processing is based on consent, such consent shall be freely given, specific, informed and unambiguous, and shall be obtained by means of a clear affirmative action (for example, by ticking a checkbox on a form). Pre-ticked boxes or silence shall not constitute valid consent.
The data subject may withdraw their consent at any time, without affecting the lawfulness of any processing carried out prior to its withdrawal. It shall be as easy to withdraw consent as it is to give it.
The performance of a contract or the provision of legal services shall not be made conditional upon the data subject’s consent to the processing of personal data that are not necessary for the professional relationship, in accordance with Article 7(4) GDPR and Article 6(3) LOPDGDD.
8. Data Security
Appropriate technical and organisational measures are implemented to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature of the personal data processed and the risks to the rights and freedoms of natural persons, in accordance with Articles 24, 25 and 32 of the GDPR.
9. Confidentiality and Legal Professional Privilege
The lawyer is bound by legal professional privilege, which entails both the duty and the right to maintain confidentiality regarding all facts and information acquired in the course of any aspect of their professional activity, and may not be compelled to disclose such information, in accordance with the Organic Law on the Judiciary (Ley Orgánica del Poder Judicial) and the General Statute of the Spanish Legal Profession (Estatuto General de la Abogacía Española).
10. Amendments to this Privacy Policy
This Privacy Policy may be amended in order to reflect legislative changes, case law developments, administrative guidance issued by the Spanish Data Protection Agency (AEPD), or changes in the personal data processing activities carried out.
Where any material changes are made, users will be informed through notices published on the website or by any other appropriate means.