Privacy Policy

Last updated: 4 August 2026

1. Data controller

Company name: EDRA LEGAL SLP
Registered office: c/ Mallorca 494, ático 1, 08013 Barcelona
Tax Identification Number (NIF): B26695163
Contact: info@edra.legal

EDRA LEGAL SLP guarantees compliance with current legislation on the protection of personal data, including Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

2. Purpose, legal basis and retention of the data processed

2.1. Legal services

Purpose. The personal data provided will be processed for the following purposes:

• Provision of legal services: to manage the contracting and provision of legal advice and defence services; to handle and respond to legal enquiries; to draw up reports, legal opinions, contracts and other legal documentation; and to organise and deliver training, courses and information sessions.
• Administrative management: invoicing, bookkeeping, file management and compliance with legal and professional obligations.
• Sending information relating to legal services similar to those previously contracted, in accordance with the provisions of the applicable regulations.

Legal basis. Performance of a contract or implementation of pre-contractual measures (Article 6(1)(b) of the GDPR). Compliance with legal obligations applicable to the exercise of the profession (Article 6(1)(c) of the GDPR). Legitimate interest in improving service quality and maintaining professional relationships (Article 6(1)(f) of the GDPR).

Retention. Personal data will be retained for as long as necessary to maintain the contractual relationship and, once this has ended, for the periods established by law to address any potential liabilities. With regard to the sending of informational and commercial communications, the data will be processed for as long as the contractual relationship is maintained or until the data subject requests to be removed from the mailing list or objects to receiving such communications.

2.2. Sending emails

Purpose. To respond to your requests for information, address your enquiries and answer your questions or queries.

Legal basis. Consent of the data subject (Article 6(1)(a) of the GDPR), given when you send us your enquiry or request for information.

Retention period. Until your request has been answered by email, provided that this has not given rise to further processing.

3. Types of data processed and the user's responsibility

In accordance with the purposes described in this Privacy Policy, EDRA LEGAL S.L.P. may process the following categories of data:

• Identification data: first name and surname, postal address, email address, telephone number and any other personal data necessary for managing the relationship.
• Data necessary for the provision of legal services and professional advice, including relevant documentation and background information.
• Economic and financial data: banking details and other economic or financial data necessary for the provision of services and the management of the relationship.

The user undertakes to provide truthful and accurate data and shall be liable for any damages that may arise from the data being untrue or no longer current. EDRA LEGAL S.L.P. does not guarantee the proper provision of its services if the user fails to provide all the data necessary for their proper execution.

Should the user provide EDRA LEGAL S.L.P. with data relating to third parties, they guarantee that they have obtained the consent of those third parties for the transfer of their data, having previously informed them of this Privacy Policy and exempting EDRA LEGAL S.L.P. from any liability in this regard.

4. Recipients

Personal data processed by EDRA LEGAL S.L.P. may only be disclosed to third parties strictly necessary to fulfil the purposes described in this Privacy Policy, such as:

• Professional advice and legal representation: tax and accountancy firms, as well as procedural representatives, experts, notaries and other collaborating professionals, exclusively where necessary for the proper provision of legal services and the management of the client's affairs.
• Public authorities and the administration of justice: courts, tribunals, public registers and tax authorities, to the extent necessary to comply with applicable legal obligations and to defend the client's interests in the context of judicial or administrative proceedings or the provision of contracted services.
• Essential service providers: third parties strictly necessary for the proper provision of the contracted services.
• Cloud services (Google Drive): for data backup, which may involve transfer to third countries. This transfer is carried out on the basis of the European Commission's adequacy decision, guaranteeing a level of protection equivalent to that required in the European Union. Further information: Google's privacy policy.
• Web analytics (Google Analytics 4, provided by Google Ireland Limited): only if the user accepts analytics cookies. This may involve international data transfers to the United States, covered by the EU-US Data Privacy Framework. Further details are set out in the Cookies Policy.

EDRA LEGAL S.L.P. will not disclose the data to other recipients or for purposes other than those indicated without the data subject's prior consent.

5. Security measures

In order to protect personal data, EDRA has implemented appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of the data provided, preventing any loss, alteration, unauthorised processing or access. These measures are reviewed periodically to adapt to technological and regulatory developments, ensuring a level of protection appropriate to the risk associated with the processing of sensitive legal data.

6. Rights of data subjects

Data subjects may, at any time, withdraw the consent given for the processing of their personal data, without such withdrawal affecting any processing carried out previously or the performance of contracts or services previously provided.

Furthermore, data subjects have the right to:

• Access their data and be informed of the purposes of the processing.
• Rectify any inaccurate or incomplete data.
• Request the erasure of their data when it is no longer necessary for the purposes for which they were collected or when consent is withdrawn.
• Request the restriction of processing in certain circumstances.
• Object to the processing of their data, including, for example, consumer surveys.
• Request the portability of their data where applicable.
• Exercise any other rights recognised by current legislation.

To exercise these rights, data subjects may submit a request to the data controller via the postal or email addresses set out in this Privacy Policy, including the reference “Personal Data” and specifying the right they wish to exercise and the data concerned.

In the event of any discrepancies or complaints relating to the processing of their data, data subjects may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

7. Cookies

This website uses technical or necessary cookies, which are essential for its operation and do not require consent. It also uses analytics cookies (Google Analytics 4), which are only installed if the user accepts them in advance and which may involve an international data transfer to the United States under the EU-US Data Privacy Framework. This website does not use personalisation or advertising cookies.

In accordance with Article 22 of the Law on Information Society Services and Electronic Commerce (LSSI-CE), users' prior consent is sought for the use of cookies that are not strictly necessary, and information is provided regarding their purpose, nature and how to disable them. You can view the details and manage your preferences in our Cookie Policy.

8. Updates

This Privacy Policy may be amended by EDRA LEGAL S.L.P. to adapt to changes to the website, developments in legislation or case law regarding the protection of personal data, or new recommendations from the competent authorities.

We therefore recommend that data subjects consult this policy each time they provide their personal data via the website, in order to be aware of the conditions in force at the time of processing.