Who is responsible for your personal data?

Controller: Andrea Martínez Corbalán, trading as LightHouse Legals

NIF: 48563639J

Address: Avda. California s/n, Local no. 8, Centro Comercial IBC, Orihuela Costa, 03189 Alicante, Spain

Email: info@lighthouselegals.com

Telephone: +34 711 551 222

No Data Protection Officer has been appointed because the current activities do not fall within the cases in which appointment is mandatory. Data-protection enquiries and rights requests may be sent to the email or postal address above.

Scope of this policy

This policy explains how personal data is processed when you visit lighthouselegals.com, submit its contact form, contact LightHouse Legals using the details published on the website, or begin discussions about a possible professional engagement.

If you become a client, you may receive additional privacy information relating to the specific professional service, the documentation required, anti-money-laundering checks and the recipients involved in your matter. That more specific information supplements this policy.

What data do we collect?

• Contact-form data: name, email address, telephone number and the information included in your message.
• Communications data: information contained in emails, telephone calls or messages you send to us.
• Technical and security data: limited information generated by the web server or security systems, such as IP address, date and time, browser or device information and security logs, where technically generated.
• Pre-engagement data: information you voluntarily provide so that we can understand your request and assess whether we can assist you.

Please do not send passports, identification documents, bank details, deeds or other sensitive case documentation through the general website contact form. If such documents are required, LightHouse Legals will indicate an appropriate channel.

Why do we use your data and on what legal basis?

Responding to enquiries and taking pre-contractual steps

We use your contact details and message to respond to your enquiry, understand the service requested, communicate with you and, where appropriate, prepare a quotation or take steps before entering into a professional services agreement.

Legal basis: Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract. Where your enquiry does not relate to a potential engagement, processing may be based on our legitimate interest in responding to communications addressed to us under Article 6(1)(f) GDPR.

Providing professional services and complying with legal obligations

If you engage LightHouse Legals, data will be processed to manage and perform the professional engagement, communicate with the persons and organisations involved, issue invoices, maintain records and comply with legal, tax, professional and anti-money-laundering obligations.

Legal basis: performance of a contract under Article 6(1)(b) GDPR and compliance with legal obligations under Article 6(1)(c) GDPR. Other bases may apply where required by the circumstances and will be explained in the engagement information.

Website security

Technical data may be processed to maintain website availability and security, prevent misuse, investigate incidents and protect systems and information.

Legal basis: our legitimate interest in operating a secure website under Article 6(1)(f) GDPR.

Commercial communications

The contact form is not currently used to subscribe users to marketing communications. If LightHouse Legals introduces newsletters or legal updates, a separate, optional and unticked consent mechanism will be provided. Consent may be withdrawn at any time without affecting processing carried out before withdrawal.

Is it mandatory to provide your data?

Fields marked as required are necessary to send and answer your request. If you do not provide them, we may be unable to respond. You should provide only information that is relevant and accurate.

How long do we keep your data?

• Enquiries that do not lead to an engagement: for the time needed to respond and follow up, and no longer than 12 months after the last meaningful contact, unless the data is required for a legal claim or must be retained by law.
• Client and professional-engagement records: for the duration of the engagement and afterwards for the applicable legal limitation and record-keeping periods.
• Anti-money-laundering documentation: for 10 years where the statutory retention obligation applies, after which it will be deleted in accordance with the applicable rules.
• Security logs: for the period reasonably necessary for security and incident management, subject to the configuration of the hosting and security services.

Who may receive or access your data?

Data is not sold or disclosed to third parties for their own marketing purposes. It may be accessed or communicated only where necessary for the enquiry, the professional engagement, a legal obligation or the operation of the website, including:

• Hosting and website infrastructure providers, including Hostinger.
• Email and productivity services provided through Microsoft Outlook / Microsoft 365.
• Secure storage services, including Dropbox, where used for professional files.
• Professional advisers and service providers, such as accounting or tax advisers, translators and specialist collaborators, where necessary and subject to appropriate duties of confidentiality.
• Notaries, property registries, public administrations, tax authorities, local tax bodies, banks, estate agents and other entities involved in a matter, where necessary to provide the requested service or comply with law.
• Courts, regulators, law-enforcement bodies and other competent authorities where disclosure is required or authorised by law.

Service providers that process data on our behalf are required to provide appropriate guarantees and, where applicable, to act under a data-processing agreement.

International data transfers

Some technology providers may process or make personal data accessible from countries outside the European Economic Area. Where this occurs, LightHouse Legals will rely on a mechanism permitted by the GDPR, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. Further information about the relevant safeguards may be requested using the contact details in section 1.

Where does the data come from?

Website enquiry data is normally obtained directly from you. During a professional engagement, information may also be received from persons or organisations involved in your matter, such as estate agents, notaries, banks, public authorities, advisers, family members or representatives. Where data is not obtained directly from you, the applicable information will be provided where required by law.

Your rights

Subject to the conditions established by data-protection law, you may request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, data portability and objection to processing. Where processing is based on consent, you may withdraw consent at any time.

To exercise your rights, email info@lighthouselegals.com or write to the address in section 1, identifying the right you wish to exercise and providing the information reasonably necessary to verify your identity. If you believe that your data has been processed unlawfully, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): https://www.aepd.es.

Automated decision-making

LightHouse Legals does not make decisions producing legal or similarly significant effects solely by automated means and does not carry out profiling through this website.

Security

LightHouse Legals applies technical and organisational measures appropriate to the risks presented by the processing. No internet transmission or storage system can be guaranteed to be completely secure, and users should avoid including unnecessary confidential documents or information in the general contact form.

Changes to this Privacy Policy

This policy may be updated to reflect legal, technical or operational changes. The current version and its update date will be published on this page.