This Privacy Policy explains how personal data of visitors to the website www.penalempresarial.com (the “Website”) and of those who contact its owner are processed, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: Alberto Vidal Castañón, lawyer (abogado). V&V Intervención Legal is the trade name of Alberto Vidal Castañón, a lawyer registered under no. 138.391 with the Ilustre Colegio de la Abogacía de Madrid (Madrid Bar).
- Tax identification number (NIF): 46.239.214-Z
- Professional address: Avenida de Ramón y Cajal, 7, Escalera izquierda, 1º izquierda, 28016 Madrid (Spain).
- Email: info@penalempresarial.com
- Data protection officer: none has been appointed, as none of the cases of mandatory appointment under Article 37(1) GDPR or Article 34(1) LOPDGDD applies.
2. What data we process and how we obtain it
The Website has no forms, user registration, subscriptions or comments. We only process the data you choose to provide when contacting us by:
- email (info@penalempresarial.com), or
- WhatsApp (+34 624 33 44 10, messages only).
This will usually comprise identification and contact details (name, telephone number, email address) and any information you decide to include about your enquiry. Given the nature of the practice, that information may include data relating to criminal offences or criminal proceedings and, occasionally, special categories of data (for example, health data).
In your first message, please describe your matter briefly and do not send documents or third-party data that are not necessary.
In addition, when you browse the Website, the hosting server technically records connection data (IP address, date and time, page requested, browser) needed to serve the pages and keep them secure.
3. Purposes and legal bases
- Responding to your enquiry and, where appropriate, preparing a fee quote or letter of engagement. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
- Providing the professional services instructed and managing the client relationship, including invoicing. Legal basis: performance of the contract for services (Article 6(1)(b) GDPR).
- Complying with legal obligations (tax, accounting, professional and, where applicable, anti-money-laundering obligations). Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR).
- Processing third-party data relating to the matter (for example, opposing parties or witnesses) in order to exercise the right of defence. Legal basis: legitimate interest in the exercise of the defence (Article 6(1)(f) GDPR).
- Maintaining the technical security of the Website (server logs). Legal basis: legitimate interest in the security of the site (Article 6(1)(f) GDPR).
- Statistical analysis of Website use (analytics cookies), only if you accept them. Legal basis: consent (Article 6(1)(a) GDPR), which you may withdraw at any time through “Cookie settings”. Further details in the Cookie policy.
- Assessing unsolicited job applications received by email. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
Data relating to criminal offences and proceedings are processed under Article 10(3) LOPDGDD, which permits lawyers to process such data in order to record information provided by their clients in the exercise of their functions. Where special categories of data must be processed, this is based on Article 9(2)(f) GDPR (establishment, exercise or defence of legal claims).
We do not send marketing communications or newsletters, we do not use advertising cookies, and no automated decision-making or profiling takes place.
Providing your data is voluntary, but without it we will be unable to deal with your enquiry or provide our services.
4. Professional secrecy
All information you provide in the course of an enquiry or professional engagement is subject to the lawyer’s duty of professional secrecy (Article 542.3 of Organic Law 6/1985 on the Judiciary and Articles 21 and 22 of the General Statute of the Spanish Legal Profession, approved by Royal Decree 135/2021). This duty extends to staff and collaborators and is not limited in time.
Where we process data relating to third parties that have not been obtained from them, the duty to inform them may not apply insofar as the data must remain confidential by reason of professional secrecy (Article 14(5)(d) GDPR).
5. Recipients and processors
Your data will not be disclosed to third parties except where required by law or where necessary to provide the services instructed (for example, disclosure to courts, the Public Prosecutor’s Office, court agents (procuradores) or experts in connection with the matter).
Service providers who may have access to data as processors or service providers include:
- Website hosting and forwarding of email sent to info@penalempresarial.com and info@penalempresarial.es: Cloudflare, Inc. (United States), which provides the service through its server network, including data centres in the European Union.
- Visitor analytics: Google Ireland Limited (Google Analytics 4), only if you accept analytics cookies.
- WhatsApp: if you contact us by WhatsApp, the firm uses WhatsApp Business, a service provided by WhatsApp Ireland Limited (Meta group), which processes data in accordance with its own terms and privacy policy..
6. International transfers
Some providers (Cloudflare in the case of hosting and email forwarding, Meta group companies in the case of WhatsApp, and Google in the case of analytics cookies) may process data outside the European Economic Area, in particular in the United States. Any such transfers are based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework, in respect of certified organisations, or on the standard contractual clauses adopted by the European Commission (Articles 45 and 46 GDPR).
7. Retention periods
- Enquiries not leading to an engagement: for as long as necessary to deal with them and, at most, twelve (12) months from the last communication.
- Clients and case files: for the duration of the engagement and thereafter for the limitation periods applicable to any liability arising from the services (generally five years for personal actions, Article 1964.2 of the Spanish Civil Code) and the periods required by tax legislation (four years, Article 66 of the General Tax Law 58/2003) or, where applicable, anti-money-laundering legislation (ten years, Article 25 of Law 10/2010).
- Unsolicited job applications: a maximum of twelve (12) months.
- Analytics cookies: the period stated in the Cookie policy.
- Technical server logs: only as long as strictly necessary to keep the Website secure.
Once these periods have expired, the data will be blocked and made available only to the courts, the Public Prosecutor’s Office and the competent authorities for the limitation period of any liability that may arise, after which they will be erased (Article 32 LOPDGDD).
8. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability (Articles 15 to 22 GDPR) by writing to info@penalempresarial.com or by post to the address in section 1, either personally or through a representative. Additional information to verify your identity will only be requested where there are reasonable doubts about it (Article 12(6) GDPR).
We will reply without undue delay and in any event within one month, which may be extended by two further months for complex requests (Article 12(3) GDPR). Exercising your rights is free of charge.
Please note that certain rights may be restricted where their exercise would affect data protected by professional secrecy or the rights of third parties, or where the data are needed for the establishment, exercise or defence of legal claims.
If you consider that the processing of your data does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) (Article 77 GDPR).
9. Security
Technical and organisational measures appropriate to the risk are applied, taking into account the particularly sensitive nature of the information handled by a criminal-law practice, to ensure the confidentiality, integrity and availability of the data.
10. Changes to this policy
This Policy may be updated to reflect changes in the law or in the Website. The version in force is the one published on this page.
In the event of any discrepancy between the language versions, the Spanish version shall prevail.
Last updated: October 2026