Privacy Policy
1. Contact details of the data controller
In accordance with the provisions of Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), users are informed that the data controller responsible for the processing of personal data is:
Sander Santos & Partners S.L.P.
NIF: ESB93688489
Registered office: Plaza de la Marina 2, 6º izquierda
29015 Málaga (Spain)
Telephone: 951 20 46 89
Websites: www.sspartners.es / www.recht-spanien.com
Contact email address:
2. Data Protection Officer
The data controller has appointed a Data Protection Officer (DPO), whose contact details are:
LABORAL RGPD S.L.U.
Contact email address of the Data Protection Officer:
3. Processing of personal data
The data controller shall process users’ personal data on this website only when necessary for the proper provision of the services offered, the management of communications with users, or compliance with applicable legal obligations.
The collection and processing of personal data shall generally take place when the user has previously provided consent, when there is a contractual or pre-contractual relationship, when processing is necessary for compliance with a legal obligation, or when another lawful basis exists pursuant to Article 6 of the GDPR.
Where the processing of data requires the user’s consent, such consent shall be requested expressly, freely, informatively and unequivocally. The user may withdraw such consent at any time, without affecting the lawfulness of the processing carried out prior to withdrawal.
However, in cases where processing is necessary for compliance with legal obligations, the performance of a contract, or the protection of the legitimate interests of the controller or third parties, no additional consent shall be required, provided that there is a valid legal basis in accordance with applicable regulations.
4. Storage and deletion of personal data
Personal data shall be stored for the period necessary to fulfil the purpose for which it was collected and, thereafter, for the legally established periods in order to address any potential liabilities arising from the processing.
Once the applicable retention period has expired, the data shall be securely deleted or, where appropriate, anonymised, unless there is a legal obligation requiring its retention for an additional period or it is necessary for the establishment, exercise or defence of claims.
The specific retention periods shall depend on the nature of the relationship with the user and the applicable legal obligations in each case.
5. Browsing data, cookies, log files and third-party services
When the user accesses our website or uses our services, technical systems may automatically collect certain information relating to the connection and browsing activity.
The data that may be recorded includes:
- IP address of the device used to access the website.
- Browser type and version.
- Operating system and device configuration.
- Date and time of access.
- Website from which the user accessed our website.
- Information relating to the use of the services offered.
This data is processed for the purpose of ensuring the correct operation, security and maintenance of the website, as well as detecting possible fraudulent use, security incidents or unauthorised access attempts.
IP addresses shall only be stored for the time necessary to fulfil these purposes. In particular, they may be stored for a maximum period of 7 days for the prevention and detection of attacks against computer systems, unless a longer retention period is required for legal reasons or investigation purposes.
Technical connection data may be processed through the servers of the hosting provider Strato AG.
This website uses cookies and similar technologies, such as pixels or other technical identifiers, in order to improve the user experience, provide certain functionalities and obtain statistical information about website usage.
Cookies are small information files stored on the user's device which allow the user to be recognised during future visits or certain browsing preferences to be remembered.
The following may be used:
- Session cookies, which are automatically deleted when the browser is closed.
- Persistent cookies, which remain stored for a specific period until they are no longer necessary for the purpose for which they were installed.
The user may configure their browser to block or delete cookies at any time. However, disabling certain cookies may prevent or limit the correct functioning of some website features.
Where legally required, the installation of non-technical cookies shall require the user's prior consent, which may be managed through the corresponding cookie configuration panel.
6. Contact forms and email communications
The website provides various means of contact through electronic forms and email.
When the user uses these communication channels, the information provided shall be processed in order to handle their request, respond to enquiries or manage the relationship established with the user.
The data that may be processed includes:
- First name and surname.
- Email address.
- Content of the message sent.
- Type or reason for contacting us.
- Acceptance of the privacy policy.
- IP address.
- Date and time of submission.
Before submitting any form, the user must expressly accept the processing of their personal data in accordance with this Privacy Policy.
The data shall be used exclusively for the stated purpose and shall not be disclosed to third parties unless there is a legal obligation to do so, it is necessary for the provision of the requested service, or another lawful basis permits such disclosure.
The information provided by the user must be truthful and correspond to their own identity. The user shall be responsible for any damage that may arise from providing false, inaccurate or third-party data without authorisation.
7. Users’ rights
The user may exercise, at any time and free of charge, the rights recognised under the applicable personal data protection regulations.
To exercise their rights, the user may contact the data controller by means of a written communication using the contact details provided in this Privacy Policy, proving their identity where necessary.
The rights that may be exercised are the following:
a) Right of access
The user has the right to obtain confirmation as to whether or not we are processing personal data concerning them and, if so, to access such data and receive information about the processing carried out.
The user may also request a copy of the personal data undergoing processing.
b) Right to rectification
The user has the right to request the correction of personal data that is inaccurate or incomplete.
For this purpose, the user must indicate the data they wish to modify and, where appropriate, provide the corresponding supporting documentation.
c) Right to erasure
The user may request the deletion of their personal data where any of the circumstances provided for in Article 17 of the GDPR apply, including:
- The data is no longer necessary for the purpose for which it was collected.
- The user withdraws the consent on which the processing was based and there is no other legal basis allowing the continuation of the processing.
- The processing has been carried out unlawfully.
- The erasure is necessary to comply with a legal obligation.
Erasure shall not apply where processing is necessary for compliance with a legal obligation, for the establishment, exercise or defence of claims, or where another legally recognised exception applies.
d) Right to restriction of processing
The user may request the restriction of the processing of their data when any of the circumstances provided for in Article 18 of the GDPR occur, such as:
- The user disputes the accuracy of their personal data while its accuracy is being verified.
- The processing is unlawful and the user objects to the deletion of the data.
- The controller no longer needs the data for the purpose of processing, but the user requires it for the establishment, exercise or defence of claims.
- The user has objected to the processing while verifying whether the legitimate grounds of the controller override those of the user.
In these cases, the data may only be processed, except where legally permitted otherwise, with the user's consent or for the establishment, exercise or defence of claims.
e) Right to object
The user has the right to object to the processing of their personal data when such processing is based on the legitimate interest of the controller or on the performance of a task carried out in the public interest, in accordance with Article 21 of the GDPR.
The user may also object at any time to the processing of their data for direct marketing purposes.
f) Right to data portability
Where processing is based on the user's consent or on the performance of a contract and is carried out by automated means, the user shall have the right to receive their personal data in a structured, commonly used and machine-readable format.
The user may also request that such data be transmitted directly to another data controller where technically feasible and where this does not adversely affect the rights and freedoms of third parties.
g) Right to withdraw consent
Where the processing of personal data is based on the user's consent, the user may withdraw such consent at any time.
Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.
h) Right to lodge a complaint with the supervisory authority
The user has the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) when they consider that the processing of their personal data infringes the applicable regulations.
8. Legal basis for processing
The processing of personal data carried out by Sander Santos & Partners S.L.P. is based on the following legal grounds:
- Consent of the data subject: when the user has expressly authorised the processing of their data for a specific purpose, in accordance with Article 6(1)(a) of the GDPR.
- Performance of a contractual relationship or application of pre-contractual measures: when the processing is necessary for the provision of services requested by the user or to deal with enquiries prior to entering into a contract, in accordance with Article 6(1)(b) of the GDPR.
- Compliance with legal obligations: when the processing is necessary to comply with obligations imposed by applicable regulations, including tax, accounting or administrative obligations, in accordance with Article 6(1)(c) of the GDPR.
- Legitimate interest of the controller or third parties: when the processing is necessary for the pursuit of legitimate interests, provided that such interests are not overridden by the fundamental rights and freedoms of the user, in accordance with Article 6(1)(f) of the GDPR.
The data controller shall always apply the appropriate legal basis according to the specific purpose of the processing and shall ensure compliance with the principles established in the GDPR.
9. Contractual language
In the event of discrepancies between versions of this Privacy Policy or any document related to the provision of services drafted in different languages, the Spanish version shall prevail, as it is the language corresponding to the main place where the services are provided and to the applicable legislation.
10. Legal information and website terms of use
Information relating to the owner of the website, terms of use, responsibilities, intellectual property and other legal aspects is contained in the corresponding Legal Notice.
This information can be accessed through the link provided on our website: Legal Notice
(+34) 
