Legal information
Privacy policy
Last updated: 8 October 2026. This translation is provided for information purposes; in case of discrepancy the Spanish version prevails.
Immlaw Abogados, C.B. ("ImmLaw Abogados") informs you about the processing of your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). As lawyers, all our clients' data are also protected by professional secrecy.
1. Data controller
- Owner: Immlaw Abogados, C.B.
- Trade name: ImmLaw Abogados
- Tax ID (NIF): E75688093
- Address: Camino de Camojan 7, Oficina 7, 29602 Marbella (Málaga), Spain
- Telephone:+34 952 858 323
- Email: info@immlaw.es
Data protection officer: the firm has not appointed a data protection officer as it is not required to do so. For any question about your data, write to info@immlaw.es.
2. What data we process, why and on what legal basis
| Processing | Purpose | Legal basis | Retention |
|---|---|---|---|
| Enquiries via the website, email, telephone or WhatsApp | To answer your enquiry and, where appropriate, prepare a quote. | Your consent (Art. 6.1.a GDPR) and, if you request a quote, pre-contractual steps (Art. 6.1.b). | Until the enquiry is answered and at most 1 year if you do not instruct us. |
| Clients | To provide the legal services instructed (advice, handling of files, representation and defence), invoicing and accounting. | Performance of the services contract (Art. 6.1.b) and compliance with tax and accounting obligations (Art. 6.1.c). | During the relationship and afterwards for the limitation periods for claims and liabilities (generally 5 years, Art. 1964 Spanish Civil Code; 6 years for commercial records and 4 years for tax records). |
| Anti-money laundering | To identify the client and carry out due diligence in the real estate, corporate and financial transactions where the law requires it. | Legal obligation (Art. 6.1.c GDPR; Spanish Law 10/2010). | 10 years from the end of the relationship (Art. 25 Law 10/2010). |
| Information mailings | To send you legal and firm news, only if you have agreed. | Your consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE). | Until you withdraw your consent. |
| Job applicants | To assess your CV in recruitment processes. | Your consent when sending it. | 1 year. |
Special categories of data
In some matters (for example immigration, asylum, family or inheritance) it may be necessary to process data concerning health, ethnic origin, political opinions, beliefs or criminal records. We only process them when necessary for the establishment, exercise or defence of your rights in administrative or court proceedings (Art. 9.2.f GDPR) or when a rule requires them for the file (Art. 10 GDPR and Art. 10 LOPDGDD), with enhanced security measures. Please do not include them in the contact form.
Third-party data
If you provide us with data about other people (relatives, heirs, opposing parties), you undertake to have informed them and to be entitled to do so.
Minors
Children under 14 may not provide their data through the website without the consent of their parents or guardians (Art. 7 LOPDGDD).
3. Recipients
We only disclose your data when necessary for the engagement or required by law, to:
- Public authorities (immigration offices, police stations, consulates and embassies, Civil Registry, Tax Agency, land and commercial registries), notaries, courts and tribunals.
- The Spanish Financial Intelligence Unit (SEPBLAC), where required by law.
- Bárbara Royo Abogados, associate of the firm for criminal and prison law, when your matter requires her services and with your knowledge.
- Court representatives (procuradores), experts, sworn translators and other professionals involved in your matter, with your knowledge.
- Providers acting as data processors under a contract complying with Art. 28 GDPR: website hosting and email providers, practice management software and accounting advisers.
4. International transfers
As a rule we do not transfer your data outside the European Economic Area. Where your matter requires it (for example, procedures before consulates or authorities in your country of origin), the transfer will take place because it is necessary for the contract or for the defence of your rights (Art. 49.1.b and 49.1.e GDPR). If any technology provider processes data outside the EEA, it will do so with appropriate safeguards, such as adequacy decisions or the European Commission's standard contractual clauses.
5. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent without affecting the lawfulness of prior processing. To do so, write to info@immlaw.es or to the postal address above, stating the right you wish to exercise. If we have doubts about your identity, we may ask for additional information to verify it.
If you consider that we have not handled your rights correctly, you may lodge a complaint with the Spanish Data Protection Agency ( www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
We do not take automated decisions or carry out profiling with your data.
6. Security and confidentiality
We apply technical and organisational measures appropriate to the risk (access control, encryption of website communications, backups and staff confidentiality duties) to protect your data. All client information is also protected by lawyers' professional secrecy.
7. Changes to this policy
We may update this policy to adapt it to legal or operational changes. We recommend that you review it periodically; the date of the last update appears at the top.
