Privacy Policy

This Privacy Policy explains how we collect, use, store, and protect personal data at Deban Derecho S.L., a company registered in Spain (CIF: B70659701) with its registered office at Calle de San Marcos, 21, 3º, 28004 Madrid, Spain. 

We comply with the General Data Protection Regulation (EU) 2016/679  (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD), and take into account data protection practices relevant to the UK legal sector, especially in Scotland.

1. Who We Are

Deban Derecho S.L. is a consultancy firm supporting UK-based law firms and estate agencies in operational transformation. 

We are the data controller of the personal information you provide us, unless otherwise stated.

You can contact us regarding privacy matters at:

Email: hola@debanderecho.com
Address: Calle de San Marcos, 21, 3º, 28004 Madrid, Spain
Phone: +34 618 830 002

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity data (name, title, company)
• Contact data (email, phone number, address)
• Professional information (role, employer, responsibilities)
• Transactional and contract-related data
• Technical data (IP address, browser data, device information when you visit our site)
• Communication preferences and correspondence

In the context of client work, we may also receive third-party data provided by our clients (employees, contractors, end-clients, suppliers), for legitimate operational or project purposes.

3. Why We Process Your Personal Data

We process personal data for the following lawful purposes:

a. Contractual Necessity

To prepare and perform our consulting services under a contractual relationship with you or your company, including:

• Delivering services as defined in our Scope of Work
• Managing invoicing and client communications
• Internal performance analysis

b. Legitimate Interests

We may use your data for:

• Improving our services and processes
• Sending updates about services, events, or thought leadership (marketing, newsletters)
• Client feedback collection

You may opt out of marketing communications at any time.

c. Legal Obligations

We may be legally required to retain or disclose personal data under Spanish or European laws, including anti-money laundering (AML), tax, and corporate compliance.

4. Who We Share Your Data With

We may share your personal data with trusted third parties when necessary for our services or legal compliance. These include:

• Cloud-based platforms 
• Marketing and communications providers (LinkedIn tools)
• Hosting, IT maintenance and project management software providers
• Legal or tax advisors
• Official bodies (Agencia Española de Protección de Datos)

All third-party service providers are required to comply with data protection laws and enter into appropriate processing agreements with us.

We do not sell or rent your personal data to anyone.

5. International Data Transfers

Some of our service providers may be based outside the European Economic Area. When this occurs, we ensure that data is transferred under adequate safeguards such as:

• EU Standard Contractual Clauses (SCCs)
• Transfer Impact Assessments
• Binding Corporate Rules or adequacy decisions

6. Data Retention

We retain personal data:

• For clients: 10 years after the end of the last contract or project
• For contacts or leads: 2 years from the last meaningful interaction
• For website analytics: up to 14 months
   

7. Your Rights Under GDPR

You may exercise the following rights at any time:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to object to processing for marketing or legitimate interests
• Right to data portability (where applicable)
• Right to withdraw consent (where consent is the basis for processing)

To exercise your rights, please contact us at hola@debanderecho.com

8. Cookies and Website Use

Our website uses cookies to optimize user experience. You may control cookie preferences through your browser. 

9. Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. 

These include encryption, password protection, secure access controls, and staff training.

In the event of a data breach, we will notify you and the relevant supervisory authority within the timeframes required by law.

10. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid
www.aepd.es

11. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy. Updates will be published on our website. We recommend checking it periodically.