Privacy policy

This policy explains which personal data we process on www.codanuancelegal.com, why, on what legal basis, for how long and how you can exercise your rights. It follows Regulation (EU) 2016/679 (GDPR), Spain's Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD) and Law 34/2002 on information society services (LSSI).

Key information

1. Who the controller is

• Controller: Irene Cobo Navarro, lawyer, trading as Coda Nuance Legal.
• Tax ID (NIF): 70420309J.
• Address: Calle Núñez de Balboa 120, 28006 Madrid (Spain).
• Email: info@codanuancelegal.com.
• Phone: +34 634 685 627.

We have not appointed a data protection officer because the firm's activity is not one of the cases where it is mandatory (Article 37 GDPR and Article 34 LOPDGDD). For any question about your data, write to info@codanuancelegal.com.

2. What data we process, why and on what legal basis

2.1. Enquiries, "We'll call you" and tools

When you write to us through the contact form, the quick enquiry, the callback request or the result of a tool (severance calculator, citizenship, inheritance or plans):

• Data: name, email or phone, subject area, your message and, if you send it, the tool's result. For security we also record the IP address, the browser (user agent) and the date.
• Purpose: to reply to you, call you if you ask us to and, if you wish, prepare a proposal.
• Legal basis: taking pre-contractual steps at your request (Article 6(1)(b) GDPR). Recording the IP address and browser is based on our legitimate interest in protecting the website against abuse and spam (Article 6(1)(f)).
• Retention: as long as needed to deal with your enquiry. If no engagement follows, we delete it no later than 12 months after the last contact.

If you ask us to call you and the firm has connected its calendar (Google Calendar or Outlook), we add a reminder with your name, phone and message to it so the call is not missed.

2.2. Booking and managing appointments

• Data: name, email, phone, subject area, optional message, type of consultation, date, time, format and price. We also record the IP address and the date you accepted.
• Purpose: to book, confirm, remind you of, change or cancel your appointment. We send you the confirmation and a reminder before the appointment. For a video call, we send you the link before the appointment and you also have it on your appointment page. If the firm has connected its calendar (Google Calendar or Outlook), the appointment is added to it.
• Legal basis: pre-contractual steps and the consultation contract (Article 6(1)(b) GDPR).
• Retention: up to 24 months after the appointment date, unless a professional relationship begins (section 2.3). If the consultation is invoiced, the invoice is kept as long as the law requires (six years under the Spanish Commercial Code and four years for tax purposes).
• Paid consultations: with the appointment we also keep the pre-contract information as you saw it when booking (price, how to pay, cancellation terms and withdrawal information) and, if you ticked it, the date on which you asked for the consultation to be provided within the withdrawal period. It lets us show that we comply with consumer protection law (Royal Legislative Decree 1/2007), a legal obligation (Article 6(1)(c) GDPR), and it is kept for the same period as the appointment.

2.3. Clients: provision of legal services

If you instruct us on a matter:

• Data: whatever you give us for the matter (identification, contact details, case documents, financial and billing details). This may include data about other people connected with your matter.
• Purpose: to provide the service, invoice it and comply with the firm's legal obligations.
• Legal basis: the services contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c)): tax and accounting rules and, where applicable, Law 10/2010 on the prevention of money laundering.
• Professional secrecy: all information about your matter is covered by lawyers' professional secrecy (Article 542.3 of the Organic Law of the Judiciary and the General Statute of the Spanish Legal Profession, Royal Decree 135/2021).
• Retention: for the duration of the matter and, afterwards, for the limitation periods of any possible liability (generally five years under Article 1964 of the Civil Code), six years for accounting records, four years for tax purposes and ten years for records required by Law 10/2010, where it applies.

2.4. Artificial intelligence assistant (chat)

When it is active, the website offers an artificial intelligence assistant powered by Google Gemini. If you do not see the chat on the website, it is not active and no data is processed this way. It answers using the content published on the website. It is not legal advice and it does not make decisions about you.

• Data: the messages you write, an anonymous identifier stored in your browser, and the IP address and browser you write from. If you give your name, email or phone in the conversation, we keep them so that we can contact you if you ask us to.
• Purpose: to answer your general questions and, if you ask, to have the firm contact you. The firm may read conversations to help you and to improve the answers.
• Legal basis: your consent, by choosing to use the assistant (Article 6(1)(a) GDPR). You can stop using it and ask us to delete the conversation at any time.
• Retention: no later than 12 months after the last conversation.
• Important: please do not include health data or other sensitive data in the chat. For that, send an enquiry or book an appointment.

2.5. News by email (newsletter)

• Data: your email address and the dates you signed up and confirmed.
• Purpose: to send you legal news from the firm.
• Legal basis: your consent, which you confirm through the link we send you (Article 6(1)(a) GDPR and Article 21 LSSI).
• Retention: until you unsubscribe, which you can do at any time with the unsubscribe link or by writing to us. We delete your address no later than 30 days after you unsubscribe, or 30 days after signing up if you never confirm.

2.6. Website security

• Data: IP address, browser, date and time of requests, and the server's technical logs.
• Purpose: to prevent spam and abuse (for example, by limiting repeated submissions) and to fix errors.
• Legal basis: legitimate interest in the security of the website (Article 6(1)(f) and Recital 49 GDPR).
• Retention: submission limits are kept in memory only and last a few minutes. Technical logs are kept for the minimum time needed for security and operation.

2.7. Contact by phone, email or WhatsApp

If you call us, email us or write on WhatsApp, we use your data only to help you, on the same legal basis and for the same period as the enquiries in section 2.1. WhatsApp is a service of WhatsApp Ireland Limited, subject to its own terms and privacy policy.

3. Health data and other sensitive data

In some areas (for example, permanent disability, immigration or international protection) we may need to process health data or other special categories of data. Please do not include them in your first message. If you give them to us, we will process them only for your matter, with your explicit consent (Article 9(2)(a) GDPR) and, where necessary, for the establishment, exercise or defence of legal claims (Article 9(2)(f)).

4. Required data and data about other people

Fields marked as required are needed to help you: without them we cannot reply or book the appointment.

If you give us data about other people (for example, heirs, relatives or your company), you must have informed them and have a basis for doing so.

5. Minors

The firm's services are aimed at adults. If you are under 14, you cannot give us your consent (Article 7 LOPDGDD): your parents or guardians must do so for you.

6. Who receives your data

We do not sell your data or disclose it to third parties unless the law requires it. Only providers that need it to serve the firm have access. They act as processors under a contract that complies with Article 28 GDPR:

• Hosting: Skyway, the firm's server, hosted in data centres of netcup GmbH (Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany) located in the European Union. The website, the database and the files are stored there and, if the firm connects its calendar (Google Calendar or Outlook), the encrypted connection to it is managed from there.
• Sending emails: Mailway, Skyway's email service, which sends the website's automatic emails (confirmations, reminders and notifications, including those the firm receives).
• Mailbox: Webador, a trade name of JouwWeb B.V. (Torenallee 20, 5617 BC Eindhoven, the Netherlands), which hosts the info@codanuancelegal.com mailbox, where your emails and the website's notifications arrive.
• Google, only for the services the firm has switched on: Google Calendar and Google Meet, for the diary and video calls; Google Gemini, for the AI assistant; and, only if you ask for it, Google Maps, to show the office map.
• Microsoft, if the firm keeps its diary in Outlook or Microsoft 365: Microsoft Ireland Operations Ltd. (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), with Outlook for the diary and Microsoft Teams for video calls.

In addition, where your matter requires it or the law demands it, we may disclose data to courts, public authorities (for example, the Spanish Tax Agency or immigration offices), notaries, registries and court representatives (procuradores).

Backups. Every day we back up the website's database. The backup is stored on the same server, in Germany, with access restricted to the people who administer the website, and only the copies from the last two weeks are kept; older ones are deleted automatically.

7. International transfers

The website, the database and the backups are in the European Union. If the firm uses Google services (Calendar, Meet or Gemini) or Microsoft services (Outlook or Teams), and if you load the Google Maps map, those providers may process data in the United States. Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework, recognised by Commission Implementing Decision (EU) 2023/1795, and their data processing terms also include the standard contractual clauses approved by the European Commission. If any other provider processes data outside the European Economic Area, it will always do so under one of these safeguards.

8. Your rights

You can exercise these rights at any time:

• Access: find out which of your data we process.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete it.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to keep the data without using it, in the cases provided by law.
• Portability: receive your data in a structured format.
• Withdraw your consent, without affecting processing carried out before.
• Not to be subject to automated decisions: we do not make decisions about you based solely on automated processing.

How to exercise them: write to info@codanuancelegal.com or by post to Calle Núñez de Balboa 120, 28006 Madrid, Spain, saying which right you want to exercise. We will only ask you to prove your identity if we have reasonable doubts about it (Article 12(6) GDPR). We will reply within one month, which may be extended by two further months for complex requests; if so, we will let you know.

Professional secrecy and legal retention obligations may limit some rights, for example erasing a file the law requires us to keep. If that happens, we will explain why.

Complaints: if you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es). We would appreciate it if you wrote to us first, in case we can resolve it.

9. Security

We apply technical and organisational measures appropriate to the risk, including:

• an encrypted connection (HTTPS) across the whole website;
• servers in the European Union;
• daily backups of the database, on the same server and with restricted access;
• access to the management panel only for authorised people, with protected passwords;
• the duty of confidentiality and professional secrecy.

10. Cookies

We only use analytics cookies if you accept them. Full details are in the cookie policy.

11. Changes to this policy

We may update this policy when the law or the way we work changes. The current version will always be published here, with its date.