Privacy policy

Privacy policy

Translation of the Spanish original, which is the binding version.

1. Data controller

The controller of the personal data covered by this Privacy Policy is SCALA Law Firm, S.L.P. ("SCALA"), tax identification number (NIF) B-93778363, with its registered office at calle Don Ramón de la Cruz, 38, 28001 Madrid.

For any matter relating to the processing of their personal data, the User may contact SCALA at info@scala.law.

2. Scope

This Privacy Policy governs the processing of personal data arising from access to, browsing and use of the website https://scala.law/ or https://www.scala.law/ (the "Website"), as well as from enquiries and communications addressed to SCALA through the contact channels indicated on the Website.

For the purposes of this Privacy Policy, "User" means any natural person who accesses, browses or interacts with the Website.

The Website is corporate and informative in nature. It does not allow legal services to be contracted or received through the website itself.

3. Categories of personal data processed

Browsing data. Browsing the Website does not require the User to directly provide identifying data. However, technical and connection data may be processed, such as the IP address, information about the device, browser and operating system, date and time of access, pages visited and other technical data necessary for the operation and security of the Website. Data obtained through cookies may also be processed, in accordance with the Cookie Policy and with the User's prior consent where required.

Data provided in communications with SCALA. When a person contacts SCALA through the contact channels indicated on the Website, the identifying, professional and contact data they provide may be processed, as well as the content of the communication and the information necessary to deal with it.

Personal data of third parties. Anyone who provides personal data of third parties must be entitled to communicate them and must have complied, where applicable, with the corresponding information obligations, without prejudice to the obligations incumbent on SCALA under data protection legislation.

4. Purposes and legal bases

Management of communications and requests. SCALA will process the data necessary to receive, analyse, manage and respond to communications, enquiries or requests addressed to the Firm. The legal basis will be, depending on the nature of the communication, the implementation of pre-contractual measures taken at the request of the data subject, where the request relates to the possible engagement of legal services, or SCALA's legitimate interest in dealing with communications relating to its professional activity.

Checks prior to the acceptance of professional engagements. Where a request may give rise to a professional engagement, SCALA may process the data necessary to carry out the relevant legal and ethical checks, including those relating to possible conflicts of interest, and, where appropriate, to prepare the formalisation of the professional relationship. The processing will be based, as applicable, on the implementation of pre-contractual measures taken at the request of the data subject, compliance with applicable legal obligations or SCALA's legitimate interest in verifying the requirements for accepting the professional engagement.

Operation, administration and security of the Website. The necessary technical data may be processed to enable browsing, administer the Website, maintain its security, detect and prevent misuse, manage incidents and ensure its proper operation. The legal basis will be SCALA's legitimate interest in guaranteeing the operation, security and integrity of the Website and its systems.

Cookies and similar technologies. Strictly necessary cookies may be used to enable the operation of the Website. Cookies or similar technologies that require consent will only be used once the User has given it through the preference management mechanism. The processing of personal data arising from the latter will be based on that consent. Detailed information on the cookies used, their purposes, the legal bases for processing and the mechanisms for managing preferences and withdrawing consent is set out in the Cookie Policy.

For processing based on legitimate interest, SCALA will first weigh the necessity and proportionality of the processing, the reasonable expectations of the persons concerned and their fundamental interests, rights and freedoms. Processing will only be carried out where these do not override the legitimate interest invoked.

5. Retention periods

Data will be kept only for as long as necessary to fulfil the purposes for which they were obtained and will subsequently be deleted or, where appropriate, blocked for the periods required by law to meet legal and ethical obligations and any liabilities arising from the processing, in accordance with Article 32 of Spanish Organic Law 3/2018 of 5 December.

Communications that do not give rise to a professional relationship will be kept for the time reasonably necessary to deal with them and close their management and, where applicable, the data will be blocked for the limitation periods applicable to possible liabilities.

Technical data and security logs will be kept for the periods necessary and proportionate for those purposes. Data associated with cookies will be kept for the periods indicated in the Cookie Policy.

Where a communication gives rise to a professional engagement, the corresponding data and documentation will be kept for the periods required by the applicable legislation, including, where appropriate, those established in relation to the prevention of money laundering and terrorist financing, as well as those necessary to meet professional obligations and any liabilities arising from the engagement.

6. Recipients and processors

As a general rule, SCALA will not disclose personal data to third parties except where there is a legal obligation, where it is necessary to comply with a request from a competent authority, where it is necessary for the establishment, exercise or defence of claims, or where another valid legal basis exists.

SCALA may use providers that supply technology, hosting, maintenance, security, email or other ancillary services and that, in order to provide those services, may access personal data on behalf of SCALA. Where they act as processors, they will be subject to the obligations and contractual guarantees required by the applicable legislation.

Data subjects may request further information on the recipients of their personal data by writing to info@scala.law.

7. International transfers

Should SCALA transfer personal data outside the European Economic Area, such transfers will be made under an adequacy decision of the European Commission or, failing that, subject to appropriate safeguards, including the standard contractual clauses approved by the European Commission, following an assessment of the conditions of the transfer and the adoption, where necessary, of supplementary measures.

Data subjects may request information on such transfers and obtain a copy of the applicable safeguards by writing to info@scala.law.

8. Rights of data subjects

Persons whose personal data are processed by SCALA may exercise, under the terms and within the limits provided for by the applicable legislation, the following rights:

  • Access: to obtain confirmation as to whether SCALA is processing personal data concerning them and, if so, to access those data and the legally required information about their processing.
  • Rectification: to request the correction of inaccurate personal data or the completion of incomplete data.
  • Erasure: to request the deletion of their personal data where any of the circumstances provided for by law apply, without prejudice to retention obligations and to cases in which it is necessary to keep them for the establishment, exercise or defence of claims.
  • Restriction of processing: to request that the processing of their data be restricted in the cases established by the legislation, among others, where the accuracy of the data is contested or the lawfulness of the processing is questioned.
  • Portability: to receive the personal data provided to SCALA in a structured, commonly used and machine-readable format, and to transmit them to another controller, where the legal requirements are met.
  • Objection: to object, on grounds relating to their particular situation, to processing based on SCALA's legitimate interest, unless there are compelling legitimate grounds that override it or the processing is necessary for the establishment, exercise or defence of claims.
  • Withdrawal of consent: to withdraw at any time the consent previously given, where it constitutes the legal basis for the processing, without affecting the lawfulness of processing carried out beforehand.

These rights may be exercised free of charge by sending a request to info@scala.law, identifying the right to be exercised and providing the information necessary to process it. Where there are reasonable doubts as to the identity of the applicant, SCALA may request the additional information strictly necessary to verify it.

SCALA will deal with requests without undue delay and, in any event, within one month of receipt, without prejudice to the extensions provided for by law where the complexity or number of requests so justifies. In the case of manifestly unfounded or excessive requests, the exceptions provided for in the legislation may apply.

Data subjects may lodge a complaint with the competent data protection supervisory authority.

9. Security and confidentiality

SCALA will apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss or alteration, as well as against unauthorised access, disclosure or use, taking into account the nature of the data, the risks of the processing and the state of the art.

10. Links to third parties

The Website may contain links to third-party websites. The processing of personal data carried out by such third parties will be governed by their own privacy policies.

11. Updates

SCALA may update this Privacy Policy to adapt it to regulatory changes, criteria of the competent authorities, changes to the Website or changes in the processing carried out. The version in force will be the one published on the Website.

Last updated: October 2026.