Data Protection

Last updated: 12 October 2026

This page supplements the Privacy Policy: it explains how to exercise your rights, which security measures we apply, how we manage security breaches and which commitments we assume as data controller, in accordance with the GDPR and the LOPDGDD.

1. Our commitments

Lawfulness, fairness and transparency: we inform you clearly before collecting your data.
Minimisation: we request only the data that is necessary; telephone number and town or city are optional.
Purpose limitation: we do not use your data for purposes incompatible with those communicated.
Accuracy and storage limitation: we keep data up to date and delete or block it when it is no longer necessary.
Integrity and confidentiality: restricted access and a duty of confidentiality for those who process the data.
Accountability: we maintain a record of processing activities (Art. 30 GDPR) and review the risks of each processing operation.

2. How to exercise your rights

Right	What you can request
Access (Art. 15)	To know whether we process your data and to obtain a copy, with information on purposes, recipients and retention periods.
Rectification (Art. 16)	To correct inaccurate data or complete incomplete data.
Erasure (Art. 17)	That we delete your data when it is no longer necessary, you withdraw consent or you object, unless there is a legal obligation to retain it.
Restriction (Art. 18)	That we suspend processing while a challenge or an objection is being resolved.
Portability (Art. 20)	To receive the data you gave us in a structured, commonly used format.
Objection (Art. 21)	To object to processing based on legitimate interest and to commercial communications.
Withdrawal of consent (Art. 7.3)	To stop receiving the newsletter or withdraw your consent at any time.

Request: contact form (subject “Exercise of data protection rights”) or email to legalia2026@gmail.com.
State your name, the right you are exercising and the email address you used to write to us. We may ask you for a document proving your identity.
Response time: one month from receipt, extendable by two further months if the request is complex or numerous, with prior notice (Art. 12.3 GDPR).
Free of charge, except for manifestly unfounded or excessive requests (Art. 12.5 GDPR).
If you are not satisfied with the response, you may lodge a complaint with the AEPD (www.aepd.es).

3. Security measures

Encryption in transit via HTTPS/TLS, Content Security Policy (CSP), HSTS and headers protecting against clickjacking and referrer tracking.
Forms protected with a signed anti-bot challenge, proof of work, honeypot field and per-IP-address request limits.
The company’s contact details do not appear in the website’s source code.
Double opt-in for the newsletter, to prevent subscriptions by third parties.
Providers selected with sufficient guarantees and data processing agreements (Art. 28 GDPR).
Access to data limited to the people who need it and bound by a duty of confidentiality.

4. Security breaches

In the event of a personal data breach, we will document it and notify the Spanish Data Protection Agency within a maximum of 72 hours after becoming aware of it, unless it is unlikely to result in a risk to the rights of individuals (Art. 33 GDPR). If it entails a high risk, we will notify you without undue delay (Art. 34 GDPR).

5. Data processors and transfers

The providers that process data on our behalf (hosting, email delivery, analytics) act under our instructions and under a contract compliant with Art. 28 GDPR. Transfers to third countries are covered by adequacy decisions or standard contractual clauses (Arts. 45 and 46 GDPR). The list of recipients is set out in the Privacy Policy.

6. Commercial communications

We send commercial communications by electronic means only if you have given your consent or there is a prior contractual relationship and they relate to similar products (Art. 21 LSSI-CE). Every communication includes a simple, free unsubscribe link. If you receive a message you did not request, write to us and we will investigate.

7. Minors

The website is not directed at children under 14. If we detect data of a minor provided without the authorisation of their legal representatives, we will delete it.

8. Privacy contact

OBRALIA PROSERVICE, S.L. · Calle Carrero 9, Bajo, 12500 Vinaròs (Castellón). Email for exercising data protection rights: legalia2026@gmail.com.

Owner’s contact details

Tax ID (NIF) and email address, visible after an anti-bot verification.

For security, the phone number, email and tax ID are shown on request (anti-spam protection).

Exercise my rights Exercise of data protection rights: I state my name and the right I wish to exercise.