Legal information

Privacy policy

The tool works in full without you accepting anything. Here we set out, purpose by purpose, what happens if you decide to accept any of them.

DRAFT pending approval. This text is a working proposal drawn up for review by the firm. It is not yet a final legal text and must not be treated as approved or relied upon as such.

The essentials, in five lines

  • You can use the whole test without giving us any personal data.
  • Each purpose is decided separately: there is no single button that authorises everything.
  • We use no cookies and no third-party analytics. We do not profile you and we do not track you.
  • Everything is hosted in the European Union. There are no international transfers.
  • You can withdraw your consent in one click from the footer, under “Manage my consent”.

Data controller

ILP Abogados, contact address info@ilpabogados.com, is the data controller for the processing described in this policy.

To be completed by the firm before publication: exact company name, NIF (Spanish tax identification number), registered office and, where applicable, the contact details of the data protection officer.

Purposes, one by one

We ask for your decision on three separate purposes. You can accept one and reject the other two. Rejecting all of them does not limit your use of the tool.

1. Audience measurement

Aggregated, anonymous usage counts: how many people start the test, how many finish it, how many reports are requested. You are not identified, there are no advertising cookies and no third parties.

What is stored is a daily counter per metric name and a figure. It is not linked to any person, not even to a session: there is no way to reconstruct who did what.

2. Sending the report

Using the details you type into the form to prepare and send you the exposure report you have requested. The fields are full name, company, job title, work email address and telephone, together with the result of your test.

Without this authorisation we cannot send you the report, because we would have neither the recipient nor the basis for doing so.

3. Commercial contact

Allowing ILP Abogados to contact you about your result. This is handled in the firm's internal CRM, ILP LeadOS, hosted in the European Union.

The system's golden rule: only the data of people who have expressly ticked the commercial contact box is sent to the CRM. If you do not tick it, your data is not added to the firm's CRM.

When you do tick it, what travels to the CRM is: name, email address, telephone and company; a session identifier; a text summary with your job title, the traffic-light rating of your result, the percentage of entries at risk and the estimated exposure range; your answers to the test and the volume figures you have given; the practice area (“Data Protection”), the language and the source tool; the date and time of your consent, with the version and the hash of the text shown to you; and the source parameters of your visit (campaign, medium, source, landing page and referring site) if you came from a campaign.

Legal basis

The legal basis for all three purposes is your consent, Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR). It is freely given, specific, informed and unambiguous consent: it is requested separately for each purpose, no box is pre-ticked, and refusing does not penalise your use of the service.

The technical storage that is strictly necessary to provide the service you ask for is covered by Article 22(2) of Law 34/2002 (LSSI-CE, the Spanish e-commerce act) and does not require consent. It is explained in the cookie policy.

Recipients and data processors

We do not pass your data to third parties for commercial purposes. We do not sell it. Only the suppliers strictly necessary for the tool to work are involved:

  • Hosting of the site and the application: Vercel, with execution fixed to the Frankfurt region (Germany).
  • Database: Neon, managed PostgreSQL, also in Frankfurt (Germany). It holds the evidential record of consents and the aggregated counters.
  • Internal CRM ILP LeadOS: the firm's own system, hosted in the European Union. It only receives the data of people who have consented to commercial contact.

All of them act as data processors, on behalf of ILP Abogados and following its instructions. Apart from the above, public authorities may access the data where a legal provision requires it.

International transfers

There are no transfers of data outside the European Union. The hosting, the database and the CRM are all within EU territory. The tool includes no tag, pixel, font or script served by a third party.

Retention periods

  • Your decision on the purposes: for as long as it remains in force and, at most, 24 months. It then expires and we ask you again. It also expires sooner if we change this information text.
  • Evidential record of consents: kept for as long as it may be necessary to demonstrate that you consented, in accordance with Article 7(1) GDPR, and for the applicable limitation periods.
  • Data for sending the report: for as long as it takes to prepare and send it, and thereafter for the period imposed by the firm's legal obligations.
  • Data in the ILP LeadOS CRM: for as long as the relationship, or an interest in it, is maintained and you do not object or withdraw your consent; thereafter, blocked for the limitation periods and then erased.
  • Audience counters: these are aggregated figures with no personal data, so no erasure period applies.

Exactly what is kept in the evidential record

When you accept or reject a purpose, we store an entry that serves to demonstrate what you decided and on which text. That entry contains only:

  • A random session identifier, generated in your browser, which contains no personal data.
  • The timestamp of the decision.
  • The purpose it relates to and whether it was accepted or rejected.
  • The language in which the text was shown to you.
  • The version of the legal text and a hash of it, that is, a cryptographic fingerprint that makes it possible to prove exactly which wording you read.
  • The channel from which you decided (for example, the consent panel or the test form).
Your IP address is not stored, nor is any browser signature (fingerprint). Neither is your location, your device or your browser. This is a design decision built into the system, not a policy that depends on configuration.

Acceptance of the no legal advice statement is recorded with the same fields and to the same extent.

Your rights

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability of your data.

To do so, write to info@ilpabogados.com stating the right you are exercising. We will reply expressly within one month, extendable by a further two months where the matter is complex, telling you within the first month. We may ask you to prove your identity.

If you consider that we have not dealt with your request properly, you may lodge a complaint with the competent supervisory authority, the AEPD, the Spanish Data Protection Agency (www.aepd.es).

Withdrawing your consent

Withdrawing consent must be as easy as giving it. In the footer of any page you will find the link “Manage my consent”: open it and you can change each purpose, or reject them all at once. The change takes effect immediately.

Withdrawal does not affect the lawfulness of processing carried out before it. If we had already sent you the report, that sending remained lawful.

Expiry of your decision

Your decisions expire after 24 months, and sooner if we change this information text: in that case we will ask you again, because consent is not inherited between different versions of the text.

Automated decisions

The result of the test is calculated by an algorithm from your answers, but it produces no legal effect on you and does not significantly affect you: it is general guidance. We do not build profiles and we do not take automated decisions within the meaning of Article 22 GDPR.

Children

This tool is aimed at professionals and companies. It is not intended for minors and we do not knowingly collect their data.

Changes to this policy

If we amend this policy, we will raise its version number. As consent is not inherited between versions, you will be asked again the next time you visit.

Text version: 2026-08-06-borrador-1.

Text version: 2026-08-06-borrador-1

Privacy policy · ASNEF Exposure | ILP Abogados