Who is responsible for your data

Ioritz Uranga Galindo, attorney at law (abogado), is the data controller. Contact: ioritz.ur@gmail.com. Full identification details are in the Legal Notice.

What I collect, and why

  • Eligibility quiz answers and your email — to prepare and send your free written assessment. Legal basis: your consent, given by an unchecked box you tick yourself.
  • Contact form messages — to reply to you. Legal basis: your consent and pre-contractual steps.
  • Client case files — if you engage me, the documents needed for your application. Legal basis: performance of our engagement contract and legal obligations.

What I never do

  • No marketing lists or newsletters unless you explicitly ask for them.
  • No selling or sharing your data with third parties for their purposes.
  • No advertising trackers. The free-assessment page carries no analytics at all; nothing leaves your browser until you choose to submit.

Retention

If you don’t move forward after an assessment or an enquiry, your personal data is automatically deleted within 30 days — the deletion date is recorded next to your enquiry the moment it arrives, and the removal covers both my automation platform and my case-management system. The only exception is anything I am legally required to keep — for example, a formal legal opinion, which professional and tax rules require I retain.

If you become a client, case files are kept for the periods Spanish professional and tax regulations require, and then deleted.

Processors

To run this practice I rely on a small set of service providers, each acting under a data-processing agreement (and, where based outside the EU, under the EU–U.S. Data Privacy Framework or Standard Contractual Clauses):

  • Make (Celonis / Make.com, EU-hosted) — receives quiz and contact-form submissions and routes them.
  • Airtable (US, DPF-certified) — my case-management system, where enquiries and case status are recorded.
  • Stripe (DPF-certified) — payment processing; I never see or store your card details.
  • Calendly (DPF-certified) — video-call scheduling, only if you book a call.
  • Google Workspace / Google Drive (DPF-certified) — email and the private folder where clients upload case documents.
  • GitHub Pages — website hosting; serves the pages you read but receives none of your form data.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing. Write to ioritz.ur@gmail.com and I’ll handle it personally within the legal deadlines. You can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos.

Last updated: July 2026.