Last updated: 9 October 2026.
This is a translation of the Spanish privacy policy. In the event of any discrepancy, the Spanish version prevails.
1. Controller
- Controller: Javier Gómez Sanz (“Food Tech Legal”), tax ID (NIF) 39864707A.
- Address: Plaza Prim, núm. 12, 4.º E, 43201 Reus (Tarragona), Spain.
- Data protection contact: legal@foodtechlegal.com.
- No data protection officer has been appointed.
2. Data, purposes and legal bases
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Responding to communications and comments sent by email | Identification and contact details, and the content of the message | Art. 6(1)(f): legitimate interest in responding | 12 months from the last communication |
| Assessing and quoting for service requests (form) | Contact details, company, position and description of the matter | Art. 6(1)(b): pre-contractual steps taken at the data subject’s request | If no engagement follows, 12 months from the request |
| Providing the service engaged | Data of the client and its team; documents provided | Art. 6(1)(b): performance of a contract | For the duration of the relationship and, thereafter, for as long as liability may arise from the engagement |
| Complying with legal obligations (accounting, tax, professional) | Identification and invoicing data | Art. 6(1)(c): legal obligation | Statutory periods; 6 years for accounting records (Article 30 of the Spanish Commercial Code) |
| Security and operation of the website | Technical connection data (IP address, browser, date and time) | Art. 6(1)(f): legitimate interest in security | As kept in the hosting provider’s logs |
The mandatory fields of the form are necessary to deal with the request. This website does not send unsolicited commercial communications; should it do so in the future, the data subject’s consent would be obtained beforehand.
3. Source of the data
The data are provided by the data subjects themselves. In the course of the services, the client may provide documents containing data of third parties (for example, of its staff); the client warrants that it may lawfully disclose them.
4. Recipients and processors
The data are not disclosed to third parties, except where required by law (tax authorities, courts and tribunals). The following act as processors, under a contract in accordance with Article 28 GDPR:
- Google (Google Workspace): email and document management.
- Vercel Inc.: website hosting.
- Resend, Inc.: delivery by email of the requests received through the form (European Union region).
Where the engagement so requires, and with the client’s knowledge, the data may be disclosed to collaborating members of the Spanish Bar (abogados colegiados) and to external scientific specialists.
5. International transfers
Vercel Inc., Resend, Inc. and, where applicable, Google LLC may process data in the United States. These transfers are based on the European Commission’s adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) where the provider is certified and, failing that, on standard contractual clauses (Article 46 GDPR).
6. Use of artificial intelligence
Artificial intelligence tools may be used to support the systematic checking of documents against regulatory checklists. No personal data of clients are entered into them. Every output is reviewed, completed and signed by the responsible specialist, so there are no decisions based solely on automated processing (Article 22 GDPR).
7. Confidentiality
Once the professional relationship has begun, the controller undertakes to keep the client’s information confidential. Collaborating members of the Spanish Bar are, in addition, bound by professional secrecy (Article 542(3) of the Spanish Organic Law on the Judiciary).
8. Rights of data subjects
You may exercise the rights of access, rectification, erasure, restriction of processing, objection and data portability (Articles 15 to 22 GDPR) by writing to legal@foodtechlegal.com and identifying yourself. A reply will be given within one month, which may be extended by two further months where the request is complex (Article 12(3) GDPR). If you consider that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Security
Technical and organisational measures appropriate to the risk are applied (Article 32 GDPR), including encryption of communications with the website (HTTPS) and access control to information.
10. Minors
The services are aimed at companies and professionals, not at minors.
11. Cookies
This website does not use first-party or third-party cookies that require consent (Article 22(2) of Spanish Law 34/2002 on information society services and electronic commerce, LSSI). No analytics or advertising cookies are installed. Should any be introduced in the future, information would be provided and prior consent obtained before activating them.
12. Changes
This policy may be updated. Each version states its date.