Privacy policy

2. What data we process

• Contact data: the data you provide when filling in the form or writing to us (name, email address, optional phone number, profile and the content of your message).
• Technical data: IP address and logs necessary for the security and operation of the site.

We do not collect browsing data for advertising purposes and we do not build profiles.

3. Purposes and legal basis

• Handling your request and, where applicable, preparing the requested feasibility study and quote — consent (art. 6.1.a GDPR), which you give by ticking the form checkbox and can withdraw at any time, and pre-contractual measures.
• Security and abuse prevention — legitimate interest.
• Applicable legal obligations — legal obligation.

4. Specific processing on this site

Contact form

Data submitted through the form is processed in serverless functions hosted on Netlify and routed to the support mailbox. Users declare that the data they provide is their own or that they have sufficient legal grounds to provide it. No case file documentation is requested at this stage: a description of the case is enough for the feasibility assessment.

Documentation provided for an expert engagement

Case file documentation (reports, police reports, payslips, tachograph files, photographs, etc.) is not submitted through this website: it is delivered through the channel agreed when the engagement letter is accepted. That data is processed as controller by Pedro Mulero Sánchez, court-appointed expert, in accordance with the terms of the engagement and his professional code of conduct, subject to the duty of professional secrecy. Where the client is a law firm, an insurer or a company commissioning processing on its own behalf, the Data Processing Agreement (DPA) applies.

Nature of the service

The information published on this site is indicative and does not constitute legal advice or an expert report. Where support or artificial intelligence tools are used in preparing a report, the expert verifies and personally assumes responsibility for the result.

5. Recipients and data processors

To deliver the service we rely on the following providers (data processors), with whom the guarantees required by the GDPR are in place:

• Netlify, Inc. — website hosting and receipt of contact form submissions. It may process data in the United States under the Standard Contractual Clauses (SCCs) approved by the European Commission.
• Google Ireland Ltd. / Google LLC (Google Fonts) — font serving; when the page loads, your IP address is disclosed to Google. Possible processing in the United States under the Standard Contractual Clauses.

No data is shared with third parties for commercial purposes.

6. International transfers

Some providers are located outside the European Economic Area (mainly the USA). These transfers are covered by the Standard Contractual Clauses (SCCs) approved by the European Commission and by supplementary measures. You can request information about these safeguards by writing to privacidad@tarracoapplab.com.

7. Retention

We retain your data for as long as the relationship arising from your enquiry exists and, afterwards, for the periods legally required to address potential liabilities; the data is then deleted or anonymised.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacidad@tarracoapplab.com. You may also withdraw your consent at any time and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that your request has not been addressed.

9. Security

We apply appropriate technical and organisational measures: encryption in transit, access control, secure secrets management and security event logging.

Reporting of security breaches

In the event of a personal data breach that may pose a risk to the rights and freedoms of data subjects, we will act in accordance with Articles 33 and 34 GDPR:

• Notification to the AEPD: within a maximum of 72 hours of becoming aware of the breach.
• Communication to data subjects: where the breach is likely to result in a high risk, individual notification without undue delay.
• Internal record: every breach, whether or not notifiable, is recorded together with its analysis and the corrective measures adopted.

Anyone who detects or suspects a security incident can report it by writing to privacidad@tarracoapplab.com.

Data Processing Agreement (DPA)

Where a law firm, an insurer or a company commissions the processing of third-party personal data on its own behalf, the client acts as data controller and the expert acts as data processor under the terms of the Data Processing Agreement (DPA). In court-appointed expert work, by contrast, the expert acts as controller with obligations of his own arising from that capacity.

Data of a specially sensitive nature

Do not request or send specially sensitive data (racial origin, health, beliefs, trade union membership, etc.) through the site’s form. If an expert case file contains such data, it is processed under the professional engagement and with the corresponding enhanced measures.

10. Changes to this policy

We may update this policy to reflect legal or service changes. The current version will always be published on this page.