Privacy Policy

Last updated: January 2026

Lopez Financial Consulting S.L. ("we", "us", "the practice") respects your privacy. This policy explains what personal data we collect through this website, why we collect it, how long we keep it, and the rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Spanish data protection law (Ley Organica 3/2018).

1. Data controller

The data controller is Lopez Financial Consulting S.L., CIF B-87654321, with registered office at Calle de Serrano 45, 28001 Madrid, Spain. You can reach us about any privacy matter at info@joseandreslopez.com or +34 910 123 456.

2. Data we collect

2.1 Contact form

When you submit the contact form, we collect your name, email address, subject and message content. We use this data solely to respond to your enquiry and, where it leads to an engagement, to prepare a service proposal. The legal basis is Article 6(1)(b) GDPR (steps prior to entering a contract) and Article 6(1)(f) GDPR (our legitimate interest in responding to enquiries addressed to us).

2.2 Cookies

We use a small number of cookies, described in detail in the Cookies section below and in our Cookie Policy. Non-essential cookies are set only after you give consent through the cookie banner.

2.3 Server logs

Our hosting provider automatically records standard server logs (IP address, date and time, requested page, browser type) for security and troubleshooting purposes. These logs are processed on the basis of our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR) and are retained by the provider for up to 30 days.

3. What we do not collect

We do not collect special categories of personal data through this website, we do not run advertising trackers, and we do not sell, rent or share your personal data with third parties for their marketing purposes.

4. Retention

Contact form submissions that do not lead to an engagement are deleted within 12 months. Where an engagement follows, correspondence and related records are kept for the duration of the relationship and for the legal limitation periods afterwards (generally five years under Spanish civil and tax law). Server logs are retained by the hosting provider for up to 30 days. Cookie retention periods are listed in the Cookie Policy.

5. Third parties and processors

We use a limited number of service providers acting as data processors under Article 28 GDPR:

• Hosting provider: stores the website and its server logs within the European Union.
• Email provider: transmits and stores email correspondence, including form submissions delivered by email.

We do not transfer personal data outside the European Economic Area. If this ever changes, we will update this policy and ensure an adequate level of protection as required by Chapter V GDPR.

6. Cookies

This site uses one necessary cookie (cookie_consent) that stores your cookie preferences for six months. Analytics, marketing and functional cookies are disabled by default and are only activated if you accept them in the cookie banner. You can change or withdraw your consent at any time by clearing the cookie_consent cookie in your browser, which will make the banner reappear. Full details — including a table of each cookie, its purpose and duration — are in our Cookie Policy.

7. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectification of inaccurate or incomplete data (Art. 16);
• Erasure of your data where the legal conditions are met (Art. 17);
• Restriction of processing in the cases of Art. 18;
• Portability of data you provided to us (Art. 20);
• Object to processing based on legitimate interest (Art. 21);
• Withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3)).

To exercise any of these rights, email info@joseandreslopez.com with the subject "Data protection request". We respond within one month. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you believe we have handled your data unlawfully.

8. Security

We apply appropriate technical and organisational measures, including TLS encryption in transit, access controls on our email and hosting accounts, and deletion schedules for enquiry records. No method of transmission over the internet is perfectly secure, but we work to protect your data in line with the state of the art proportionate to the risks.

9. Changes to this policy

We may update this policy to reflect legal or operational changes. The "Last updated" date at the top shows the current version. Material changes will be flagged on this page before they take effect.

10. Contact for privacy requests

Lopez Financial Consulting S.L., Calle de Serrano 45, 28001 Madrid, Spain · info@joseandreslopez.com · +34 910 123 456. See also our Terms of Service.