Privacy policy

Data controller

[Company name], tax ID [NIF], registered office [Registered office]. Privacy contact: [Privacy email].

We are the controller of your account data and of the lawyer directory. The files a firm keeps (matters, notes, documents and messages) are that firm's responsibility; we process them on its behalf, as a processor, under an agreement that meets article 28 of the GDPR.

We have not appointed a data protection officer; for any privacy matter write to [Privacy email].

What data we process

Account data: name, email address, password (stored irreversibly, never in plain text), preferences and sign-in methods (passkeys, two-factor authentication).

Lawyers' professional data: biography, province, specialisations, languages, fees and bar registration details.

Matters and documents, messages with your lawyer or client, and calendar events.

Your consents: which version of these texts you accepted and when, and whether you accepted or withdrew marketing emails.

Technical data needed for your session and for security: IP address, browser and a log of access to documents.

The days you use your account (the date only, not what you do), to measure how many people use the platform. Deleted after 13 months.

To create an account we need your name, email address and password; without them we can't provide the service. Everything else is optional.

Usage statistics for the public pages (directory, listings and lawyer profiles) with Umami, hosted on our own servers: no cookies and no data that identifies you. Nothing you do inside your account is measured.

Visits to lawyers' profiles: we count how many each profile gets, per day and by source (search engine, directory, direct or other), to show them to the lawyer. We don't store your IP or who you are: we use a daily code derived from your IP and browser that can't identify you or follow you from one day to the next, and is deleted after two days. The lawyer only sees the totals.

Waitlist (before the launch, no account): your email, your province and the kind of lawyer you need, your language, the page and campaign that brought you, and when you gave consent. Never a description of your problem.

What we use it for and on what legal basis

Providing the service you ask for (your account, your matters, contact with lawyers): performance of the contract.

Notices about your matters, appointments and deadlines: performance of the contract; adjust them in Settings › Notifications.

Verifying lawyers' bar registration and protecting the platform against fraud: legitimate interest.

Recommending lawyers for the case you publish: performance of the contract. It's done automatically on our own servers, without sending the text to third parties; you decide which lawyer to work with, so no automated decision with legal effects is taken about you.

News about Slawly by email: only with your consent, which you can withdraw at any time.

Complying with legal obligations: legal obligation.

Before a hire, detecting contact details in case and proposal texts to warn whoever writes them and keep a record: legitimate interest (keeping the platform working and its terms respected). We don't analyse the messages of hired matters.

Charging and paying through the platform, and the yearly report to the Spanish Tax Agency on what lawyers earn (DAC7): performance of the contract and legal obligation.

Telling you about the launch if you join the waitlist: your consent, which you confirm from the email we send you. Commercial news only if you tick it separately (LSSI art. 21).

Who we share it with

The lawyers and firms you choose to work with. Until then, your identity is shown to them anonymised.

Verified lawyers' profiles are public in the directory, visible to any visitor: performance of the contract with the lawyer, who publishes their profile to find clients.

These processors, under processing agreements: hosting, database and files on our own servers ([provider and server location]); backups ([backup provider and location]); email delivery from our own server, with the same hosting provider; error tracking runs on our own servers.

If you sign in with Google, Facebook, Apple or LinkedIn, that provider receives the data needed to identify you, under its own privacy policy.

We don't sell your data or share it for advertising.

With Stripe, when you pay or get paid through Slawly: Stripe Payments Europe, Ltd. processes payment data (card, amount, identity of the firm's account holder) as an independent controller, under its own privacy policy, and the data we send it for each charge on our behalf. We never see or store your full card details.

How long we keep it

Your account data, for as long as you keep the account. If you delete it, it is erased 30 days after you confirm (or, for a lawyer, once their matters or firm are handed over); until then you can cancel.

Records of your consents are kept, unlinked from your name and email, for the limitation periods, as proof of what you accepted.

Session data (IP address and browser) is deleted when you sign out or, at the latest, the day after the session expires; the counters that limit requests per IP address, within 24 hours. The document access log (who viewed, downloaded, uploaded or deleted each document, and when) is part of the firm's file and is kept for as long as the file is.

Decisions the admin team makes about an account (verifying or rejecting a lawyer, suspending or reinstating an account, with the reason) go into a log that can't be changed and is kept for six years, on our legitimate interest in being able to justify them (GDPR, arts. 5.2 and 6.1.f).

A firm keeps its files for as long as the law requires of it (professional secrecy, limitation periods, anti-money-laundering rules), even if you delete your account.

Backups are encrypted and fully renewed within 12 months at most.

The waitlist: unconfirmed, one week; confirmed, until we tell you about the launch (if you also asked for commercial news, until you unsubscribe) or you unsubscribe from the link in the email, which deletes it at once.

Your rights and how to exercise them

Access and portability: download all your data in Settings › Account › Your data.

Erasure: delete your account in Settings › Account › Delete account. If you're a lawyer who leads matters or owns a firm with members, you'll hand those over first.

Rectification: correct your data in Settings or in your profile.

Objecting to marketing emails: turn them off in Settings › Notifications.

For any other right (objection, restriction of processing), or if you can't sign in, write to [Privacy email]. We answer within one month.

If the data is part of a firm's file, also contact that firm, which is its controller.

If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).