Privacy policy.

Last updated: 27 September 2026 · GDPR + LOPDGDD (Spanish GDPR implementation)

How Lares Gestión y Consultoría S.L. processes the personal data of the user who interacts with this Website, in compliance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law on Personal Data Protection and Digital Rights (LOPDGDD).

1. Data controller

  • Identity: Lares Gestión y Consultoría S.L.
  • NIF (Spanish tax ID): B75692889
  • Address: Albacete, Spain.
  • Data protection contact email: info@laresgestion.com
  • Phone: +34 603 38 62 34

Given the volume of processing and the nature of the activities, Lares Gestión y Consultoría S.L. is not legally required to appoint a Data Protection Officer (DPO). Even so, any query related to the processing of personal data can be sent to the email above.

2. Purposes of processing

The personal data collected through the Website is processed for the following purposes:

Purpose 1 - Handling enquiries and communications. Responding to enquiries that the user submits through the Website forms, by email, phone or WhatsApp. This includes the follow-up of the conversation until it closes, as well as scheduling the initial diagnostic video call through the Google Calendar booking page, if the user requests it.

Purpose 2 - Managing the contractual relationship. If the user becomes a client, administrative, accounting and fiscal management of the contractual relationship, including billing, payments, technical support and operational communications tied to the contracted services.

Purpose 3 - Compliance with legal obligations. Compliance with applicable legal obligations, especially in fiscal, commercial and employment matters.

Purpose 4 - Form security. Preventing abuse of the Website forms and the use of third parties' data, as detailed in section 6.

3. Legal basis for processing

The legal basis for processing varies by purpose:

  • For enquiry handling: pre-contractual measures taken at the data subject's request (art. 6.1.b GDPR), and legitimate interest of the Controller to respond and continue the conversation (art. 6.1.f GDPR).
  • For contractual management: performance of the contract to which the data subject is party (art. 6.1.b GDPR).
  • For compliance with legal obligations: compliance with a legal obligation applicable to the Controller (art. 6.1.c GDPR).
  • For form security: legitimate interest of the Controller (art. 6.1.f GDPR), as detailed in section 6.

4. Retention period

  • Enquiries that do not become a contractual relationship: for as long as needed to handle and follow up on the enquiry and, at most, up to 24 months from the last interaction, unless the data subject expressly requests earlier deletion.
  • Client data: for the full duration of the contractual relationship and, once it ends, for the legal periods applicable in commercial, fiscal and accounting matters (generally 6 years under the Spanish Commercial Code).
  • Data for compliance with legal obligations: for the periods required by the relevant regulations.
  • Technical record of form submissions: 90 days; 12 months if the submission is identified as abuse (section 6).

Once those periods elapse, the data will be deleted or kept blocked, available solely to competent authorities for the prescription periods of any potential liabilities.

5. Data recipients

Personal data is not transferred to third parties except:

  • When there is a legal obligation to disclose (tax, judicial or administrative authorities).
  • To processors providing services to the Controller that are strictly necessary for service provision: web hosting providers, email platforms, administrative and accounting management platforms, calendar and video call platforms. All are bound by the corresponding data processing agreement under article 28 GDPR.

In addition, when the user chooses, on their own initiative, to use any of the external services linked from the Website (the Cal.com booking page or WhatsApp), they share their data directly with Cal.com or WhatsApp/Meta, which act as independent controllers under their own privacy policies. Those links are only activated when the user clicks them; simply browsing the Website does not transmit any data to those third parties.

Apart from those links, when the diagnostic request form is submitted the Controller sends the data subject an acknowledgement by email and, if the phone number given is a Spanish mobile number, also a WhatsApp message from one of our team's WhatsApp lines. For that message, the phone number and the text of the acknowledgement pass through WhatsApp (Meta). The acknowledgement may be held until a person reviews the submission, as explained in section 6.

The Controller does not carry out international data transfers outside the European Economic Area, except those that may result from the use of Cal.com and WhatsApp/Meta: if the user books an appointment on Cal.com or communicates via WhatsApp, and when the form acknowledgement is sent to them via WhatsApp. Those transfers are handled by those providers under their own privacy policies and the safeguard mechanisms provided for in the GDPR.

6. Form security

When the diagnostic request form on the Website is submitted, in addition to the data the user types in, we record the IP address it is sent from, the technical data the browser itself sends with the request (browser and operating system type, language and referring page), the time taken to fill in the form, and the date and time of submission. From the IP address we also derive the approximate country and city, using a database installed on our own server, and the public network name associated with that address.

  • Purpose: preventing abuse of the forms and the use of third parties' data (for example, someone entering another person's phone number). These data feed an automatic check that only decides whether the automatic acknowledgement (email and, where applicable, WhatsApp; see section 5) is sent straight away or waits until a member of the team has reviewed the submission; the request reaches the team either way, and the check has no legal effects on the data subject and does not similarly significantly affect them (section 10).
  • Legal basis: the Controller's legitimate interest in protecting its forms and the people whose data might be used without their permission (art. 6.1.f GDPR).
  • Retention: 90 days from submission, or 12 months if the submission is identified as abuse, so that a complaint or a report to the authorities can be dealt with. After that, the data are deleted. The result of the check (a score and the codes of the signals detected, without the IP address or the other technical data) is noted in the request's record in our sales management tool and kept together with it, as set out in section 4.
  • Recipients: not disclosed to third parties except where required by law (authorities and courts). They are not used for advertising or to track the user: the form sets no cookies and stores nothing in the browser.
  • Right to object: the data subject may object to this processing at any time, on grounds relating to their particular situation, by writing to info@laresgestion.com (sections 7 and 8).

7. Rights of the data subject

Any individual has the right to:

  • Access their personal data to know which data is being processed.
  • Rectify inaccurate or incomplete data.
  • Delete the data when it is no longer necessary for the purposes for which it was collected.
  • Object to the processing on grounds related to their particular situation.
  • Restrict the processing in certain circumstances.
  • Request portability of the data in a structured, commonly used format.
  • Withdraw consent at any time, for any processing that may be based on it, without affecting the lawfulness of processing prior to its withdrawal.

8. Exercising rights

To exercise any of these rights, the data subject can send a written request to:

The request must include first and last name, the right being exercised and an address for notifications. Additional information to confirm identity will only be requested where there are reasonable doubts about it (art. 12.6 GDPR). Lares Gestión y Consultoría S.L. will respond within a maximum of one month from receipt of the request, extendable by two additional months in cases of particular complexity.

9. Right to lodge a complaint with the supervisory authority

The data subject has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, the Spanish supervisory authority for data protection) if they consider that the processing of their personal data infringes the GDPR. The AEPD can be contacted through its electronic site at www.aepd.es.

10. Automated decision-making and profiling

The only automated assessment carried out is the security check on the diagnostic request form described in section 6. It weighs each submission using technical signals and signals from the submission itself: referring page, approximate country, network name, time of day, time taken to fill in the form, whether the accommodation name looks randomly typed, and whether the same phone number or IP address appears in other recent submissions. Depending on the result, the automatic acknowledgement is sent straight away or waits until a member of the team reviews the submission.

This check does not reject the request, which reaches the team either way; it has no legal effects on the data subject and does not similarly significantly affect them (art. 22 GDPR), and it is not used for commercial or advertising purposes. The data subject may object to it as explained in section 6.

Apart from that check, no automated decisions are made and no profiling is carried out using the personal data processed.

11. Changes to the privacy policy

This privacy policy may be amended to adapt to legislative changes, service improvements or changes in the Controller's practices. Any amendment will be published on the Website and communicated to data subjects where legally required.