Last updated: October 27, 2025

1. Data Controller

Juan Diego Muñoz Espada (trade name Mecan Legal)
NIF: 78980091T
Address: Calle Castillejos, 4, 1A, 29601 Marbella (Málaga), Spain
Email: [email protected]

2. Personal Data We Process

Depending on the form or interaction: identification and contact data (name, email, phone), professional details, the content of your inquiry, billing/payment data if you are a client, and technical browsing data (IP, cookie identifiers and preferences—see Cookies Policy).

3. Purposes and Legal Bases

• Managing inquiries and “Book Consultation” requests: pre-contractual measures and/or consent.

• Providing services and client relationship (matters, communications, invoicing): performance of a contract and legal obligations.

• Informational/marketing communications (if you opt in): consent; you may withdraw consent at any time.

• Site security and fraud prevention: legitimate interest.

• Selection of collaborators (if applicable): consent and/or pre-contractual measures.

4. Retention Periods

• Leads/inquiries: up to 24 months of inactivity.

• Clients: for the duration of the relationship and 6 years thereafter due to accounting/tax obligations.

• Marketing: until you withdraw consent or after 24 months of inactivity.

• Security/logs: up to 12 months.

5. Recipients

We may share data with:

• Service providers acting as processors (hosting/email, IT support, analytics, meeting scheduler, productivity tools), under contracts compliant with Art. 28 GDPR.

• Public administrations and courts where there is a legal obligation.

• Financial institutions to manage payments/collections.

(The specific list of tools and providers is reflected and updated in the Cookies Policy and/or within the consent management platform (CMP).)

6. International Transfers

Where providers outside the EEA are used (e.g., the U.S.), we implement the safeguards of GDPR Chapter V (e.g., Standard Contractual Clauses) and, where appropriate, additional measures.

7. Your Rights

You may access, rectify, erase, object, restrict processing, and obtain portability of your data, and withdraw consent at any time.
To exercise your rights, write to [email protected] with the subject “GDPR Rights” and proof of identity.
You can lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.

8. Minors

Our services are not directed at minors. If we become aware of data relating to minors without valid authorization, we will delete it.

9. Security

We apply appropriate technical and organizational measures to protect confidentiality, integrity, and availability.

10. Changes

We may update this Policy; the current version and “Last updated” date will always be published.