Controllers
BEDMOND MEDICAL PROJECTS, S.L., tax ID B93645224, calle Don Cristian, 16, 29007 Málaga, controls processing related to this website, commercial enquiries, contracting, administration and invoicing.
Juan José Domínguez Baro, lawyer and member 3,448 of the Málaga Bar Association, acts as an independent controller for the data needed to perform the legal assessment independently, document the matter and comply with legal and professional duties.
Both may be contacted at jjdbaro@gmail.com.
Data we process
We may process the URL and public content of the audited website; name, role, organisation, email and telephone; answers and score from the indicative diagnostic; attribution data included in the campaign link; tax and invoicing details; communications; engagement terms; necessary documents and evidence; invoice and payment status; report conclusions; and minimum technical security data.
To prevent form abuse, the network address and user agent are converted into a cryptographic identifier. The network address is not retained in plain text in that control table.
Purposes and legal bases
- Responding to enquiries and preparing a proposal: steps requested before entering into a contract.
- Agreeing and performing the engagement: performance of the contract and legitimate interests in managing a professional relationship with the represented organisation.
- Performing the audit and issuing the report: performance of the engagement and legitimate interests in providing a traceable, independent and high-quality service.
- Invoicing, accounting and compliance: legal obligations and performance of the contract.
- Security, fraud prevention, conflicts and claims: legitimate interests, professional duties and the establishment, exercise or defence of legal claims.
- Other marketing: only with consent or another valid legal basis, with a right to object at any time.
Required data
The URL, name, email, professional purpose and acceptance of this information are required to process an enquiry. Telephone is optional. Tax information is required only before an engagement is formalised and invoiced.
Data obtained from the audited website
The audit may document personal data visible on the client’s website or other relevant public sources, including professional names and contact details, notices, corporate profiles, forms, testimonials or screenshots. The category and source will be linked to the evidence in the file.
Where Article 14 GDPR requires direct information, it will be provided within the legal period. If an exception applies—for example because the person already has the information, notification would involve disproportionate effort after proper assessment, or the data must remain confidential under professional secrecy—the decision and safeguards will be documented.
Recipients, providers and international transfers
Data may be disclosed to public bodies, courts, professional associations, financial institutions, advisers and insurers where legally required or necessary to manage or defend the professional relationship.
Service providers may include OpenAI Sites and Cloudflare for infrastructure and databases, Resend for transactional email, and Stripe for invoicing and payments. Some providers may process data outside the EEA. Where there is no adequacy decision, legally recognised safeguards such as standard contractual clauses and, where appropriate, supplementary measures will be used.
Retention
Enquiries that do not lead to an engagement are ordinarily retained for no more than twelve months from the last interaction. Technical rate-limit identifiers are deleted within 24 hours.
Professional files are retained for the relationship and the periods needed to comply with professional duties or defend liabilities. Contracts, invoices and evidence of payment are retained for applicable company, tax and limitation periods. Data will then be erased or blocked where required by law.
Rights
You may request access, rectification, erasure, restriction, portability or objection and may withdraw consent without affecting previous processing. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.
Write to jjdbaro@gmail.com. Only information necessary to verify identity will be requested where reasonable doubt exists. You may also complain to the Spanish Data Protection Agency or your competent supervisory authority.
Automated diagnostic and security
The questionnaire adds the answers provided and automatically displays an indicative exposure band. The result has no legal effect, does not determine whether an engagement is accepted, is not an audit and may be reviewed by a person. No marketing profiles are created outside this requested diagnostic.
Measures are used to restrict access, prevent abuse and protect credentials, enquiries and evidence. The lawyer and collaborators are bound by professional secrecy. Please do not submit special-category data, secrets or unnecessary confidential information through the form.
Update
Version dated 7 September 2026. This policy will be reviewed when the processing, providers or service functions change.