Legal Stones Legal Stones Preventive legal consulting

Legal information

Privacy policy

Information on personal data processing under Regulation (EU) 2016/679 (GDPR) and Spanish data protection law (LOPDGDD). Each purpose has its own legal basis.

1. Controller

  • Controller: Stones Legal Consulting, S.L.
  • Trading name: Legal Stones
  • Tax ID (NIF): B05764766
  • Locality: 12550 Almazora (Castellón), Spain
  • Contact: [email protected] · +34 676 47 33 16

2. Data and source

Data come from the person who writes, from the form, or from browsing if analytics are accepted.

  • Contact and partner forms. Required: name, work email and the message. Optional: company. There is no phone field.
  • Email and WhatsApp. Whatever the person includes. The telephone +34 676 47 33 16 is the company’s. The WhatsApp link opens that line, and the message reaches the company and Meta.
  • AI consultancy questionnaire at /pruebas/consultoria-ia/. Professional identification and answers about AI use. That route is not indexed.
  • Analytics. Technical identifiers and usage statistics, only if analytics cookies are accepted.
  • Form security. The Cloudflare Turnstile result and the IP address Cloudflare sends when the submission is checked.

The site does not ask for special categories of data. If a message includes them, they are handled confidentially and minimisation is requested.

3. Purposes and legal bases

  • Replying to enquiries and preparing a scope or a fee (form, email or WhatsApp), at the sender’s request: pre-contractual steps, GDPR art. 6(1)(b). Sending the form is that request. It is not an opt-in to marketing.
  • Providing the consultancy once an engagement is accepted: performance of a contract, GDPR art. 6(1)(b).
  • Accounting, commercial and tax duties of an engagement, where they exist: art. 6(1)(c).
  • Web analytics with Google Analytics 4: consent, art. 6(1)(a). If rejected, the script does not load.
  • Filtering automated form submissions: legitimate interest, art. 6(1)(f). The interest is limiting abuse of the form. It covers the Turnstile check and the IP used for that check, not the text of the enquiry, which is processed under the enquiry basis above. You can object by writing to [email protected].

4. Recipients

Depending on the channel, data may be processed by:

  • DigitalOcean, origin hosting for the site and the consultancy application, in Frankfurt.
  • Cloudflare, which sits in front of the domain (CDN, HTTPS and Turnstile on the form) and whose worker delivers the contact and partners forms to the mailbox.
  • Zoho, provider of the [email protected] mailbox. Those two forms are delivered there, and the site does not keep its own database copy.
  • FormSubmit (formsubmit.co), which receives the name and email from the blog guide download form and forwards them to [email protected].
  • Google Ireland Ltd. and Google LLC, only if analytics are accepted (ID G-BK25M6PQ1P).
  • Meta, if the site’s WhatsApp link is opened.

Data are not shared for third-party advertising. An authority may receive them where the law requires it.

5. International transfers

The origin server is in Frankfurt, inside the European Economic Area. This policy does not state that the rest of the processing stays there. Google, Cloudflare, FormSubmit, Zoho and Meta may process data outside the EEA as part of their service. Where processing depends on analytics consent, that consent covers loading Google Analytics. For the other providers, the safeguard is the one each provider documents, including standard contractual clauses where they offer them. A signed processor agreement with each provider is still to be filed internally. The region of the Zoho account is not stated on this page.

6. Retention

  • Enquiries with no engagement: as long as needed to handle them and, at most, 12 months from the last contact, unless you ask for erasure sooner or a professional relationship starts.
  • Engagements: for the life of the relationship and the retention periods required by applicable tax and commercial law.
  • Cookie choice: in the browser’s local storage, key ls-cookie-consent, until it is changed or the site data is cleared.
  • Analytics: as described in the Cookie policy, and only if accepted.

7. Rights

You can request access, rectification, erasure, objection, restriction and portability, where they apply, at [email protected]. Say which right you are using and, if needed to identify you, a detail that shows the request is yours.

You can also complain to the Spanish Data Protection Agency (www.aepd.es).

8. Security

Technical measures reduce unauthorised access: HTTPS, transport-security headers on the server, an anti-abuse check on the form, and a separate test environment. Those measures are not a statement that the site is absolutely secure. If you notice an incident that affects you, write to [email protected].

9. Children

The services are aimed at companies and professionals. The site does not ask for data of children under 14.

10. Changes

If the processing or the applicable law changes, this page is updated and shows the date of the current version.

Last updated: 29 October 2026