Privacy policy

    Last updated: 28 September 2026

    1. Data controller

    2. What data we process

    When you sign up for LegALert through our form, we process:

    • Identification and contact data: company name or trading name, contact person, email address and, if you provide it, telephone number.
    • Activity profile data: type of activity (company or self-employed), legal structure, tax regime, sectors, CNAE code, activity description, autonomous community and municipality, number of employees, turnover and balance sheet brackets, registration or incorporation date, circumstances of your activity that trigger regulatory requirements, planned projects and recruitment, standing with the tax authority and Social Security, de minimis aid received, areas of interest and alert frequency.
    • Optional profile data about the owner or partners: age bracket, whether the person is a woman entrepreneur, whether they were previously unemployed and, where applicable, whether they have a recognised disability. This data is voluntary and used only to identify grants aimed at these groups.
    • Data generated through use of the service: alerts generated for your company, delivery status and dates, and unsubscribe requests.
    • Technical data: IP address and connection data logged by servers when you visit our pages, for security and operational purposes.

    Health data. Disability is special-category data under Article 9 of the General Data Protection Regulation (GDPR). We process it only if you give your explicit consent through the dedicated checkbox on the form. If you do not tick that box, the data is not stored.

    3. How we use your data

    • Provide the regulatory alert service: analyse official publications (such as the BOE) daily and determine which ones may affect your company based on your profile, including relevant grants and subsidies.
    • Send you alerts by email at your chosen frequency, and urgent alerts immediately.
    • Respond to your enquiries and requests, including those concerning your data protection rights.
    • Ensure the security and proper operation of our systems.

    Use of artificial intelligence and human review. To analyse regulations, we use an artificial intelligence model to which we send a description of your activity profile together with the text of official publications. Our team reviews the alerts it generates before they are sent. We do not make decisions based solely on automated processing that produces legal effects concerning you or significantly affects you.

    4. Legal basis

    • Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): to provide the service you request when signing up.
    • Explicit consent (Arts. 6(1)(a) and 9(2)(a) GDPR): for disability data. You may withdraw it at any time without affecting the lawfulness of prior processing.
    • Legitimate interests (Art. 6(1)(f) GDPR): for the security of our systems and to respond to your enquiries.
    • Compliance with legal obligations (Art. 6(1)(c) GDPR): when the law requires us to retain certain data, for example for tax purposes if you purchase a paid plan.

    5. How long we keep your data

    We keep your data while you remain subscribed to the service. If you unsubscribe, we will stop sending you alerts and retain your data in restricted form only for as long as legal liabilities may arise. After those periods, we will delete it. You may request deletion at any time by writing to hola@legalert.online.

    6. Who we share your data with

    We do not sell or disclose your data to third parties. To provide the service, we work with providers acting as data processors under the relevant data protection agreements or terms:

    ProviderServiceProcessing location
    SupabaseService database and functionsServers in Zurich, Switzerland
    AnthropicArtificial intelligence model that analyses regulationsUnited States
    ResendEmail deliveryServers in Ireland (EU); company headquartered in the US
    NetlifyHosting for the form and service pagesUnited States and global network
    IONOSContact email and domainEuropean Union

    International transfers. Switzerland has an adequacy decision from the European Commission. When data is processed in the United States, transfers are covered by safeguards under the GDPR, such as the EU–US Data Privacy Framework where the provider participates, or standard contractual clauses approved by the European Commission.

    Under its commercial terms, Anthropic does not use data sent through its API to train its models.

    We may also disclose your data to authorities when legally required.

    7. Your rights

    You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, at any time by writing to hola@legalert.online. Please specify which right you wish to exercise. We may ask you to verify your identity.

    To update your profile, simply complete the sign-up form again using the same email address. To stop receiving alerts, use the ‘Unsubscribe’ link in each email.

    If you believe we have not handled your data properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

    8. Security

    We apply appropriate technical and organisational measures to protect your data: encrypted communications, company-level database access controls, unguessable unique codes in review and unsubscribe links, and storage of access keys in protected environments.

    9. Minors

    LegALert is a service for companies and professionals. It is not intended for anyone under 18.

    10. Changes to this policy

    We may update this policy to reflect legal or service changes. We will always publish the current version on this page with its update date and notify you by email of significant changes.

    If you have any questions about this policy, please contact us.