Privacy Policy — GESTEXLINK

I. Data Controller

Personal data on the GESTEXLINK Platform is processed by two controllers with distinct roles:

1.1 Technical Platform Controller (Digital Operator)

Name: NexLink Hub S.L.U.
Tax ID: B88756994
Address: Avenida Meridiana 320, 3º 6ª, 08027 Barcelona, España
Email: privacidad@gestexlink.com

1.2 Legal Service Controller (Legal Provider)

Name: GESTEXPERT S.L.
Tax ID: B55701668
Address: Avenida Diagonal, 468, Planta 8, 08006 Barcelona, España
Email: privacidad@gestexpert.com

Note on joint controllership: Where both entities jointly determine the purposes and means of processing, they act as joint controllers (GDPR Art. 26), with an internal agreement setting out their respective obligations. Users may exercise their rights with either entity.

II. Purposes, Legal Basis and Categories of Data Processed

Depending on the legal area contracted and the service used, GESTEXLINK processes the following personal data for the purposes and on the legal bases indicated. If you submit the quick consultation form with an email that does not yet have an account, GESTEXLINK creates your application account without a password and emails you a link to set one, together with the standard registration messages.

Processing Purpose	Data Categories	Legal Basis (GDPR)	Retention Period
User registration management and Platform access	First name, surname, email, password (hash), preferred language, access IP	Art. 6(1)(b) — Contract performance	For the term of the contract + 3 years after termination
Browser Extension (GESTEXLINK Chrome Extension) — Enable secure authentication of lawyers via credentials, temporarily retrieve the list of legal cases from the platform backend and run automated form autofill on authorised government e-portals.	Access credentials (temporary session tokens) and local technical configuration data of the extension.	Art. 6(1)(b) — Contract performance.	Configuration and session data are stored locally while the extension remains installed or until the user logs out. The extension does not permanently store, collect or transmit any personal data from cases or browsing history; form processing is performed strictly in local memory at runtime.
Provision of legal services (Corporate, Tax, Employment, Civil Law)	Corporate documentation, tax IDs, notarial powers of attorney, contracts, financial information, case data	Art. 6(1)(b) — Contract performance	During the relationship + 5 years (commercial limitation) or 15 years (civil limitation)
Immigration Services	Passport, NIE/TIE, migration documents, family situation, birth and nationality data	Art. 6(1)(b) — Contract performance	During the relationship + 5 years
Litigation case management (court or arbitration proceedings)	Procedural information, background, court case documents	Art. 6(1)(b) and Art. 6(1)(c) — Contract performance + legal obligation	Until final judgment + 5 years
Intellectual and Industrial Property — registration and enforcement	Owner data, technical documentation of the work/invention, third-party data in infringement disputes	Art. 6(1)(b) — Contract performance	Useful life of registration + 10 years
Compliance with legal obligations (accounting, tax, LSSI-CE)	Billing data, tax ID, tax address, service amounts	Art. 6(1)(c) — Legal obligation	6 years (Commercial Code) / 4 years (AEAT)
Commercial communications and newsletter (with prior consent)	Email, name, service preferences, language	Art. 6(1)(a) — Consent	Until consent is withdrawn
Platform usage analysis (service improvement)	Browsing data, analytics cookies (subject to consent), traffic origin (QR, web, app)	Art. 6(1)(f) — Legitimate interest / Art. 6(1)(a) — Consent	25 months maximum (CNIL/AEPD guidelines)

III. Special Category Data

In certain cases, provision of legal services may involve processing of special category data within the meaning of GDPR Article 9, as well as data relating to criminal convictions and offences under GDPR Article 10.

3.1 Data relating to Court Proceedings and Criminal Records (GDPR Art. 10)

In the context of criminal litigation services or legal defences involving information on convictions or criminal offences, GESTEXPERT S.L. applies the following enhanced security measures:

End-to-end encryption (AES-256) in storage and transmission.
Restricted access to lawyers and authorised legal professionals linked to the case.
Access logging and audit of operations on especially sensitive data.
Pseudonymisation of data in testing and technology development environments.

3.2 Sensitive Civil and Corporate Data (Contracts, Tax IDs, Financial Assets)

Commercial contracts, incorporation deeds, shareholder information, financial statements and tax IDs of individuals linked to legal entities are processed under the data minimisation principle (GDPR Art. 5(1)(c)) and retained only for as long as necessary to provide the service.

3.3 Intellectual Property and NDA Transmission

Technical documentation, prototypes, unpublished works, patent applications and any information covered by non-disclosure agreements (NDA) is transmitted via TLS 1.3 encrypted channels and stored in document management systems with controlled, logged access.

IV. Recipients and International Data Transfers

4.1 Recipients

Personal data will not be disclosed to third parties except in the following cases:

Legal obligation: Public authorities, courts, Tax Agency, Social Security or other competent authorities when required by applicable law.
Processors: Technology providers acting as processors (cloud hosting, transactional email, analytics tools) under contract pursuant to GDPR Art. 28, ensuring adequate security measures.
Collaborating lawyers: Registered professionals linked to the Platform who act as independent controllers for management of their specific legal case.

4.2 International Transfers

As a general rule, personal data is processed and stored on servers located within the European Economic Area (EEA). Where an international transfer to a third country outside the EEA is necessary, such transfer will be carried out in accordance with the appropriate safeguards set out in GDPR Chapter V, including Standard Contractual Clauses approved by the European Commission.

V. Retention Periods

Personal data will be retained for the minimum time necessary for provision of the contracted service and, thereafter, for applicable limitation periods under current law, to address potential liabilities.

Generally, without prejudice to the specific periods indicated in the table in Section II:

Service contract data: 5 years from last provision (personal actions limitation, Art. 1964 Civil Code).
Billing and accounting data: 6 years (Art. 30 Commercial Code).
Tax data: 4 years (Art. 66 Law 58/2003 General Tax Law).
Anti-money laundering data: 10 years (Law 10/2010).
Consent-based data (marketing): until consent is withdrawn.

VI. Data Subject Rights

Under the GDPR and LOPDGDD, the data subject has the right to exercise the following rights regarding processing of their personal data:

📋 Access (Art. 15)

Obtain confirmation as to whether personal data concerning you is being processed and access it.

✏️ Rectification (Art. 16)

Request correction of inaccurate or incomplete personal data without undue delay.

🗑️ Erasure (Art. 17)

Request erasure of your data when, among other grounds, it is no longer necessary for the purpose for which it was collected.

⏸️ Restriction (Art. 18)

Request restriction of processing in certain circumstances provided for in the GDPR.

📦 Portability (Art. 20)

Receive personal data in a structured, commonly used, machine-readable format and transmit it to another controller.

🚫 Objection (Art. 21)

Object to processing of your data in certain circumstances, including profiling.

To exercise any of these rights, the data subject may write to privacidad@gestexlink.com, attaching a copy of their identity document. A response will be provided within one month of receipt of the request, extendable by up to three months in cases of particular complexity.

You also have the right to lodge a complaint with the competent supervisory authority:

Spain: Spanish Data Protection Agency (AEPD) — www.aepd.es
EU: The data protection authority of the data subject's Member State of habitual residence.

VII. Cookie Policy

The GESTEXLINK Platform uses cookies and similar tracking technologies in accordance with the ePrivacy Directive (2002/58/EC) and the GDPR.

7.1 Strictly Necessary Cookies

These cookies are essential for Platform operation and cannot be disabled. They do not store identifiable information. They include:

User session: Maintenance of the authenticated session.
CSRF token: Protection against cross-site request forgery attacks.
Language preference: Selected language (localStorage, not a cookie).

7.2 Analytics Cookies (Subject to Consent)

They will only be installed with the user's prior informed consent. They analyse Platform usage to improve the service. Traffic origin (including visits from QR codes with the ?origin=qr parameter) may be analysed in aggregate and anonymised form.

7.3 Cookie Management

Users may manage, block or delete installed cookies through browser settings. Disabling non-essential cookies will not affect essential Platform operation.

The Platform includes a cookie consent banner on the first visit, in accordance with AEPD guidelines. Users may accept or reject non-essential cookies. The preference is stored in localStorage under the key gestexlink_cookies and may be changed at any time. For more information, see the Cookie Policy.

VIII. Security Measures

In accordance with GDPR Article 32, NexLink Hub S.L.U. and GESTEXPERT S.L. have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including among others:

Data encryption in transit via TLS 1.3.
Data encryption at rest (AES-256) for sensitive legal documentation.
Two-factor authentication (2FA) for access to legal cases.
Role-based access controls (RBAC) with least privilege principle.
Audit logging of all operations on personal data.
Security breach management procedure with notification to the AEPD within 72 hours.
Periodic data protection impact assessments (DPIA) for high-risk processing.
Servers hosted in ISO 27001-certified data centres within the EEA.

IX. Minors

GESTEXLINK Platform services are intended exclusively for persons aged 16 or over. In accordance with GDPR Art. 8 and LOPDGDD Art. 7, if the controller becomes aware that personal data of children under 16 has been collected without verifiable consent of the holder of parental authority or guardianship, such data will be immediately deleted.

X. Changes to the Privacy Policy

This Privacy Policy may be amended to reflect legislative, case law or Platform practice changes. Any material change will be notified to registered users by email at least 30 days before it takes effect.

Continued use of the Platform after the new version takes effect will constitute acceptance thereof.

XI. Contact and Data Protection Officer

For any enquiry regarding processing of your personal data or exercise of your rights, please contact:

Email de privacidad: privacidad@gestexlink.com
Legal email: legal@gestexlink.com
Data Protection Officer (DPO): dpo@gestexlink.com — Data Protection Compliance Officer for NexLink Hub S.L.U. and GESTEXPERT S.L.

For complaints to the Spanish supervisory authority: Spanish Data Protection Agency (AEPD) — www.aepd.es