Privacy policy

1. Data controller

BRAVO ADVOCATS ASSOCIATS, S.L.U., with tax number (NIF) B64450224 and registered office at Rambla Just Oliveras, 64, entresuelo 1.ª, Esc. A, 08901 L'Hospitalet de Llobregat (Barcelona), Spain, is the data controller.

Contact: info@bravoadvocats.com · Telephone: +34 93 337 58 04.

No data protection officer has been appointed. Queries and requests concerning privacy may be addressed to the contact details above.

2. Scope, origin of the data and persons concerned

This policy applies to data processed through the website and its forms, the chat assistant available on every page, the booking and payment of appointments, the telephone, the AI Secretary, the transcription and summarising of calls, e-mail, Microsoft 365, the WhatsApp Business channel, the enquiries CRM and, after engagement, the case management system.

Data normally comes from the person concerned. It may also be provided by their representative or by another person connected with the matter, come from a professional referral or, where necessary, from public sources and registers accessible in accordance with the law. Anyone providing third-party data must limit it to what is necessary and act legitimately. Where appropriate, we will inform those persons in accordance with art. 14 GDPR, unless a legal, confidentiality or professional secrecy exception applies.

The persons concerned may be website visitors, people who call or make an enquiry, prospective clients, clients, representatives, payers, job applicants, subscribers and third parties mentioned in a communication or case file.

3. Data we process

Identification and contact: name, surname, telephone, e-mail, language and, where necessary, details of representation.

Enquiry and professional relationship: area of law, brief reason, stated urgency, communications, documents provided and data needed to assess or manage the matter.

Calls: calling number, date, time, duration, recording of the call, transcript, summary, operational classification and agreed actions.

Bookings and payments: diary, professional or area, date and time, appointment status, amount, payment reference and result. BRAVO ADVOCATS does not receive your full card details.

Channels and systems: WhatsApp or e-mail messages, follow-up status, internal person responsible, and access, export, security and incident logs.

Website: technical connection and browsing data, and data obtained with your consent where a non-exempt cookie or technology requires it.

First-party website analytics (no cookies): the website uses its own visit counter, hosted on the same server, which installs no cookies, stores nothing on your device and sends no data to third parties. Each time a page is viewed or a button is pressed (phone, WhatsApp, e-mail, booking, form or another button on the site) it records: date and time, type of action, page path and title (without parameters), page language, referring domain (without the path), campaign tags if the address carries them, the name of the button and its destination (the page it leads to or, for phone buttons, the firm's number), device type (mobile, tablet or computer, based on screen width) and a visit identifier. The counter does not store your IP address, your browser, your location or anything you type into forms. The visit identifier is calculated on the server from your IP address and browser details, irreversibly transformed with a random key that is replaced every day and not kept: the counter does not store your IP address or browser details, which are used only at that moment; the next day the identifier can no longer be recalculated and the same person receives a different one, so it cannot be used to follow them from one day to the next. If you contact the firm, a fragment of that identifier is used to link the visit to your contact (through the booking, the form or the WhatsApp message; for calls, by approximate time) and the actions of that visit may be copied to your record in the firm's system (see “Origin of the booking and type of matter” below). The counter's data are stored in a database on the website's hosting server, in France, outside the part accessible from the internet, and are deleted automatically after 425 days (about 14 months, to compare each month with the same month of the previous year). If your browser sends the “Do Not Track” signal or Global Privacy Control, the counter measures nothing and no identifier is added to links.

Complementary analytics (no cookies): in addition to the first-party counter, the website uses a second, open-source visit statistics tool installed on a server administered by the firm's IT manager, hosted by OVHcloud in Strasbourg (France), within the European Union. The data are not disclosed to Google or to any other third party. This tool installs no cookies and stores no information on your device; from your browser it only checks the screen size, the language, the “Do Not Track” signal and an exclusion flag that exists only if whoever administers the website has created it on their own computer. Each time a page is viewed it records: the page viewed (with its title and without the address parameters), the origin (the website and page you arrive from), the device type and screen size, the operating system, the browser, the browser language and the country, region and approximate city you connect from; and, on the booking buttons in the Resources section, the name of the button pressed. It does not collect what you type into forms or into the chat. It does not store your IP address: it is used only at that moment to calculate a visit code, from your IP address, your browser and a key that changes every day, and to infer the country, region and city; it is then discarded. Because the key changes every day, the code cannot be used to follow the same person from one day to the next. This tool respects the “Do Not Track” signal: if your browser sends it, nothing is measured. The data are kept for 14 months and deleted automatically. This tool is not cross-referenced with contact, booking or enquiry data: only the first-party counter can link a visit to your record, as described above.

Recruitment and communications: CV, experience, training, availability, professional expectations and communication preferences.

Origin of the booking and type of matter. When you book, send a form or write to Clara, we record which page or resource on the website you came from (the page path only, without parameters), what source brought you (referring domain or campaign, if any) and the type of matter you chose (for example criminal, employment, court summons or arrest), always as closed options. This is used to handle the matter with the right priority and to know which content is useful. To link the visit to the booking, a temporary identifier that expires after 24 hours is used, with no cookies or storage on your device; it is added to the booking link, to the form and, invisibly, at the end of the WhatsApp message text prepared from the website. It is not used if your browser sends the “Do Not Track” signal or Global Privacy Control. Legal basis: pre-contractual measures (Art. 6(1)(b)) for the type of matter and legitimate interest (Art. 6(1)(f)) for the origin; you may object (section 10). It is kept with the record (section 8).

Resources tools. The calculators and other tools in the Resources section run entirely in your browser: what you enter (dates, amounts, rates…) is not sent to the firm or to third parties, and is not stored. As on the rest of the site, we only measure that the page was visited and, where relevant, that a contact button was pressed. Results are indicative and are not legal advice. The buttons that lead from a resource to the booking (for example “Review my summons”) only carry closed options (area and reason), never what you entered in the tool.

Given the nature of legal assistance, an enquiry may contain health data or other special categories, as well as information on convictions, offences, criminal proceedings, victims or third parties. On first contact we ask only for your name, contact details, area of law and a very brief reason; please avoid sending documents or sensitive details that are not yet necessary.

4. Purposes and legal bases

Where we rely on legitimate interest, the balancing test will be documented and information on its essential elements may be requested. If a person objects on grounds relating to their particular situation, we will stop the processing unless compelling legitimate grounds exist or it is necessary to establish, exercise or defend legal claims.

5. AI Secretary, recording, transcription and human oversight

The assistant identifies itself as an artificial-intelligence assistant of BRAVO ADVOCATS at the start of the call, before the person explains their matter, and states that the call is recorded and transcribed in order to manage the enquiry and, where relevant, the appointment. This information is given on first contact and expanded in this policy, to which the notice itself refers.

The recording and its transcript are accessible only to authorised staff of the firm and are deleted within the period set out in section 8. Anyone who does not wish to be recorded may say so and use e-mail, the web form or an in-person visit instead, without any reduction in the quality of the service.

The system can identify the area of law and the stated urgency, generate a summary, propose an appointment and route the communication. The transcript may contain errors; authorised staff may review it and the person concerned may request access or rectification.

The AI Secretary does not provide definitive legal advice, does not decide on the acceptance of clients, does not open case files automatically and does not take solely automated decisions with legal effects or a significant impact. Human assistance may be requested. The information is used to provide the service and not to train general-purpose models.

Internal staff assistant. Authorised firm staff may use an internal artificial intelligence assistant to look up and summarise the records and conversations of enquiries received, only with each person’s permissions and with a log of each query. It is processed with the providers and in the regions in sections 6 and 7, without training models and subject to professional secrecy; a professional always reviews the result before using it.

5a. Clara chat and guidance inside the booking

What is sent. In the Clara chat (available on every page), what you type is sent. At the last step of the booking form, Clara also receives the closed answers from the earlier questionnaire (area, reason, situation and priority) and the questions you ask. It does not receive your name, phone number or email unless you type them into the conversation. Please avoid typing health data, criminal-record data or third-party data that is not essential.

Why. To give you general guidance and next steps, to detect whether the matter is urgent, and so the firm can prepare your consultation. The guidance is generated with artificial intelligence: it is not legal advice and does not create a professional relationship with the firm, and no automated decision with legal effects is taken about you. You can ask to speak to a person at any time.

Legal basis. Pre-contractual measures at your request (Art. 6(1)(b) GDPR) and legitimate interest in handling and protecting this channel (Art. 6(1)(f)).

What goes into the form. If you have typed your name, phone number, email or the reason for your enquiry in the conversation, Clara may offer to copy them into the form. They are only copied if you press “Use these details”; you can review and change them before continuing, and you tick the terms box yourself. If you do not press the button, those details do not go into the form or the booking, but what you wrote in the conversation is kept for the period stated below.

Retention. The conversation is kept for a maximum of 60 days, with scheduled deletion. If you complete a booking or give contact details, the periods in section 8 apply to the resulting record.

Processors. Conversations are processed with artificial intelligence services from Google Cloud (Vertex AI, Gemini models) in the European Union (Google Cloud EU location) and, as a back-up, Microsoft Azure OpenAI through a resource in Sweden Central (Sweden) with an EU Data Zone deployment, so that the data is processed within the European Union. Both provide the service under a processing contract (Art. 28 GDPR) and do not use the data to train models. Cloudflare provides the anti-spam check (section 6). Safeguards are in section 7.

In your browser. To keep the conversation going, the chat stores an anonymous session identifier in your browser’s session storage, which is deleted when you close the tab. It uses no cookies.

6. Recipients, processors and other providers

We do not sell data or disclose it for purposes unrelated to the service. It may be accessed by the professionals and authorised staff of BRAVO ADVOCATS and by the necessary providers, all bound by a processing agreement under art. 28 GDPR:

• The firm's IT manager, who administers the server of the AI Secretary, the website's first-party visit counter and the complementary statistics tool.
• Telnyx, for the numbering and transport of voice, WhatsApp and SMS communications.
• OVHcloud, for the server dedicated to the solution, which also hosts the complementary statistics tool, located in Strasbourg (France).
• Google Cloud, in the European Union (Google Cloud EU location): Vertex AI (Gemini models), as the generative artificial intelligence service for the Clara chat, calls and the internal assistant, and Speech-to-Text and Text-to-Speech, for the transcription and voice synthesis of calls, without using the data to train general-purpose models.
• Microsoft Azure, as back-up: Azure Speech (transcription and voice synthesis of calls), in the North Europe region (Ireland), within the European Union, and Azure OpenAI (generative artificial intelligence, on some channels), through a resource in Sweden Central (Sweden) with an EU Data Zone deployment, so that the data is processed within the European Union, without using the data to train general-purpose models.
• Microsoft 365, for diary, e-mail and a minimal history.
• Notion Labs, as the enquiries CRM, where contact details, area of law, brief reason and the follow-up status of each enquiry are recorded.
• The provider hosting, maintaining and securing the website, with its server in France, where the first-party visit counter's data are also stored, and, if any non-exempt cookie were to be incorporated in the future, the analytics or advertising provider the person has authorised.
• The bank and Redsys for payment, when paid by electronic means. The card is entered in the payment environment and BRAVO ADVOCATS receives only the reference, amount and result.
• Meta / WhatsApp Business, for the messaging channel.
• Cloudflare, Inc., when the anti-spam system for the booking form, the contact form and the chat assistant is active, to distinguish a person from an automated submission.
• Kleos, only after a professional confirms the engagement and opens the case file.

Where necessary for the service or where a legal obligation exists, data may also be received by courts and tribunals, public administrations, bar associations, court agents (procuradores), experts, notaries, registries, insurers, financial institutions or other professionals involved in the matter.

7. International transfers

The telephony and hosting infrastructure is configured within the European Economic Area. The transcription and voice synthesis of calls and generative artificial intelligence are processed within the European Union by Google Cloud (EU location). Microsoft Azure is used as back-up, also within the European Union: Azure Speech in North Europe (Ireland) and, on some channels, Azure OpenAI through a resource in Sweden Central (Sweden) with an EU Data Zone deployment. Google and Microsoft belong to groups headquartered outside the European Economic Area: where any processing or access takes place outside it (for example, technical support), it relies on an adequacy decision or on the European Commission’s standard contractual clauses.

Meta, Telnyx, Notion Labs and Cloudflare, Inc. (United States; anti-spam for the forms and the chat), and certain sub-processors or support services, may involve access or transfers outside the European Economic Area. In those cases the transfer relies on an adequacy decision applicable to the receiving entity or on the European Commission's standard contractual clauses and, where necessary, on a transfer assessment with additional safeguards. Information on these safeguards may be requested at info@bravoadvocats.com.

A European location or region does not by itself exclude all international access. BRAVO ADVOCATS and its processors will review the list of sub-processors and update this policy if the actual map of processing changes.

8. Retention

Call recording and transcript: a maximum of 60 days in the system, including queues and operational replicas, with scheduled deletion. Backups have a defined overwrite cycle and are not restored for ordinary use. A specific incident or claim may require temporary blocking in accordance with the law.

Clara chat and conversations with the assistant: a maximum of 60 days, with scheduled deletion. If an enquiry record is opened, the record’s periods apply.

Pending enquiries: while they are being handled; the "pending" flag does not allow indefinite retention. Once an enquiry is closed without engagement, the record card and minimal summary will be kept for up to 12 months from the last interaction, unless a valid objection is made or a proven need for defence exists.

Bookings without engagement: up to 12 months. Payment references and tax or accounting documentation: for the applicable legal periods.

Engaged matters: for the duration of the professional relationship and, afterwards, blocked for the applicable legal, ethical and liability periods. Commercial and accounting documentation is kept for six years; tax documentation, as a general rule, for four years; and documentation subject to anti-money-laundering rules, where applicable, for its legal period.

Technical and security logs: as a general rule, up to 12 months, unless there is an incident or a retention obligation.

First-party website analytics: 425 days, with automatic deletion. The visit identifier cannot be recalculated after the day on which it was generated. The actions of a visit that have been linked to your record because you contacted the firm are kept with the record (see “Origin of the booking and type of matter”).

Complementary statistics: 14 months, with the oldest data deleted automatically every day. The visit code changes every day.

Newsletter: until consent is withdrawn or an objection is made. Job applications: for the duration of the process and, with consent for future vacancies, for a maximum of 12 months. Cookies: according to their duration and the specific policy.

At the end of each period, the data will be securely deleted or anonymised. Where blocking applies, the data will be reserved solely for judges, courts, the Public Prosecutor's Office, administrations or data protection authorities during the limitation periods.

9. Necessary data and alternatives

Your name, a means of contact and the minimum information needed about the enquiry or booking are required in order to handle it. If they are not provided, it may not be possible to return the call, assign the area of law or complete the appointment and payment. You may ask for human assistance and use the form or e-mail as an alternative.

10. Your rights

You may request access, rectification (including transcription errors), erasure, restriction, objection and portability where applicable, and withdraw your consent to a newsletter or a cookie without affecting the lawfulness of prior processing.

Requests may be sent to info@bravoadvocats.com, with the subject "Protección de datos", or to the postal address indicated. We may ask for information strictly necessary to verify your identity. A response will be provided within the legal deadlines and free of charge, except for manifestly unfounded or excessive requests.

If you consider that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): https://www.aepd.es.

11. Confidentiality and security

Legal information is protected by the duty of confidentiality and, where applicable, by professional secrecy. We apply measures appropriate to the risk: minimisation, role-based permissions, strong authentication, encryption in transit and, where appropriate, at rest, access and export logs, backups, updates, vulnerability and incident management, processing agreements, scheduled deletion and human oversight.

Access is limited to those who need it for their duties. Providers may not use the information for their own purposes or for training or general improvement of models, unless a separate legal basis exists and prior notice is given, which is not authorised in the planned configuration.

12. Minors and third-party data

Our channels are not specifically aimed at minors. Where an enquiry concerns a minor or a vulnerable person, we will ask only for the necessary information and may require the involvement of their representative. Do not provide third-party data or documents that are not essential to the enquiry.

13. Updates

This policy will be reviewed whenever the purposes, providers, regions, periods or safeguards change. The same current version will be published in a coordinated way on the website, the booking page and the AI Secretary's notices.

Version 1.6. Effective date: 7 November 2026. The version in force is always the one published on this page.