This English version is a courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.
This policy explains who processes your personal data when you contact this firm or browse abogadosyemla.com, for what purpose, for how long, and what rights you have. It has been drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Ley Orgánica 3/2018 (Spanish Data Protection Act, LOPDGDD).
1. Data controller
| Data controller | Mounir El Yemlahy Chouati |
|---|---|
| NIF (Spanish tax identification number) | 47289478Y |
| Address | Calle de Abtao 44, oficina 7 — 28007 Madrid (España) |
| yemla.abogados@gmail.com | |
| Telephone | +34 624 10 17 02 |
| Bar membership | Ilustre Colegio de la Abogacía de Madrid (Madrid Bar Association), No. 139.038 |
The appointment of a Data Protection Officer is not mandatory. For any privacy-related matter, you may write directly to the address indicated above.
2. What data we process and where it comes from
We process only the data that you provide to us, whether through the forms on this website or via WhatsApp, telephone, email or in a meeting, as well as the data obtained from the documentation you provide to us or that we obtain from public bodies in your name and on your behalf while handling your case.
- Identification and contact data: first name, surnames, telephone number, email address, nationality, NIE/NIF/passport.
- Case data: description of your situation, documentation provided, administrative or court decisions, time limits.
- Browsing data: those described in the Cookie Policy.
Special categories of data and criminal data. Owing to the nature of the work, a case file may include data concerning health, ethnic origin or religious beliefs, or data relating to criminal offences and convictions. These data are processed on the basis of Article 9(2)(f) GDPR (establishment, exercise or defence of legal claims) and Article 10 GDPR in connection with the lawyer’s actions before the courts, and are protected by professional secrecy.
Third-party data. If you provide us with data relating to other persons (family members in a family reunification, witnesses, opposing parties), you warrant that you are entitled to disclose them to us and you undertake to inform them of this processing.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to your initial enquiry and assessing the viability of the matter | Taking steps prior to entering into a contract at the request of the data subject (Art. 6(1)(b) GDPR) |
| Providing the legal service engaged and handling your case | Performance of the services contract (Art. 6(1)(b) GDPR) |
| Issuing invoices and complying with accounting and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Due diligence regarding the prevention of money laundering, where the work falls within the scope of Ley 10/2010 (Spanish Anti-Money Laundering Act) | Legal obligation (Art. 6(1)(c) GDPR) |
| Replying to communications sent via WhatsApp, telephone or email | Legitimate interest in responding to those who contact us (Art. 6(1)(f) GDPR) |
| Measuring the website’s audience by means of analytics cookies | Consent (Art. 6(1)(a) GDPR) |
| Retaining case documentation for the defence against possible claims | Legitimate interest of the controller (Art. 6(1)(f) GDPR) |
No automated decisions producing legal effects concerning you are made. The enquiry form on this website internally sorts requests by urgency and area of law in order to prioritise responses, but every assessment of the matter is always carried out by a person; that classification produces no legal effects and does not significantly affect you.
4. Retention periods
- Enquiries that do not lead to an engagement: up to one year from the last contact, unless you request their erasure earlier.
- Client case files: for the duration of the relationship and, once it has ended, blocked for the limitation periods of any actions that may arise (as a general rule, five years under Article 1964 of the Código Civil (Spanish Civil Code), and the specific periods applicable to professional liability).
- Accounting and tax documentation: the periods required by commercial and tax legislation (as a general rule, between four and six years).
- Documentation subject to Ley 10/2010 on the prevention of money laundering: ten years.
- Browsing data: according to the duration of each cookie, as detailed in the Cookie Policy.
5. Recipients of the data
Your data are not sold or transferred for commercial purposes. They may be disclosed to:
- Public administrations and judicial bodies where necessary to handle your case or where there is a legal obligation to do so: Immigration Offices (Oficinas de Extranjería), Government Delegations and Sub-Delegations, the Ministry of Justice, the Directorate-General for Legal Certainty and Public Faith (Dirección General de Seguridad Jurídica y Fe Pública), the National Police, and the Courts and Tribunals.
- Court representatives (procuradores), expert witnesses, sworn translators-interpreters and other professionals whose involvement is necessary for your matter.
- Banks for the management of collections and payments.
- The firm’s tax and accounting advisers.
- Technology providers acting as data processors: the web hosting provider (Bluehost / Newfold Digital) and the email provider (Google). All of them are bound by the corresponding data processing agreement under Article 28 GDPR.
- Partner lawyers in Morocco, only where your matter so requires and with your prior knowledge (see section 6).
6. International data transfers
United States. Some technology providers (hosting, email, web analytics) may process data in the United States. Such transfers are based on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified and, failing that, on the Standard Contractual Clauses approved by the European Commission.
Morocco. Where your matter involves proceedings before Moroccan authorities or judicial bodies, it may be necessary to disclose data to partner lawyers in Morocco. Morocco is not covered by an adequacy decision of the European Commission. These disclosures are made on the basis of Article 49(1)(b) GDPR (transfer necessary for the performance of the contract concluded with you) and, where applicable, Article 49(1)(e) (establishment, exercise or defence of legal claims), and are limited to the data strictly necessary for the task entrusted.
WhatsApp. If you decide to contact us via WhatsApp, the content and metadata of that conversation are also processed by Meta Platforms Ireland Ltd. in accordance with its own terms, over which this firm has no control. If you prefer not to use that channel, you can write to us by email or call us by telephone.
7. Your rights
You may exercise the following rights at any time by writing to yemla.abogados@gmail.com or to the postal address indicated, providing proof of your identity:
- Access: to know which of your data we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request that your data be deleted when they are no longer necessary.
- Objection: to object to processing based on legitimate interest.
- Restriction: to request that processing be suspended while a dispute is being verified.
- Portability: to receive your data in a structured and commonly used format.
- Withdraw the consent you have given, without this affecting the lawfulness of prior processing.
We will respond within one month, which may be extended by a further two months in complex cases. These rights may be restricted where retention is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
If you consider that your rights have not been properly addressed, you may lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency; C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
8. Security and professional secrecy
We apply appropriate technical and organisational measures to protect your data, including encryption of the website by means of a TLS certificate, access control over documentation and the restriction of processing to strictly necessary staff.
Irrespective of data protection legislation, all the information you entrust to us is protected by the lawyer’s duty of professional secrecy (Article 542.3 of the Ley Orgánica del Poder Judicial, the Spanish Organic Act on the Judiciary), which is indefinite and does not cease when the engagement ends.
9. Minors
This website is not directed at children under the age of fourteen, and their data are not knowingly collected through the forms. Where the matter concerns a minor—for example, in a family reunification or in measures concerning parent-child relations—the data are provided by their parents or legal representatives.
10. Changes to this policy
This policy may be updated to adapt it to regulatory changes or to changes in the processing carried out. The version in force is always the one published on this page.
Last updated: 8 September 2026.