1. Data Controller
Granex SL (in incorporation), based in Granada, Spain. Contact: privacidad@granex.es
2. Data Collected
We collect data you provide when creating an account (name, email, firm) and data you enter to manage your practice (clients, cases, documents). We never sell your data to third parties.
3. Legal Basis
Processing is based on (a) contract performance, (b) legitimate interest in improving the product, and (c) explicit consent where requested.
4. Retention
We retain your data while your contract is active. After cancellation, we keep data for the legally required period (up to 6 years for tax obligations) then permanently delete it.
5. Subprocessors
Your data is processed by the following providers, all with signed DPAs and EU servers or Standard Contractual Clauses: Supabase Ireland Ltd (database, EU), Anthropic Inc (AI, USA with SCCs), Resend Inc (email, EU), Vercel Inc (hosting, EU).
6. International Transfers
Anthropic operates from the USA. Transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission, compliant with GDPR.
7. Your Rights
You have rights of Access, Rectification, Erasure, Objection, Restriction, and Portability. To exercise them, write to privacidad@granex.es with your request and a copy of your ID.
8. Complaints
If you believe processing is non-compliant, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).