Last updated: 16/01/2026

KEPLER-KARST Law Firm, S.L.P. (“KEPLER-KARST”) is committed to protecting and respecting your privacy. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, through our website (the “Website”) will be processed.

1. Information and Contact Details of the Data Controller

The data controller responsible for the processing of your personal data is KEPLER-KARST LAW FIRM, S.L. (hereinafter, “KEPLER-KARST”), with Tax Identification Number (C.I.F.) B88632203, and registered office at Paseo de la Castellana 141, 3rd floor, 28046, Madrid, Spain. The company is duly registered with the Commercial Registry of Madrid, Volume 40,400, Page 101, Sheet M-717656. You may contact us by email at info@keplerkarst.com or by telephone at +34 911 095 710.

2. Data Protection Officer (DPO)

KEPLER-KARST has appointed a Data Protection Officer (DPO), whom you may contact for any matter relating to the processing of your personal data or the exercise of your rights.

You may contact the DPO at the following email address: dpo@keplerkarst.com

3. Detailed Information on Data Processing Activities

When browsing the KEPLER-KARST Website and/or communicating electronically with us, personal data relating to each user may be collected and processed in accordance with this Privacy Policy.

3.1. Website Browsing

• Data Processed: IP address, connection data, browser and device type, and other technical data collected through cookies and similar technologies (for further information, please consult our Cookies Policy).
• Purpose: To enable and facilitate your browsing of the Website, and to manage and optimize its technical performance and security.
• Legal Basis: The implementation, at your request, of pre-contractual measures (Article 6(1)(b) GDPR), insofar as the queries made fall within the scope of a potential engagement of legal services.
• Retention Period: Session data will be retained only for the duration of your browsing session. Aggregated and anonymized data used for statistical purposes will be retained indefinitely.

3.2. Information Requests (Contact Form / Email)

• Data Processed: First name, last name, email address, company, and any other information you voluntarily provide in the body of your message.
• Purpose: To manage, process and respond to your request for information, inquiry or request for professional services.
• Legal Basis: Your consent (Article 6(1)(a) GDPR), granted by voluntarily submitting your inquiry. Where your inquiry relates to the potential engagement of our services, the legal basis may be the implementation of pre-contractual measures at your request (Article 6(1)(b) GDPR).
• Retention Period: Data will be retained for the time strictly necessary to address your request. Once resolved, the data will be blocked and retained for the applicable statutory limitation periods for potential legal liabilities.

3.3. Subscription to Publications and Communications (Newsletters)

• Data Processed: EFirst name, last name, email address, company, and any other information you voluntarily provide in the body of your message.
• Purpose: To send you our legal publications, newsletters, event invitations and other communications regarding KEPLER-KARST’s activities and developments that may be of interest to you.
• Legal Basis: Your explicit consent (Article 6(1)(a) GDPR), granted when you subscribe. If you are already a client of KEPLER-KARST, we may send you commercial communications relating to services similar to those you have previously contracted, based on our legitimate interest in accordance with Article 21.2 of the Spanish Information Society Services Act (LSSI), always providing a simple and free means to object to such communications.
• Retention Period: Your data will be processed for this purpose until you withdraw your consent or exercise your right to object.

3.4. Recruitment Processes (Job Applications)

• Data Processed: Identification and contact details, academic and professional background, and any other information included in your curriculum vitae.
• Purpose: To assess your professional profile for the position applied for and, where applicable, for future vacancies matching your profile.
• Legal Basis: The implementation, at your request, of pre-contractual measures with a view to entering into an employment relationship (Article 6(1)(b) GDPR) for the ongoing recruitment process. For the retention of your CV for future opportunities, your explicit consent will be requested (Article 6(1)(a) GDPR).
• Retention Period: Your data will be retained for the duration of the recruitment process for which you applied. If you consent to consideration for future opportunities, your CV will be retained for a maximum period of 24 months, after which it will be securely deleted.

3.5. Event Registration and Attendance

• Data Processed: First name, last name, company, job title and email address.
• Purpose: To manage your registration and attendance at the event, and to send you related documentation and communications. Please note that photographs and/or audiovisual recordings may be taken during the event for informational and promotional purposes related to KEPLER-KARST’s activities, to be published on our communication channels (website, social media, publications). Your registration is understood as you granting your consent for KEPLER-KARST to use the photographs and/or audiovisual recordings that may be taken during the event.
• Legal Basis: Your consent (Article 6(1)(a) GDPR), granted by voluntarily registering for the event.

4. Data Disclosure and International Transfers

As a general rule, KEPLER-KARST will not disclose your personal data to third parties unless required by law.

However, for the provision of certain ancillary services (such as web hosting, email marketing platforms or event management tools), we may engage service providers (data processors) who require access to your data in order to provide their services. KEPLER-KARST ensures that all such providers comply with applicable data protection regulations and enters into the corresponding data processing agreements with them.

Some of these providers may be located outside the European Economic Area (EEA). In such cases, KEPLER-KARST will ensure that international data transfers are carried out subject to one of the appropriate safeguards provided for under the GDPR, such as the execution of Standard Contractual Clauses approved by the European Commission, thereby ensuring a level of data protection equivalent to that of the European Union.

5. Exercise of Your Rights

You have the right to:

• Access your personal data.
• Request the rectification of inaccurate data.
• Request erasure where, among other reasons, the data is no longer necessary for the purposes for which it was collected.
• Object to the processing of your data.
• Request the restriction of processing.
• Exercise your right to data portability.
• Withdraw your consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

You may exercise these rights free of charge by sending a written request, together with a copy of your ID card or equivalent identification document, to our Data Protection Officer at dpo@keplerkarst.com or by post to our registered office address.

Additionally, if you believe that the processing of your personal data does not comply with applicable data protection regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

6. Security Measures

KEPLER-KARST has adopted and maintains the necessary technical and organizational security measures to ensure the security, confidentiality, integrity, availability and resilience of the personal data it processes, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons. Nevertheless, users should be aware that security measures on the Internet are not infallible.

7. Updates to the Privacy Policy

KEPLER-KARST reserves the right to amend this Privacy Policy in order to adapt it to legislative or case law developments, or to new industry practices. Any changes will be duly published on this Website, indicating the date of the latest update at the top of the document. We recommend that you review this Policy periodically to remain properly informed.