Version 3.0 | March 2026

Privacy Policy

ILEXUM GROUP, as data controller, is committed to protecting the privacy and personal data of users who access our website. This Privacy Policy aims to provide clear, precise, and comprehensive information about how we process personal data, in strict compliance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD), and Royal Decree 1720/2007. Access to and browsing of this website constitutes full and unambiguous acceptance of the practices described herein.

ARTICLE 1. — IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

Corporate name: ILEXUM GROUP
Registered office: [Full address]
Contact email: info@ilexumgroup.com
Data Protection Officer (DPO): dpo@ilexumgroup.com
Mercantile Registry of Madrid, Volume [X], Sheet [X], Page [M-XXXXX], Entry [X].
Company Tax ID (CIF/NIF): [X-XXXXXXXX]
Users may contact the Data Protection Officer regarding any matter relating to the processing of their personal data at dpo@ilexumgroup.com.

ARTICLE 2. — PERSONAL DATA WE COLLECT AND SOURCE

2.1. Data provided directly by the data subject:
• Contact forms: full name, email address, phone number, company, position, and message content.
• Service requests: identification data, case-related data, and documentation voluntarily provided.
• Emails and communications: content of the communication and associated metadata (date, time, sender).
• Contracts and contractual documentation: data necessary for the execution of the professional services agreement.
2.2. Data collected automatically during browsing:
• IP address and navigation data (Google Analytics, with anonymized IP addresses).
• Device type, operating system, and browser used.
• Date and time of access, pages visited, time spent on each page.
• Traffic source (search engine, direct access, campaign).
2.3. Data from public sources: ILEXUM GROUP does not collect data from public sources without the prior consent of the data subject.
2.4. Special categories of data (Article 9 GDPR) are not requested. Should the data subject voluntarily provide such data in the context of a contracted service and should it be strictly necessary for the requested forensic analysis, enhanced protection measures under Article 32 GDPR shall apply.

ARTICLE 3. — PURPOSES OF PROCESSING AND APPLICABLE LEGAL BASIS

3.1. Management of inquiries and information requests:
Purpose: To handle and manage inquiries received through the contact form, email, or any other communication channel.
Legal basis: Performance of pre-contractual measures (Article 6.1.b GDPR).
3.2. Provision of contracted professional services:
Purpose: To execute the professional services agreement, which may include:
• Preparation of judicial and extrajudicial expert reports.
• Forensic analysis of electronic devices and digital storage media.
• Recovery and preservation of digital evidence with chain of custody documentation.
• Technical and technological advisory services in judicial proceedings.
• Preparation of expert opinions for courts and organizations.
Legal basis: Contract execution (Article 6.1.b GDPR). For special categories of data that may be processed, additional legal basis: Article 9.2.f GDPR (establishment, exercise, or defence of legal claims).
3.3. Compliance with legal obligations:
Purpose: To comply with applicable tax, accounting, and anti-money laundering obligations.
Legal basis: Legal obligation (Article 6.1.c GDPR). Applicable legislation: General Tax Law, Audit Law, Law 10/2010 on money laundering prevention.
3.4. Sending of commercial communications:
Purpose: To inform about new services, events, specialized publications, and relevant developments in the field of computer forensics and cybersecurity.
Legal basis: Explicit consent of the data subject (Article 6.1.a GDPR and Article 21 LOPDGDD).
Note: Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
3.5. Legitimate interest:
Purpose: To ensure website security, prevent unauthorized access, detect malware and fraudulent activity, and conduct statistical analysis for continuous service improvement.
Legal basis: Legitimate interest of the controller (Article 6.1.f GDPR), provided that the interests or fundamental rights of the data subject do not prevail.

ARTICLE 4. — CATEGORIES OF PERSONAL DATA PROCESSED

4.1. Identification data: full name, national ID card (DNI/NIF), signature (manual and electronic).
4.2. Contact data: email address, phone number, postal address.
4.3. Digital identification data: IP address, cookies, navigation logs, timestamps.
4.4. Professional and employment data: company or organization, position, professional sector, role, area of expertise.
4.5. Economic and financial data: billing data, bank account number (exclusively for payment management), payment history.
4.6. Transaction and service data: description of contracted service, attached documentation, correspondence related to the forensic case.
4.7. Special categories of data: as indicated in Article 2.4, these are only processed when the data subject voluntarily provides them in the context of a contracted service and they are strictly necessary for the requested forensic analysis. Enhanced safeguards apply in such cases.

ARTICLE 5. — DATA RECIPIENTS AND INTERNATIONAL TRANSFERS

5.1. Recipients with access to your data:
Personal data may be disclosed to the following categories of recipients, always in compliance with the principles set forth in Article 5 GDPR:
a) Public Administrations and judicial bodies:
• State Tax Administration Agency (AEAT).
• General Treasury of Social Security.
• Mercantile Registry of Madrid.
• Courts and Tribunals of Justice (in legal proceedings where ILEXUM GROUP acts as an expert).
• Public Prosecutor's Office and competent authorities in criminal investigation matters.
b) Data processors (Article 28 GDPR):
• Hosting and cloud infrastructure provider: [Provider name], with whom a data processing agreement has been formalised in accordance with Article 28 GDPR.
• Google LLC (Google Analytics): for web statistical analysis, with anonymised data. Transfer governed by Standard Contractual Clauses.
• Email marketing service provider: [Name], with a data processing agreement in place.
c) External professional collaborators:
• Party-appointed experts and collaborators in judicial expert proceedings.
• Law firms and legal representatives when necessary for the provision of services.
• Independent technical experts contracted for specialised work.
5.2. International transfers:
ILEXUM GROUP does not transfer personal data outside the European Economic Area (EEA), except where necessary for the provision of web analytics services with Google LLC, which are subject to the Standard Contractual Clauses adopted by the European Commission. Additional information on these transfers may be requested at dpo@ilexumgroup.com.
5.3. No sale or rental of personal data to third parties is carried out under any circumstances.

ARTICLE 6. — DATA RETENTION PERIODS

Personal data shall be retained for the periods indicated below, or until the data subject exercises the right to erasure, and shall be securely deleted once the applicable retention period has elapsed:
a) Contact and inquiry data: 2 years from the date of last interaction, unless the data subject requests earlier deletion.
b) Customer data and contractual documentation:
• Throughout the entire duration of the professional services agreement.
• For 6 years following contract termination, in compliance with tax and accounting obligations (Article 1964 Civil Code, Article 30 Commercial Code).
• Expert reports, opinions, and associated documentation shall be retained for a minimum of 10 years from the date of issuance, due to professional liability considerations and potential evidentiary needs in judicial proceedings.
c) Data processed based on consent for commercial communications: until the data subject validly withdraws consent.
d) Navigation and analytical cookies data: 12 months from collection, in accordance with AEPD guidelines.
e) Accounting and invoice data: 10 years from document issuance, pursuant to Article 30 of the Commercial Code.

ARTICLE 7. — DATA SUBJECT RIGHTS

ILEXUM GROUP informs users that they may exercise the following rights against the data controller, as established in Articles 15 to 22 GDPR:
7.1. Right of access (Article 15 GDPR): Obtain confirmation as to whether personal data concerning them are being processed and, where that is the case, access to such data together with the following information: purposes of the processing, categories of data concerned, recipients, retention period, data source, and existence of automated decision-making.
7.2. Right to rectification (Article 16 GDPR): Request the correction of inaccurate data or the completion of incomplete data, including by means of a supplementary statement.
7.3. Right to erasure (Article 17 GDPR): Request the erasure of personal data where one of the following applies: the data are no longer necessary for the purposes for which they were collected; the consent is withdrawn and there is no other legal basis; the data subject exercises the right to object and there are no overriding legitimate grounds; the data have been unlawfully processed; the data must be erased for compliance with a legal obligation.
7.4. Right to restriction of processing (Article 18 GDPR): Request the restriction of processing in the cases provided for by law, in which case data shall only be retained for the exercise or defence of legal claims.
7.5. Right to data portability (Article 20 GDPR): Receive the personal data provided in a structured, commonly used, and machine-readable format, and transmit those data to another controller without hindrance, where processing is based on consent or contract and is carried out by automated means.
7.6. Right to object (Article 21 GDPR): Object to processing based on legitimate interest or public interest, as well as to processing for direct marketing purposes.
Exercising rights:
To exercise any of these rights, the data subject shall send a written request to:
• Email: dpo@ilexumgroup.com (subject: "GDPR Rights Exercise")
• Postal mail: [Address], enclosing a copy of the national ID card (DNI/NIF) or equivalent identity document.
ILEXUM GROUP shall respond to requests within a maximum period of one (1) month from receipt, in accordance with Article 12.3 GDPR.
Complaint: Without prejudice to any other administrative remedy or legal action, the data subject has the right to lodge a complaint with the competent Supervisory Authority — the Spanish Data Protection Agency (AEPD) — where they consider that the processing of their personal data infringes applicable law. Further information: www.aepd.es.

ARTICLE 8. — TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

ILEXUM GROUP implements appropriate technical and organisational security measures to ensure a level of security appropriate to the risk of processing, in compliance with Article 32 GDPR and the National Security Framework (ENS).
8.1. Technical measures:
• Data encryption in transit via SSL/TLS protocol (HTTPS) with commercial-grade encryption.
• Data encryption at rest using AES-256 or superior encryption algorithms.
• Application-layer firewalls (WAF) and intrusion detection and prevention systems (IDS/IPS).
• Automated daily backups with encrypted storage in secure data centres.
• Enterprise-grade antivirus and anti-malware software, periodically updated.
• Systematic application of critical security patches within a maximum of 72 hours of release.
• Network segmentation and role-based access control (RBAC).
• Continuous security monitoring and real-time alerting.
• Access logs with verifiable timestamps (audit logs).
8.2. Organisational measures:
• Restricted access to personal data, granted exclusively according to the principle of least privilege.
• Formalised confidentiality agreements with all employees and collaborators.
• Mandatory annual training programme on personal data protection and information security for all staff.
• Documented information security incident management procedures.
• Data Protection Impact Assessments (DPIA) carried out prior to any high-risk processing, in accordance with Article 35 GDPR.
• Periodic security measure review at least annually.
• Secure data destruction policy for personal data no longer required (shredding or secure overwriting).
8.3. Security breach management:
In the event of a security breach affecting personal data, ILEXUM GROUP shall notify the competent Supervisory Authority (AEPD) within a maximum period of 72 hours from becoming aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of individuals, affected users shall also be notified directly, providing clear information on the nature of the breach and the corrective measures adopted.

ARTICLE 9. — COOKIE POLICY

This website uses own and third-party cookies as described in the Cookie Policy, available at /en/cookies and accessible from any point of the site.
Summary of cookies used:
• Technical (necessary) cookies: essential for website functionality; temporarily stored during the session.
• Analytics cookies: Google Analytics (_ga, _gid), with anonymised data and truncated IP addresses; 12-month duration.
• Preference cookies: selected language and user settings; 12-month duration.
• Marketing cookies: only activated after explicit user consent is obtained.
You may manage your cookie preferences at any time through the configuration panel accessible from the initial banner or by modifying your browser settings. Please note that disabling essential cookies may affect the proper functioning of the website.

ARTICLE 10. — MINORS

Services offered by ILEXUM GROUP are exclusively aimed at adults.
ILEXUM GROUP does not knowingly collect personal data from individuals under 16 years of age. Should we become aware that data from a minor under 16 has been collected without the relevant age verification, we shall proceed with its immediate deletion without delay.
If you are a parent, legal guardian, or custodian of a minor and believe that they have provided personal data to ILEXUM GROUP, please contact us promptly at: dpo@ilexumgroup.com

ARTICLE 11. — MODIFICATIONS TO THIS POLICY

ILEXUM GROUP reserves the right to modify this Privacy Policy to adapt to legislative changes, instructions or guidelines from the AEPD, changes in services provided, modifications to the corporate structure, or any other circumstance that makes it necessary.
Any modification shall be published on this same page with express indication of the last update date. Periodic review of this document is recommended to check for possible changes.
The current policy is the one published on the date indicated at the beginning of this text. Use of the website following the publication of modifications constitutes express acceptance of such modifications by the user.

ARTICLE 12. — APPLICABLE LAW AND JURISDICTION

This Privacy Policy shall be governed by applicable Spanish and European Union legislation, and in particular by:
• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
• Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
• Royal Decree 1720/2007, of 21 December, approving the Implementing Regulations of the LOPDGDD.
• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE).
For any dispute arising from the interpretation, application, or compliance with this Privacy Policy, the parties, with express waiver of any other jurisdiction that may correspond, submit to the Courts and Tribunals of Madrid capital.
Without prejudice to the above, users have the right to access the extrajudicial dispute resolution mechanisms established by European Union law, particularly the ODR (Online Dispute Resolution) Platform: https://ec.europa.eu/consumers/odr/.