Privacy Policy

At Forenlab we respect your privacy and are committed to processing your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

• Controller: Juan Jesús Merino Carretero (Forenlab Computer Forensics Experts).
• Tax ID (NIF): 08862315R
• Professional registration: registered member no. 89 of the Colegio Profesional de Ingenieros en Informática de Extremadura (CPIIEX).
• Registered address: Campus Universitario, Avda. de la Investigación S/N, Edificio PCTEX, Oficina 2.1 — 06006 Badajoz (Spain).
• LOPDGDD contact email: [email protected]
• Phone: +34 924 09 06 08

2. Purposes of processing

We process your personal data for the following purposes:

• Handling inquiries and quote requests received through the website’s contact forms (data: name, email, optional phone number, subject, message).
• Handling job applications when you send us your CV or professional information through the careers form.
• Provision of computer forensics expert and digital forensics services if you hire our services (contract data, digital evidence provided, billing data).
• Compliance with legal obligations, tax and procedural, applicable to our professional activity.
• Analysis of website usage through analytics tools (only if you have given your consent in the cookie banner).

3. Legal basis for processing

• Consent of the data subject when submitting the form and accepting the GDPR clause.
• Performance of a contract in the provision of expert services.
• Compliance with a legal obligation (invoicing, anti-money-laundering, responding to court orders).
• Legitimate interest of Forenlab in maintaining the security of the website and preventing fraud.

4. Retention periods

• Data from inquiries that do not lead to a contract: up to 12 months from the last contact, unless a prior request for erasure is made.
• Job application data: up to 1 year from receipt, unless the candidate requests erasure.
• Contract and tax data: the legally required period (at least 6 years from the end of the contractual relationship under the Spanish Commercial Code).
• Data from expert engagements: the legally required period and for as long as professional liability may arise.

5. Recipients of the data

Your personal data will not be disclosed to third parties except where legally required or where necessary for the performance of the contract (for example, submitting the expert report to the competent court). As data processors we may use the following providers:

• Cloudflare, Inc. (USA) — hosting and CDN of the site. International transfer covered by Standard Contractual Clauses approved by the European Commission.
• Formspree, Inc. (USA) — management and delivery of the site’s forms. International transfer covered by Standard Contractual Clauses.
• Google LLC (USA) — Google Analytics 4 and Google Tag Manager (only if you have given your consent). Policy: policies.google.com/privacy.
• Microsoft Corporation (USA) — Microsoft Clarity (only if you have given your consent). Policy: privacy.microsoft.com.

6. Data subject rights

You may exercise the following rights at any time:

• Access: find out what data of yours we process.
• Rectification: request correction of inaccurate data.
• Erasure (right to be forgotten): ask for your data to be deleted when it is no longer necessary.
• Restriction: request restriction of processing.
• Portability: receive your data in a structured format.
• Objection: object to processing based on legitimate interest.
• Not to be subject to automated individual decision-making.
• Withdraw consent at any time.

To exercise these rights, send an email to [email protected] stating the right you wish to exercise and attaching a copy of your national ID (DNI) or equivalent document. We will reply within a maximum of one month.

7. Complaint to the Supervisory Authority

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Security

We apply appropriate technical and organizational measures to guarantee the confidentiality, integrity and availability of personal data, including HTTPS encryption on all communications of the website.

9. Changes

Forenlab reserves the right to modify this Policy to adapt it to legislative changes. Changes will be published on the website with the date of the update.