This policy explains what personal data we process, why we use it and how you can exercise your rights.

1. Data controller

  • Controller: LULLIUS PARTNERS, S.L.
  • Spanish tax identification number (CIF): B09759051
  • Registered address: Carrer del Sindicat, nº 69-6ºC, Edificio Santander, 07002 Palma de Mallorca, Illes Balears, Spain
  • Telephone: +34 871 00 21 51
  • Email: info@lullius.com

2. Data we may process

Depending on your relationship with Lullius, we may process the following categories of data:

  • Identification and contact details, such as your name, email address, telephone number, country or jurisdiction.
  • Professional or business information needed to assess an enquiry or provide a service.
  • The area of your enquiry, how you heard about Lullius and the content of messages submitted through our forms.
  • Billing, compliance and anti-money laundering information where required for a professional relationship.
  • Career and professional information if you take part in a recruitment process.
  • Limited technical data connected with website security and the prevention of abusive submissions. Where possible, this data is pseudonymised or converted into identifiers that are not directly readable.

3. Purposes and legal bases

Enquiries and contact requests

We process data to receive, organise and respond to your request, assess the general nature of the matter and direct it to the appropriate professional. The legal basis is your consent and, where you ask for a proposal or service, taking steps at your request before entering into a contract.

Professional services

Where a professional relationship exists, we process data to manage the engagement, provide services, issue invoices, comply with applicable legal and professional duties and maintain necessary communications. The legal bases are performance of the contract, compliance with legal obligations and, where applicable, our legitimate interest in managing the professional relationship.

Publications and communications

If you ask to receive publications or updates, we will use your contact details to send them. The legal basis is consent, which you may withdraw at any time by using the link in each communication or emailing info@lullius.com.

Recruitment

If you submit an application, we will process the information to assess your profile and manage current or future recruitment processes. The legal basis is your consent and taking steps at your request before entering into a contract.

Security and abuse prevention

We may process limited technical information to protect the website, prevent automated or abusive submissions and maintain the security of our systems. The legal basis is our legitimate interest in maintaining secure and operational infrastructure.

Audience and advertising measurement

If you accept optional cookies, we process technical information about website use and campaign interactions to understand performance and measure advertising conversions. The legal basis is your consent, which you may withdraw at any time through “Cookie settings” in the footer.

We do not make automated decisions that produce legal effects and we do not create commercial profiles from data collected through the website.

4. Enquiries and confidentiality

Submitting an enquiry does not in itself create a professional relationship. To protect your information, include only the data required for us to understand the general nature of the matter. Do not send particularly sensitive documents until a member of Lullius has confirmed the appropriate channel.

5. Recipients and service providers

We do not sell personal data or disclose it for third-party commercial purposes. Data may be disclosed where required by law, necessary to provide a requested service or processed by service providers acting on behalf of Lullius.

We currently use the following providers to operate the website and manage communications:

  • Cloudflare and Sites: hosting, infrastructure, security and technical storage for the website and enquiries received.
  • Brevo: delivery of form enquiries, confirmations and authorised electronic communications.
  • Microsoft 365: corporate email, receipt of communications and internal productivity tools.
  • Google Tag Manager and Google Ads: management of measurement tags and assessment of advertising conversions, only in accordance with your cookie choice.

We may also use professional, technological or administrative providers that are subject to confidentiality and data protection obligations.

Where a provider processes data outside the European Economic Area, the transfer will be made under an adequacy decision of the European Commission, standard contractual clauses or another safeguard permitted by applicable law.

6. Retention

Data will be retained for as long as necessary for the purpose for which it was collected and subsequently for the periods required to comply with legal obligations or address potential liabilities.

Publication subscriptions will be retained until you withdraw your consent. Client and matter information will be kept for the applicable legal and professional periods. Recruitment data will be reviewed periodically and deleted when it is no longer useful for recruitment purposes.

7. Your rights

You may request access to, rectification or erasure of your data, object to or restrict processing, request portability and withdraw your consent at any time.

To exercise your rights, email info@lullius.com or write to Carrer del Sindicat, nº 69-6ºC, Edificio Santander, 07002 Palma de Mallorca, stating the right you wish to exercise. We may request the information strictly necessary to verify your identity.

If you believe that the processing does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency.

8. Security

Lullius applies technical and organisational measures designed to protect data against unauthorised access, loss, alteration or improper disclosure. Internal access is limited to people who need the information for the purposes described above.

9. Updates

This policy may be updated to reflect changes in law, technology or our processing activities. The version published on this page will always be the current version.

Last updated: 26 July 2026.