You will know how far the GDPR reaches you and receive the documents you need.
§ 1
Approach
We will analyse whether your activity falls within the GDPR and to what extent, so that you comply with what applies to you and nothing more.
We will determine whether you must appoint a representative in the Union and on what basis each data flow will travel to your country.
We will draft the record of processing, the contracts and your website texts from the real map of your data.
§ 2
Engagement
El importe exacto se cierra en la hoja de encargo antes de pagar, con los gastos previsibles incluidos. Si el encargo se alarga, no pagas más.
§ 3
Process
A unilateral confidentiality agreement signed by PASSAS before the video consultation, available at no additional cost on request. It binds the firm alone — no signature is required from the client — and adds an explicit contractual layer on top of the professional secrecy obligations inherent to the practice of law.
A 60-minute working session by video call in which we analyse your situation, your specific needs and our ability to help you. We assess whether we can take on the matter and give you the fixed price in advance. You can book it directly through the Google Calendar link on our website and pay €90 by Stripe.
A technical inventory of the real path personal data takes through the product: forms, SDKs, cookies and trackers, APIs, suppliers and AI tools, server locations and transfers outside the EEA. It is built by inspecting the website, the app and their traffic, and it flags every point where what happens and what the privacy policy declares do not match.
Legal analysis of the business model that determines which rules affect the company, what legal risks exist and what documentation is mandatory before operating. Covers the sectoral regulatory framework, data protection obligations, essential contracts and any applicable authorisation or licensing requirements.
The documentation required for GDPR compliance and, more broadly, for any rules on data protection and on the processing and transfer of data, including international transfers, both in dealings with users and with the providers that process data on your behalf, with the legal mechanisms needed to operate without regulatory exposure.
The legal documentation required to operate online: legal notice, privacy policy, cookie policy and, where applicable, terms of sale. Drafted with legal precision and adapted to the specific activity, not carried over from another website. Complies with the GDPR and with information society services rules.
§ 4
Team
I see legal practice as a discipline of precision. I work where the law meets technology and cross-border operations, and I read code and contracts with the same attention. Before accepting an engagement I tell you whether it is worth pursuing and what it costs, at a fixed price.
§ 5
Questions
Yes, where it offers goods or services to people located in the Union or monitors their behaviour, regardless of where the company is incorporated and of whether it charges for the service. That is the test in article 3(2). Establishing whether your activity falls within it, and how far, is the first part of the engagement.
Article 27 requires it of controllers and processors outside the Union that fall within the Regulation, subject to a narrow exemption for occasional processing that does not involve special category data on a large scale and is unlikely to result in risk. The exemption is invoked more casually than its wording allows, and relying on it takes a documented analysis rather than an assumption.
It depends on whether the Commission has adopted an adequacy decision. Where it has not, transfers rest on standard contractual clauses supported by a transfer impact assessment, a requirement that follows from the Schrems II judgment. For the United States, the EU-US Data Privacy Framework is also available to certified entities. The engagement establishes which basis supports each flow and leaves the supporting documentation built.
Software organises records and automates notices. What it does not resolve is the legal characterisation underneath: what data you process, on what lawful basis, in which contractual role, and under which supervisory authority. That determination is signed by a lawyer admitted to the Bar, carries professional liability and is covered by legal professional privilege. It is also the part a supervisory authority will test.
From €4,500 + VAT, delivered within two weeks, at a fixed price agreed in the engagement letter before you pay. The exact figure depends on the number of processing activities and the complexity of your international flows. If your situation fits, you can book a 60 minute Virtual Consultation for €90 (VAT included), deductible from the first invoice if we go on to accept the engagement.
Sixty minutes on Google Meet with a qualified lawyer. It costs €90 including VAT and will be deducted from the first invoice if an engagement follows.
