You will receive the real map of your data and the documentation behind it.
§ 1
Approach
We will inspect the website, the app and their traffic before reading a single document, to see every SDK, every pixel and every supplier that receives data.
We will check under which contract and on what basis each flow travels, including when it ends up in the United States.
The record of processing, the processor agreements and the website texts will be drafted from that map, so that what you declare matches what you do.
§ 2
Engagement
El importe exacto se cierra en la hoja de encargo antes de pagar, con los gastos previsibles incluidos. Si el encargo se alarga, no pagas más.
§ 3
Process
A unilateral confidentiality agreement signed by PASSAS before the video consultation, available at no additional cost on request. It binds the firm alone — no signature is required from the client — and adds an explicit contractual layer on top of the professional secrecy obligations inherent to the practice of law.
A 60-minute working session by video call in which we analyse your situation, your specific needs and our ability to help you. We assess whether we can take on the matter and give you the fixed price in advance. You can book it directly through the Google Calendar link on our website and pay €90 by Stripe.
A technical inventory of the real path personal data takes through the product: forms, SDKs, cookies and trackers, APIs, suppliers and AI tools, server locations and transfers outside the EEA. It is built by inspecting the website, the app and their traffic, and it flags every point where what happens and what the privacy policy declares do not match.
Legal analysis of the business model that determines which rules affect the company, what legal risks exist and what documentation is mandatory before operating. Covers the sectoral regulatory framework, data protection obligations, essential contracts and any applicable authorisation or licensing requirements.
The documentation required for GDPR compliance and, more broadly, for any rules on data protection and on the processing and transfer of data, including international transfers, both in dealings with users and with the providers that process data on your behalf, with the legal mechanisms needed to operate without regulatory exposure.
The legal documentation required to operate online: legal notice, privacy policy, cookie policy and, where applicable, terms of sale. Drafted with legal precision and adapted to the specific activity, not carried over from another website. Complies with the GDPR and with information society services rules.
§ 4
Team
I see legal practice as a discipline of precision. I work where the law meets technology and cross-border operations, and I read code and contracts with the same attention. Before accepting an engagement I tell you whether it is worth pursuing and what it costs, at a fixed price.
§ 5
Questions
A standard package starts from a questionnaire and delivers templates. This audit starts from the product as it runs: we inspect the website, the app and their traffic to find out what data leaves, to whom and on what basis. The documents are drafted afterwards, from what we found.
Access to the live website and app, the list of suppliers you know about and someone on your technical team for occasional questions. Everything else we obtain by inspecting the product.
If the audit finds processing that requires one (article 35 GDPR), we flag it and the engagement letter prices it separately, because its scope depends on the specific processing.
From €3,500 + VAT, delivered within three weeks. The exact figure is fixed in the engagement letter before you pay, and depends on the number of products, suppliers and international flows.
Then the right engagement is GDPR for Non-EU Companies, which adds the article 3(2) analysis, the EU representative and transfers to your country.
Sixty minutes on Google Meet with a qualified lawyer. It costs €90 including VAT and will be deducted from the first invoice if an engagement follows.
