Legal documents
Privacy policy
Information on the processing of personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).
Last updated:
Data controller
- Controller
- Óscar Rosa P.
- Trading name
- ORP Investigaciones
- Privacy contact
- contacto@orp-investigaciones.com
- Registration
- RNSP 11659 · Licence 6333
Should the volume or nature of the processing require it, a Data Protection Officer will be appointed and their contact details published in this section.
What we process
We process personal data in three clearly distinct contexts. The legal bases and retention periods differ in each.
1. Enquiries received through the form or by email
| Data | Name or alias, telephone, email address, type of investigation and the case summary you choose to provide. |
|---|---|
| Purpose | To handle your enquiry, assess whether the instruction is viable, and reply to you. |
| Legal basis | Consent of the data subject (art. 6(1)(a) GDPR) and pre-contractual steps taken at your request (art. 6(1)(b) GDPR). |
| Retention | Up to one year from the last contact if the enquiry does not lead to an instruction. If it does, processing no. 2 applies. |
We expressly ask that you do not include sensitive data or identifying details of third parties in the form. General context is enough for us to assess a case; the rest is handled in a confidential conversation.
2. Clients who formalise an instruction
| Data | Identification, contact and billing data, and whatever is needed to evidence the legitimate interest in the investigation. |
|---|---|
| Purpose | To carry out the instruction, issue the investigation report, invoice, and meet legal, accounting and tax obligations. |
| Legal basis | Performance of a contract (art. 6(1)(b) GDPR) and compliance with legal obligations (art. 6(1)(c) GDPR). |
| Retention | Investigation reports are kept archived for a minimum of three years, under article 49.4 of Private Security Act 5/2014. Recorded images and sound are destroyed three years after the investigation ends, unless connected with court, police or disciplinary proceedings. Accounting and tax records, for the applicable statutory limitation periods. |
3. Persons under investigation
Private investigation inherently involves processing data about people who are not our clients and who have not provided that data to us directly.
| Data | Strictly what is necessary and proportionate to the instruction, obtained from publicly accessible sources, public registers, information supplied by the client, and direct observation in public or publicly accessible places. |
|---|---|
| Purpose | To obtain and provide evidence of private conduct or facts relating to an established legitimate interest, within the framework of Spanish Act 5/2014 on Private Security. |
| Legal basis | The client's legitimate interest in obtaining evidence to exercise or defend their rights (art. 6(1)(f) GDPR), subject to a balancing test in each case, together with the enabling framework of private security legislation. |
| Retention | A minimum of three years, the period imposed by article 49.4 of Private Security Act 5/2014. Thereafter, the material is erased by certified destruction. |
Limits we impose on ourselves: we do not investigate events occurring in private or restricted places, we do not process special categories of data unless strictly indispensable and proportionate, and we decline the instruction where legitimate interest is not established.
The information owed to the person under investigation under article 14 GDPR may be subject to exception where providing it would render impossible or seriously impair the achievement of the objectives of the processing, under article 14(5) GDPR. This exception is assessed case by case and ceases when its justification does.
4. Website audience measurement
| Data | Pages visited, referring source, device type and anonymised IP address. No identifying data. |
|---|---|
| Purpose | Knowing how many people visit the site and where they come from, in order to improve it. |
| Legal basis | Legitimate interest (art. 6(1)(f) GDPR) in understanding use of our own website, with anonymised data and no profiling. |
| Retention | Thirteen months for raw data. Beyond that, only aggregated, anonymous counts remain. |
| Recipients | None. The tool runs on our own server and the data is not disclosed to third parties. |
Recipients
We do not sell, transfer or share data for commercial, advertising or profiling purposes. Data may be disclosed only to:
- The client instructing the investigation, as recipient of the report.
- Courts, tribunals, law enforcement and public authorities, where legally required.
- The client's legal representatives, where the client expressly so instructs.
- Suppliers acting as processors (web hosting, email, accountancy), under a contract compliant with article 28 GDPR.
International transfers
This site may load typefaces from the Google Fonts service. That request means your IP address is communicated to Google LLC (United States), so it only happens if you authorise it beforehand from the privacy settings panel. Google adheres to the EU-US Data Privacy Framework, in respect of which the European Commission has adopted an adequacy decision.
Technical recommendation not yet applied: self-hosting the typefaces removes this third-party communication entirely.
Beyond this, no international data transfers take place. Hosting and email services are contracted, wherever possible, with providers processing data within the European Economic Area.
Professional privilege
The private detective is bound by a duty of secrecy in respect of information obtained in the course of their work, under private security legislation. This duty survives completion of the instruction and is independent of data protection obligations.
Communications with the client are encrypted, case files are compartmentalised, and access is restricted to the personnel assigned to each case.
Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to contacto@orp-investigaciones.com stating the right you wish to exercise and enclosing a copy of a document proving your identity. We will respond within one month, extendable by a further two months where the request is particularly complex.
The exercise of these rights may be restricted where necessary to safeguard the investigation of offences, the exercise of the right of defence, or compliance with legal obligations, in the cases provided for in article 23 GDPR and the LOPDGDD. Any restriction is reasoned and communicated to you.
If you consider that the processing does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.
Security
We apply appropriate technical and organisational measures to ensure a level of security proportionate to the risk: encryption of communications and of the media holding case files, access control, compartmentalisation of information, backups, and certified destruction of material once the statutory retention period has expired.
Changes to this policy
This policy may be updated to reflect legislative changes or new processing activities. The version in force is always the one published on this page, showing the date it was last updated.