Privacy policy

Data controller

The data controller is Tarraco App Lab, S.L.U. (tax ID being obtained), with registered address at C/ Pau Claris, 2 - 43005 Tarragona, Spain.

You can write to us at info@tarracoapplab.com for general enquiries and to privacidad@tarracoapplab.com for privacy matters and the exercise of your rights. Contact telephone: (+34) 877 64 12 52.

This policy is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and by Spanish Organic Act 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).

What data we process

User account data: we process your email address and your name. Access works without a password, by means of a link and a single-use code sent to that address, so we do not process any password.

Sign-in with external providers: not enabled. Gest Peritia does not currently use Google, GitHub or any other identity provider, so none of them receives or gives us any data. Should it ever be enabled, only the verified email address and the name would be received from the chosen provider, and this policy would be updated before switching it on.

The expert's working data: the case files, clients, court writings, expert reports and accounts you manage with Gest Peritia are stored on servers located in the European Union. They may include personal data of third parties (parties to the proceedings, injured persons in medical expert work): in respect of that data the expert acts as controller and the provider as processor, merely hosting it and processing it on the expert's instructions.

Purposes and legal basis

We process your account data solely for the following purposes:

To create and manage your user account and to provide you with the Gest Peritia service. Legal basis: performance of the contract (art. 6.1.b GDPR).
To ensure the security of the application: keeping the session open, preventing unauthorised access and protecting the sign-in process against CSRF attacks. Legal basis: legitimate interest (art. 6.1.f GDPR).

The expert as controller of third-party data

In respect of the personal data of third parties that you enter into your case files (clients, parties to proceedings or other persons involved), you are the data controller, as the expert using the application. Tarraco App Lab plays no part in that processing: in the local version, such data does not even reach our systems.

We remind you that, in your professional activity, you must comply with the GDPR and the LOPDGDD: informing data subjects where appropriate, processing only the data that is necessary, storing it securely and dealing with any rights exercised before you.

Gest Peritia is a tool for organising and drafting documents; it does not provide legal advice.

Retention

Your account data is kept for as long as the account remains active. If you delete it, we will erase your data, without prejudice to blocking it for the periods needed to deal with any legal liabilities.

Working data is kept for as long as you keep the account. You decide at all times which case files you keep and which you delete, and you may request the complete erasure of your organisation.

Recipients and processors

We do not disclose your data to third parties and we do not sell it. To provide the service we rely on the processors listed below, with whom the contracts required by article 28 GDPR have been signed. Working data is hosted on servers in the European Union.

No password or external identity provider is needed to sign in to Gest Peritia: you get in with a single-use code sent to your email address. No third party takes part in verifying your identity beyond the provider that carries that message.

We do not use advertising or profiling cookies. In addition to the strictly necessary technical cookies —exempt from consent under art. 22.2 LSSI-CE and the cookie guidance of the Spanish Data Protection Agency— we use analytics cookies (Google Analytics 4) that are only installed if you expressly accept them in the cookie notice; the details are set out in the Cookie policy.

To provide the service we use only the following suppliers, with whom the safeguards required by the GDPR are in place:

Turso (turso.tech): the database of the service. Your case files, deadlines, invoices and accounting entries live here, in region eu-west-1 (Ireland) of the European Union. Company headquarters: United States, with standard contractual clauses.
Netlify, Inc.: hosting of the site, server functions and storage of the documents you attach to your case files. Headquarters: United States, with standard contractual clauses and supplementary measures.
Brevo (Sendinblue SAS): delivery of sign-in emails and service notices. Headquarters: France (European Union).
Supabase, Inc.: infrastructure for the optional cloud backup, in region eu-central-1 (Frankfurt, Germany). It is only involved if you switch that backup on; if you do not, it receives no data. Company headquarters: United States, with standard contractual clauses.
Google Ireland Ltd.: aggregated web analytics (Google Analytics 4), as processor. It is only involved if you accept the analytics cookies; any international transfer of data relies on the standard contractual clauses approved by the European Commission.

Your rights

The GDPR grants you the rights of access, rectification, erasure, restriction, portability and objection, which are set out below.

To exercise them, write to privacidad@tarracoapplab.com from the email address linked to your account, or attaching information that allows us to verify your identity. We will reply within a maximum of one month.

If you consider that we have not dealt with your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Access: to know what data of yours we process.
Rectification: to correct inaccurate or incomplete data.
Erasure: to request the deletion of your data.
Restriction: to restrict processing in the cases provided for by law.
Portability: to receive your data in a structured and commonly used format.
Objection: to object to processing based on legitimate interest.

Security

We apply technical and organisational measures appropriate to the risk of the processing:

We also recommend that you safeguard access to your email account, since it is the way into the application.

Access works without a password (a link and a single-use code sent to your email), so there are no passwords that can leak or be reused.
The LEXP_SESSION session cookie is httpOnly, which prevents it from being read by scripts in the browser.
The data of each organisation is kept separate: every query is restricted to the organisation of whoever makes it, so one expert cannot reach another expert's case files.
Communications travel encrypted (HTTPS) and the servers are located in the European Union.

Changes to this policy

We may update this policy to reflect regulatory or functional changes. If the change substantially affects the processing of your data, we will tell you before it takes effect.

The version in force will always be available on this page.

Cloud backup (Supabase)

The application optionally allows a backup of the working data to be kept in a database hosted on Supabase, with servers located in the European Union (Frankfurt region, Germany). The backup is encrypted in transit (HTTPS) and the tables are protected so that only the user's installation can read from or write to them.

When this feature is used, Supabase Inc. acts as infrastructure supplier (processor, in GDPR terms) in respect of the replicated data. There are no transfers outside the European Economic Area for this backup.

Remember that, in respect of the third-party data included in your case files, you remain the data controller in the cloud backup too.

Governing version

This text is an English translation provided for convenience. In the event of any discrepancy between this version and the Spanish one, the Spanish version prevails, as it is the version drafted under the Spanish law that governs this policy.

Last updated

July 2026.