Privacy Notice

1. Data controller

Alexander Aguilar Hasbún, owner of the registered trademark BCL Corp Law.

Address: Avenida la Capilla, No. 414, Colonia San Benito, San Salvador, El Salvador.

Phone: +503 2507-1263

Email for privacy matters and exercising your rights: bclcorplaw@gmail.com

2. Data protection officer

Data protection officer: Alexander Aguilar Hasbún.

Email for questions, withdrawal of consent and exercising ARCO-POL rights: bclcorplaw@gmail.com

3. Data collected

The contact form collects only:

• Name
• Company
• Email address
• Phone number (including country code)
• Requested service
• Record of your authorization: server date and time and the version of the text you accepted

4. Purpose

The data is used solely to respond to your request and to contact you about the service you selected.

This data will not be used for marketing, advertising, newsletters or commercial communications without separate, specific consent.

5. Legal basis

Your express authorization, given by ticking the checkbox in the form before submitting it. The form cannot be submitted without it, and the authorization can be withdrawn at any time.

6. Recipients and processors

Your data is processed by the controller and by the following providers, verified against this site's actual configuration:

• Lovable — platform hosting the website and the database where the request is stored.
• Cloudflare — network delivering and protecting the site; processes the IP address and technical connection data for security and bot mitigation.
• Resend — service that delivers the notification email for the request.
• Google (Gmail and corporate email) — mailboxes where request notifications are received and read.
• Google Tag Manager and Google Maps — services used on the site for measurement and to display the office map, only if you allow them; they do not receive the form content.

7. International transfers

The providers listed operate servers outside El Salvador, so your data may be stored or processed abroad under each provider's contractual commitments.

8. Retention period

Requests that do not lead to a professional relationship will be kept for 12 months from the last communication and will then be deleted or anonymised, unless a legal obligation, a dispute or a documented legitimate reason requires keeping them. If a professional relationship is established, the information will be added to the corresponding file and kept in accordance with the applicable legal obligations.

9. Your rights

You may exercise the following rights at any time:

• Access
• Rectification
• Cancellation
• Objection
• Portability
• Erasure (right to be forgotten)
• Restriction of processing
• Deletion
• Withdrawal of the consent given

10. How to exercise them

Write to bclcorplaw@gmail.com stating the right you wish to exercise and the details needed to locate your request (for example, the name and email address you used). You will receive a reply at the same address. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Security

Reasonable security measures are applied: encrypted site connection, restricted database access, and use of the data limited to handling your request. No system can guarantee absolute security, so no unconditional guarantees are given.

12. Cookies and analytics

The site uses Google Tag Manager, which may load Google measurement tools and advertising tags, and displays an embedded Google Maps map. None of those services load until you allow them in the cookie notice, and you may accept, reject or withdraw your consent at any time from “Cookie preferences”.

The hosting platform's visitor analytics is switched off in the project settings, so no usage measurement runs before your cookie decision. Hosting only sets the technical cookie __dpl, needed to serve the deployed version of the site consistently.

The Cloudflare network delivering the site also sets the security cookie __cf_bm for about 30 minutes to tell human traffic from automated traffic.

When you successfully submit the form, a measurement event records the selected service and the phone country code; your name, company, email address and phone number are not sent to analytics.

The detail of cookies, providers, purposes and durations is set out in the Cookie Policy linked at the end of this notice. You can review how Google's services use data at https://policies.google.com/privacy.

13. Effective date and version

Version: aviso-privacidad-v1.4-2026-09-07

Effective from: 2026-09-07

Any change will be published on this page with a new version and date.

14. Previous versions

The version history is kept so the text in force at the time of each authorization can be evidenced:

• aviso-privacidad-v1.4-2026-09-07 · 2026-09-07 — The hosting platform's visitor analytics is switched off: it is no longer listed as an active processing activity or analytics processor; Lovable is identified only for website and database hosting. Cloudflare remains as a security processor.
• aviso-privacidad-v1.3-2026-09-07 · 2026-09-07 — Cloudflare and the hosting platform's analytics (Lovable Analytics) are added as processors, and the measurement the platform runs before the cookie decision is described.
• aviso-privacidad-v1.2-2026-09-07 · 2026-09-07 — Final 12-month retention period and cookie consent by category.
• aviso-privacidad-v1.1-2026-09-08 · 2026-09-08 — Data protection officer designated.
• aviso-privacidad-v1.0-2026-09-04 · 2026-09-04 — Initial version of the contact form Privacy Notice.