PRIVACY · AI · INFORMATION SECURITY

Smart compliance.
Keeping business moving.

We help organisations turn regulatory and risk challenges into clear decisions, practical solutions and tangible results.

Let's talk Explore services

01 / The challenge

More requirements shouldn’t mean more complexity.

Complex regulations, evolving technologies and responsibilities spread across teams. The goal is to stay in control without creating unnecessary processes or administrative burden.

Knowing the rules
is not enough.

What matters is knowing what each situation requires, who needs to act, and how to stop obligations turning into unnecessary complexity.

Growing regulatory complexity

Overlapping obligations, deadlines and responsibilities that make coordination harder.

Technology and emerging risks

New technologies that transform processes and call for closer control.

Third-party risk

External suppliers and technologies increase dependencies and require oversight.

The gap between rules and reality

Requirements and procedures that are hard to translate into teams’ day-to-day work.

02 / Frameworks

Different frameworks,
one integrated approach.

We work with the regulations and standards that apply to each organisation, bringing European, international and local requirements together into consistent, practical and sustainable measures.

Privacy and data

Data protection and compliance in digital environments.

GDPRePrivacyE-commerceData ActISO/IEC 27701EDPB Guidelines

Artificial intelligence

Governance, risk management and responsible use of AI systems.

AI ActISO/IEC 42001ISO/IEC 23894NIST AI RMF

Security and resilience

Information security, resilience and risk management.

NIS2ENSISO/IEC 27001ISO/IEC 27002DORAISO 22301

03 / Services

From assessment to implementation.
And beyond.

Specialist services with a strategic perspective tailored to each organisation.

01 / PRIVACY

DPO as a Service

A certified external DPO who understands your business. We support organizations with implementation and oversight, and in dealings with clients, auditors and supervisory authorities.

Impact assessmentsContractsSuppliersData breachesPolicies

02 / ARTIFICIAL INTELLIGENCE

AI governance

We help identify AI use cases, assess the risks, define responsibilities and implement controls so AI is used safely and responsibly.

Risk assessmentsRolesGood practicesPolicies

03 / SECURITY & COMPLIANCE

Governance, risk & compliance

We design, review and strengthen compliance and security models: clear responsibilities, prioritised risks, effective controls and supplier risk management.

ISMSRisk assessmentsSupply chain securityPolicies

04 / TRAINING

Specialist training

We design training tailored to each organisation’s context and risks, and to different audiences: technical teams, business units and senior management.

PrivacyAISecurityCompliance

SPECIALIST ADVISORY

Legal drafting and advisory

We draft and review legal notices, contracts and clauses. We make sure websites, apps and digital services comply with the rules.

Legal notices · Contracts · Digital compliance

04 / Our approach

We go beyond
recommendations.

We work alongside your teams to set priorities, implement measures and verify that they work. We do not stop at a report: we support delivery and continuous improvement.

Assess

We review existing arrangements, identify gaps and distinguish what is urgent from what matters most.

Define

We define ownership, decision-making and priorities that fit day-to-day operations.

Implement

We turn plans into practical processes, controls and training that teams can use.

Refine

We check what works, address gaps and help maintain progress over time.

What sets us apart

We are committed to making things work.

Sound judgement

We prioritise what matters and recommend justified, feasible and proportionate measures.

Integrated perspective

We bring obligations, risks and responsibilities into a joined-up management approach.

Results, not deliverables

We measure our work by improvements delivered, not by the number of reports produced.

Flexibility

We adapt to each organisation’s resources, teams and level of maturity.

05 / Experience

LEADERSHIP & JUDGEMENT

Experience matters.
Judgement matters more.

We combine experience, business insight and delivery capability to structure, prioritise and implement solutions that work in practice.

Natalia Almudévar

Founder · TrustHub

A lawyer specialising in technology law, with over 25 years of experience in privacy, regulatory compliance and risk governance.

International experience in governance, compliance and risk management, leading multidisciplinary teams and helping turn regulatory requirements into solutions built into the business.

Certified Data Protection OfficerAEPD-DPD scheme (Spanish Supervisory Authority)

CISACertified Information Systems Auditor · ISACA

CISMCertified Information Security Manager · ISACA

06 / Let's talk

Let’s talk about what matters.

Tell us about the challenges your organisation is facing. We’ll help you set priorities and turn them into practical solutions.

LEGAL INFORMATIONBack to home

Legal notice

Website operator

In compliance with Spanish Law 34/2002 on Information Society Services and Electronic Commerce, this website is owned by TrustHub, S.L., with Spanish tax identification number (NIF) B75510016 and registered address at Pasaje Joan Casas, 6, 08013 Barcelona, registered with the Barcelona Commercial Registry, Volume/IRUS 1000437101247, page 1, company file B-625644.

Contact email address: contacto@trusthub.es.

Purpose

This website provides information about the consulting services offered by TrustHub, S.L. in the areas of privacy, artificial intelligence governance and information security.

Use of information

The content of this website is general and for information purposes only. It does not constitute professional advice or establish a professional relationship with TrustHub, S.L.

Intellectual and industrial property

The content, design, logo and other distinctive signs on this website belong to TrustHub, S.L. or are used with the permission of their respective owners. Reproduction, distribution, communication to the public or modification without the prior written authorisation of TrustHub, S.L. is prohibited.

Third-party links

This website may include links to third-party websites. TrustHub, S.L. does not control those websites or accept responsibility for their content, but will promptly remove any link upon becoming aware that it leads to unlawful content.

Data protection

Personal data provided through this website will be processed in accordance with the Privacy policy available on this website.

Governing law and jurisdiction

This legal notice is governed by Spanish law. Any dispute shall be submitted to the courts and tribunals of Barcelona, unless applicable law provides for a different jurisdiction, as is the case for consumers.

Last updated: 11 October 2026.

LEGAL INFORMATIONBack to home

Privacy policy

Data controller

TrustHub, S.L., with Spanish tax identification number (NIF) B75510016 and registered address at Pasaje Joan Casas, 6, 08013 Barcelona.

What data we process and for what purposes

If you contact us through the form on this website, we will process your name, email address, company (if provided) and any information you choose to share to respond to your enquiry and, if you request it, prepare a service proposal. Please do not include more personal data than is necessary to explain your enquiry in this initial contact and, in particular, do not include sensitive data relating to yourself or third parties.

Legal basis for processing

We process your data to respond to your enquiry on the basis of our legitimate interest in responding to individuals who contact us. If you request a service proposal, we will process your data because this is necessary to take steps at your request prior to entering into a potential contract. We will not use your data to send you marketing communications without your consent.

Who may access your data

We do not disclose your data to third parties for commercial purposes or otherwise disclose it except as permitted or required by law.

To operate and secure this website and manage enquiries, we use service providers that may process personal data in order to provide their services to us. Specifically, we use Cloudflare to host and protect the website, including the Turnstile service; Resend to transmit messages submitted through the contact form; and Microsoft 365 to receive and manage email and provide productivity and collaboration tools.

These services may involve international transfers of personal data outside the European Economic Area, particularly to the United States. Such transfers are carried out in accordance with the mechanisms and safeguards provided for under data protection law, including, where applicable, adequacy decisions and standard contractual clauses approved by the European Commission.

How long we keep your data

We will keep the data relating to your enquiry for as long as is necessary to respond to it. If no professional relationship follows, we will delete it within a maximum of one year. If an engagement is agreed, we will retain the data for the duration of the professional relationship and subsequently keep it blocked, in accordance with Spanish data protection law, for the applicable statutory limitation periods for potential legal liabilities.

Your rights

You may request access to, rectification or erasure of your data, object to processing, request restriction or exercise your right to data portability through the contact form on this website by writing “Data protection” in your message. If you believe that we have not properly handled your request or that your data is not being processed appropriately, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Cookies and security measures

This website does not use cookies or other tracking technologies.

To protect the contact form against automated access and misuse, we use Cloudflare Turnstile, a security service that analyses certain technical signals from the browser and connection without placing cookies on the user’s device.