Privacy Policy

ELZABURU, S.L.P. (or Elzaburu), having its place of business at C/Miguel Ángel 21, 28010, Madrid (Madrid), and NIF [Tax No.] B80181662, Telephone no. 917009400 and e-mail elzaburu@elzaburu.es, has posted this information setting out a detailed explanation of the processing of your personal data so that you may be fully informed:

  • Why do we have to process your data?
  • What data of yours might we have?
  • Do we share your data with anyone?
  • How do we protect your data?
  • What rights do you have and how can you exercise them?

Elzaburu processes your personal data to be able to carry out a range of activities. Thus, a variety of personal data of yours may be used in various ways and shared with different people depending on the different individual purposes for which they are used. Detailed information concerning all the varieties of data processing that may affect you follows below.

1       INFORMATION FOR CLIENTS

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

  • Client, accounting, tax, and administrative management on the basis of your contractual relationship with us.
  • To fulfil tax and accounting requirements with which Elzaburu is legally bound to comply.
  • To carry out promotional and marketing activities based on a pre-contractual relationship with you or on our legitimate interest in generating new business and sales opportunities and to secure the loyalty of our clients; or, if you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.
  • To improve the professional services we offer by placing a quality survey at your disposal, on the basis of our legitimate interest in learning how we can improve our services.

b) Source and storage period: The data have been made available to us by you or your legal representative, and as a general rule we will keep them over the length of our contractual relationship with you and subsequently for an additional six-year period, unless they are needed as evidence in the event of possible claims or inspections, in which case they will be stored pending completion of those proceedings. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars, commercial details, employment data, economic data, financial data, and insurance data relating to academic or professional matters.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

  • Government and public bodies.
  • Financial institutions.
  • Courts and Tribunals, courts of arbitration and/or mediation.
  • Other entities associated with the data controller (Cooperating firms inside and outside Spain and Associates of our Firm outside Spain).
  • Others (Communications to adversaries or infringing parties).
  • Government police and security forces (in defence of your rights and interests).

e) International data transfers: Your personal data may be transferred to:

  • Associated firms located in various countries outside the European Economic Area where these transfers are based either on the existence of an Adequacy Decision declaring the destination of the data to have a level of protection equivalent to the level in Europe or on exceptional circumstances in which the data transfer is necessary for performance of a contract between you and Elzaburu or pre-contractual measures taken at your request or on your behalf.

Further information is available by clicking here[RBM1].

2       INFORMATION FOR PROSPECTIVE CLIENTS

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

  • Client, accounting, tax, and administrative management on the basis of your pre-contractual relationship with us.
  • To carry out promotional and marketing activities based on our pre-contractual relationship with you, our legitimate interest in generating new business and sales opportunities, or, if you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or by other sources, and as a general rule we will keep them while the opportunity to do business with you subsists and subsequently for an additional five-year period, unless they are needed as evidence in the event of possible claims, in which case they will be stored pending completion of those claims. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars and commercial details.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

  • Other entities associated with the data controller (Cooperating firms inside and outside Spain and Associates of our Firm outside Spain).

e) International data transfers: Your personal data may be transferred to:

  • Associated firms located in various countries outside the European Economic Area where these transfers are based either on the existence of an Adequacy Decision declaring the destination of the data to have a level of protection equivalent to the level in Europe or on exceptional circumstances in which the data transfer is necessary for performance of a contract between you and Elzaburu or pre-contractual measures taken at your request or on your behalf.

Further information is available by clicking here[RBM2].

3       INFORMATION FOR PROVIDERS

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

  • General provider and administrative management on the basis of your contractual relationship with us.
  • To fulfil tax and accounting requirements with which Elzaburu is legally bound to comply.
  • If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or third-party sources, and as a general rule we will keep them over the length of our contractual relationship with you and subsequently for an additional six-year period, unless they are needed as evidence in the event of possible claims or inspections, in which case they will be stored pending completion of those proceedings. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars, personal aspects, social conditions, commercial details, economic data, financial data, and insurance data relating to academic or professional matters.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

  • Government and public bodies.
  • Other entities related to the data controller (Clients).

e) International data transfers: Your personal data may be transferred to:

  • Clients of Elzaburu located in various countries outside the European Economic Area where these transfers are based either on the existence of an Adequacy Decision for the country or place of destination of the data or because the data transfer is necessary for performance of a contract or pre-contractual measures between you and Elzaburu or for entering into or performance of a contract between Elzaburu and another natural or legal person on your behalf.

Further information is available by clicking here[RBM3].

4       INFORMATION FOR CONTACTS

a) Purpose and lawful basis for processing: If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative, and as a general rule we will keep them until you revoke your consent or object to processing or ask not to receive communications of this kind.

c) The types of data of yours that we use for this processing are identifying particulars.

d) Disclosure of your data: Your personal data will not be disclosed to third parties for their use.

e) International data transfers: Your personal data may be transferred to:

Further information is available by clicking here[RBM4].

5       INFORMATION FOR CANDIDATES IN SELECTION PROCESSES

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

  • For the selection, recruitment, and termination of employment contracts on the basis of our legitimate interest in seeking out qualified professionals or employees for job positions with the firm or on the basis of your consent, depending on whether it is Elzaburu who is seeking the candidate or qualification profile or it is the candidate who has directly applied to Elzaburu to participate in a recruitment procedure.
  • If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or by other sources, and as a general rule we will keep them for a maximum period of up to one year. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars, personal aspects, academic or professional and employment details.

d) Disclosure of your data: Your personal data will not be disclosed to third parties for their use.

e) International data transfers: Your personal data may be transferred to:

Further information is available by clicking here[RBM5].

6       INFORMATION FOR PARTIES INVOLVED IN CASES (ADVERSARIES, NOTARIES, REGISTRARS, WITNESSES, ETC.)

a) Purpose and lawful basis for processing: Your data are processed to enable us to handle our clients’ matters, and we are entitled to do so on the basis of our clients’ legitimate interest consisting of the lawful defence of their rights and interests.

b) Source and storage period: The data have been made available to us by you or by other sources, and we will keep them while extrajudicial or judicial claims or arbitration and/or mediation proceedings are pending, and subsequent to final completion, for an additional five-year period solely for the possible exercise or defence of claims.

c) The types of data of yours that we may process are identifying particulars; personal aspects; social, academic or professional, or employment details; commercial information; economic data; financial data; and insurance data concerning matters and in relation to criminal convictions and offences.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

  • Government and public bodies.
  • Other parties associated with Elzaburu (clients, providers, court procurators, experts, etc.).
  • Courts and Tribunals, courts of arbitration and/or mediation.
  • Government police and security forces.

e) International data transfers: Your personal data may be transferred to:

  • Associated firms located in various countries outside the European Economic Area where these transfers are based either on an Adequacy Decision for the country of destination of the data or because the transfer is necessary for the establishment, exercise, or defence of claims [Article 49.1(e) GDPR].
  • Salesforce.com EMEA Limited (Salesforce), in the United States, this transfer being based on the European Commission’s “Privacy Shield” Adequacy Decision.

Further information is available by clicking here[RBM6].

7       INFORMATION FOR COMPANY CONTACT PERSONS

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

  • To maintain a personal relationship with the persons working for the entities with which our Firm is involved where necessary to satisfy the legitimate interests pursued by Elzaburu in order to be able to maintain the aforesaid relationship.
  • If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or third-party sources, and as a general rule we will keep them over the length of our contractual or business relationship with the entity where you are employed and subsequently for an additional five-year period, solely for the possible exercise or defence of claims. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars and employment data.

d) Disclosure of your data: Your personal data will not be disclosed to third parties for their use.

e) International data transfers: Your personal data may be transferred to:

Further information is available by clicking here[RBM7].

8       INFORMATION FOR LEGAL REPRESENTATIVES

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

  • To be able to interact with parties holding sufficient authority to represent our clients, providers, or associates where necessary to satisfy the legitimate interests pursued by Elzaburu in order to be able to maintain the aforesaid interaction.
  • If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or by other sources, and as a general rule we will keep them over the length of our relationship with the entity you represent. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars and data concerning representation.

d) Disclosure of your data: We may share your data with notaries and registrars or public registers, courts and tribunals, arbitration and/or mediation courts, and other persons and entities associated with our Firm (clients, providers, and Associates).

e) International data transfers: Your personal data may be transferred to:

Further information is available by clicking here[RBM8].

9       INFORMATION COMMON TO ALL THE PRECEDING PARTIES

a) What are your rights in connection with the processing of your data?

Right to information: You have the right to have Elzaburu confirm whether or not we are processing personal data that concern you and to procure the information made available to you in this document, as may be appropriate.

Right to access, rectification, and erasure of your data: You have the right to access your personal data and to apply for rectification of incorrect data or, if appropriate, to request erasure of your data where they are no longer necessary for the purposes for which they were collected.

Right to restriction of processing: In certain circumstances, you may request restriction of the processing of your data, in which case they will be stored only for the exercise or defence of claims.

Right to object: In certain circumstances, you may object to processing of your data on grounds relating to your particular situation, in which case we will cease processing the data, unless we have compelling legitimate grounds or the data are necessary for the exercise or defence of possible claims.

Right to data portability: In certain circumstances, you have the right to have us transmit your data that we are processing based on consent furnished by you or on a contract entered into with you to you or directly to another enterprise of your choosing in a structured, commonly used, and machine-readable format (interoperable format).

Revocation of consent: Where we are processing your data on the basis of a consent that you have furnished for that purpose, you have the right to revoke your consent at any time. Upon revocation, processing will cease unless we are entitled to continue processing on other grounds, though revocation shall not have retroactive effect and accordingly shall not affect processing that may have been performed up to that time.

b) How can you exercise any of the aforesaid rights?

You may exercise any of the previously mentioned rights by applying to ELZABURU, S.L.P. at our postal address at C/Miguel Ángel 21, Post Code 28010 in Madrid (Madrid), in Spain or at our e-mail address at protecciondedatos@elzaburu.es.

For your ease in exercising your rights, you may also ask Elzaburu to supply you with a suitable form on which to send us your request regarding any of the aforesaid rights that you may wish to exercise.

Furthermore, please be informed that you have the right to lodge a complaint with the competent supervisory authority (the Agencia Española de Protección de Datos [Spain’s Data Protection Agency] or whichever body may supersede it at some future time) if you consider that there has been any infringement in relation to the processing of your personal data.

c) Your cooperation is important:

We here at Elzaburu continuously seek to ensure, to the best of our ability, that processing of the personal data for which we are the data controller is performed properly by any and all third parties to whom we have had to disclose the data. For that reason, we would be grateful if you would notify us without delay in the event you become aware or suspect that any of the entities with which we share your data or any of our providers referred to above is making improper use of your personal data so that we may take whatever steps may be appropriate.

Furthermore, to ensure that the data we have for you are correct and up to date, please inform us as soon as possible if there is any change to your data (e.g., a change of address, telephone number, or the like), or if you realise that any of the data we have for you are incorrect for any reason, so that we may correct them appropriately.

d) Security: Elzaburu has implemented suitable security measures to ensure the integrity and confidentiality of your personal data, summarised below

  • Antivirus and/or firewall
  • Assignment of permissions for levels of access
  • Periodic audits
  • Encrypted communications (VPN)
  • Physical and/or logical access controls
  • Security and back-up copies
  • Management of storage media
  • Premises and/or equipment in good condition
  • Suitable policies and/or protocols
  • Device lock protocol
  • Data Protection Officer
  • Up to date software used.

In addition, we conduct periodic reviews of the effectiveness of the security measures implemented and update, expand, and enhance them whenever this is shown to be appropriate by the review of the relevant risk assessments for the data processing that we perform.

a) Point of contact for communications or additional information regarding the processing of your data:

To obtain additional information, or for any other questions regarding the processing of your data, please do not hesitate to contact us at:

Address: C/Miguel Ángel 21, Post Code 28010, Madrid (Madrid), Spain.

Telephone no.: 917009400

E-mail: protecciondedatos@elzaburu.es