Privacy Policy

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

• Client, accounting, tax, and administrative management on the basis of your contractual relationship with us.
• To fulfil tax and accounting requirements with which Elzaburu is legally bound to comply.
• To carry out promotional and marketing activities based on a pre-contractual relationship with you or on our legitimate interest in generating new business and sales opportunities and to secure the loyalty of our clients; or, if you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.
• To improve the professional services we offer by placing a quality survey at your disposal, on the basis of our legitimate interest in learning how we can improve our services.

b) Source and storage period: The data have been made available to us by you or your legal representative, and as a general rule we will keep them over the length of our contractual relationship with you and subsequently for an additional six-year period, unless they are needed as evidence in the event of possible claims or inspections, in which case they will be stored pending completion of those proceedings. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars, commercial details, employment data, economic data, financial data, and insurance data relating to academic or professional matters.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

• Government and public bodies.
• Financial institutions.
• Courts and Tribunals, courts of arbitration and/or mediation.
• Other entities associated with the data controller (Cooperating firms inside and outside Spain and Associates of our Firm outside Spain).
• Others (Communications to adversaries or infringing parties).
• Government police and security forces (in defence of your rights and interests).

e) International data transfers: Your personal data may be transferred to:

• Associated firms located in various countries outside the European Economic Area where these transfers are based either on the existence of an Adequacy Decision declaring the destination of the data to have a level of protection equivalent to the level in Europe or on exceptional circumstances in which the data transfer is necessary for performance of a contract between you and Elzaburu or pre-contractual measures taken at your request or on your behalf.

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

• Client, accounting, tax, and administrative management on the basis of your pre-contractual relationship with us.
• To carry out promotional and marketing activities based on our pre-contractual relationship with you, our legitimate interest in generating new business and sales opportunities, or, if you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or by other sources, and as a general rule we will keep them while the opportunity to do business with you subsists and subsequently for an additional five-year period, unless they are needed as evidence in the event of possible claims, in which case they will be stored pending completion of those claims. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars and commercial details.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

• Other entities associated with the data controller (Cooperating firms inside and outside Spain and Associates of our Firm outside Spain).

e) International data transfers: Your personal data may be transferred to:

• Associated firms located in various countries outside the European Economic Area where these transfers are based either on the existence of an Adequacy Decision declaring the destination of the data to have a level of protection equivalent to the level in Europe or on exceptional circumstances in which the data transfer is necessary for performance of a contract between you and Elzaburu or pre-contractual measures taken at your request or on your behalf.

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

• General provider and administrative management on the basis of your contractual relationship with us.
• To fulfil tax and accounting requirements with which Elzaburu is legally bound to comply.
• If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or third-party sources, and as a general rule we will keep them over the length of our contractual relationship with you and subsequently for an additional six-year period, unless they are needed as evidence in the event of possible claims or inspections, in which case they will be stored pending completion of those proceedings. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars, personal aspects, social conditions, commercial details, economic data, financial data, and insurance data relating to academic or professional matters.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

• Government and public bodies.
• Other entities related to the data controller (Clients).

e) International data transfers: Your personal data may be transferred to:

• Clients of Elzaburu located in various countries outside the European Economic Area where these transfers are based either on the existence of an Adequacy Decision for the country or place of destination of the data or because the data transfer is necessary for performance of a contract or pre-contractual measures between you and Elzaburu or for entering into or performance of a contract between Elzaburu and another natural or legal person on your behalf.

a) Purpose and lawful basis for processing: If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative, and as a general rule we will keep them until you revoke your consent or object to processing or ask not to receive communications of this kind.

c) The types of data of yours that we use for this processing are identifying particulars.

d) Disclosure of your data: Your personal data will not be disclosed to third parties for their use.

e) International data transfers: Your personal data may be transferred to:

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

• For the selection, recruitment, and termination of employment contracts on the basis of our legitimate interest in seeking out qualified professionals or employees for job positions with the firm or on the basis of your consent, depending on whether it is Elzaburu who is seeking the candidate or qualification profile or it is the candidate who has directly applied to Elzaburu to participate in a recruitment procedure.
• If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or by other sources, and as a general rule we will keep them for a maximum period of up to one year. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars, personal aspects, academic or professional and employment details.

d) Disclosure of your data: Your personal data will not be disclosed to third parties for their use.

e) International data transfers: Your personal data may be transferred to:

a) Purpose and lawful basis for processing: Your data are processed to enable us to handle our clients’ matters, and we are entitled to do so on the basis of our clients’ legitimate interest consisting of the lawful defence of their rights and interests.

b) Source and storage period: The data have been made available to us by you or by other sources, and we will keep them while extrajudicial or judicial claims or arbitration and/or mediation proceedings are pending, and subsequent to final completion, for an additional five-year period solely for the possible exercise or defence of claims.

c) The types of data of yours that we may process are identifying particulars; personal aspects; social, academic or professional, or employment details; commercial information; economic data; financial data; and insurance data concerning matters and in relation to criminal convictions and offences.

d) Disclosure of your data: We may share your data with the following entities and/or persons:

• Government and public bodies.
• Other parties associated with Elzaburu (clients, providers, court procurators, experts, etc.).
• Courts and Tribunals, courts of arbitration and/or mediation.
• Government police and security forces.

e) International data transfers: Your personal data may be transferred to:

• Associated firms located in various countries outside the European Economic Area where these transfers are based either on an Adequacy Decision for the country of destination of the data or because the transfer is necessary for the establishment, exercise, or defence of claims [Article 49.1(e) GDPR].
• Salesforce.com EMEA Limited (Salesforce), in the United States, this transfer being based on the European Commission’s “Privacy Shield” Adequacy Decision.

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

• To maintain a personal relationship with the persons working for the entities with which our Firm is involved where necessary to satisfy the legitimate interests pursued by Elzaburu in order to be able to maintain the aforesaid relationship.
• If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or third-party sources, and as a general rule we will keep them over the length of our contractual or business relationship with the entity where you are employed and subsequently for an additional five-year period, solely for the possible exercise or defence of claims. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars and employment data.

d) Disclosure of your data: Your personal data will not be disclosed to third parties for their use.

e) International data transfers: Your personal data may be transferred to:

a) Purpose and lawful basis for processing: Your personal data are needed for the following purposes:

• To be able to interact with parties holding sufficient authority to represent our clients, providers, or associates where necessary to satisfy the legitimate interests pursued by Elzaburu in order to be able to maintain the aforesaid interaction.
• If you have given your consent, to be able to send you commercial communications electronically in relation to different aspects of the services you have engaged.

b) Source and storage period: The data have been made available to us by you or your legal representative or by other sources, and as a general rule we will keep them over the length of our relationship with the entity you represent. Processing based on your consent will, as a rule, continue until such time as you revoke your consent or object to processing.

c) The types of data of yours that we may process are identifying particulars and data concerning representation.

d) Disclosure of your data: We may share your data with notaries and registrars or public registers, courts and tribunals, arbitration and/or mediation courts, and other persons and entities associated with our Firm (clients, providers, and Associates).

e) International data transfers: Your personal data may be transferred to: