Privacy

This Privacy Policy describes the processing of personal data by B. Cremades y Asociados, S.L. (“BCREMADES”), which conforms to Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

1. Data Processing Controller

The Controller of the personal data is B. Cremades y Asociados, S.L., with CIF B-81959355 and the following contact details:

Location: Calle Goya, 18, floor 2, 28001, Madrid, Spain
Email: bcremades@bcremades.com
Telephone: (+34) 914 237 200

Any query or communication may be addressed to the Data Protection Officer at the email address dpd@bcremades.com or, alternatively, by post to the attention of the “Data Protection Officer” at Goya 18 (Planta 2), 28001 Madrid, Spain.

2. Data Protection Rights

The data subject may send a written communication to the Data Protection Officer (whose contact information is provided in section 1 above), to request the exercise of the following rights:

Right to request access to personal data.
Right to request rectification or erasure.
Right to request the restriction of data processing.
Right to object processing.
Right to data portability.

The data subject must indicate in all cases his or her name, surnames and contact address, and must also attach to any request a photocopy of his or her National Identity Document or Passport. The data subject may obtain further information about the above-mentioned rights, as well as the relevant forms to exercise the rights, on the website of the Spanish Agency for Data Protection (www.agpd.es).

If the data subject has given his or her consent for a specific purpose, he or she has the right to withdraw this consent at any time, without this affecting the legality of the data processing based on the consent prior to its withdrawal.

Should the data subject consider that his or her data protection rights have been violated, especially when his or her rights have not been satisfactorily exercised, he or she may lodge a complaint before the Spanish Data Protection Agency through its website (www.agpd.es).

3. Recipients and International Transfers

Unless there is a legal obligation or express consent is provided by the data subject, BCREMADES will not disclose or transfer internationally any personal data. If the disclosure or transfer of data to another country is required, it will be carried out in strict compliance with the legal, professional and ethical obligations of BCREMADES.

In relation to the professional services rendered by BCREMADES, as well as for the performance of contracts with clients and service providers, BCREMADES may share the personal data with third parties, including:

third parties to whom personal data should be disclosed, such as judges, tribunals, arbitrators, arbitration courts and associations, public administrations, lawyers’ bars, counterparties, auditors, accountants, advisors, experts, private investigators, lawyers, court agents, notaries, public registrars and other professionals of the legal sector;
entities of the financial sector, such as financial entities, debt collectors, credit rating agencies and debtor lists; and
service providers of BCREMADES, such as IT service providers, accountants, auditors, document storage facilities, lawyers and other professionals of the legal sector.

BCREMADES uses virtual infrastructure services and cloud storage from suppliers that could have servers in countries outside the European Union that may offer an inferior level of protection than that provided in the data protection regulations in force in Spain. These providers of BCREMADES include:

Microsoft, whose data protection policy is available here.
Dropbox, whose data protection policy is available here.
Google, whose data protection policy is available here.

The data subject expressly accepts that BCREMADES may process its personal data through the aforementioned virtual infrastructure services and cloud storage. The data subject may withdraw his or her consent in this regard at any time.

4. Type of Data Held by BCREMADES

The purpose, storage period and legal basis of the data collected and processed by BCREMADES is explained below. The data subject is informed that BCREMADES will not use the personal data for profiling, and automated decisions will not be taken.

4.1 Client Data

Purpose

BCREMADES will store personal data for the provision of legal services requested by any client or potential client. Normally, the scope of such legal services will be determined in the engagement letter executed between BCREMADES and the client. BCREMADES may also process personal data at a pre-contractual stage, such as for the purpose of preparing a services proposal for the client or potential client.

Storage Period

The personal data of clients and potential clients will be stored in all cases for the duration of the legal relationship with BCREMADES and, subsequently, until the client or potential client requests its erasure.

In no event shall the exercise of the rights of the client or potential client condition or limit (i) the performance of a contract with BCREMADES and any legal obligations derived therefrom; or (ii) any payment obligations that the client or potential client may have with BCREMADES. Accordingly, BCREMADES may deny such rights to the client or potential client until the completion of the performance of the corresponding contract, the fulfilment of the corresponding legal or ethical obligations, the collection of any amounts that are due to BCREMADES and/or the termination of any legal actions derived from the above (e.g., administrative, judicial or arbitration actions).

Legal Basis

BCREMADES is entitled to store personal data for the performance of the engagement letter (contract) executed by BCREMADES and the client, as well as for any pre-contractual proceedings (e.g., the preparation of a services proposal). Likewise, BCREMADES’ legal basis is the client’s consent, which will be reflected in the engagement letter executed by BCREMADES and the client.

The processing of personal data is an essential requirement for the execution of the engagement letter and, therefore, the client is obliged to provide it to BCREMADES. Should the client not provide its personal data, BCREMADES may refuse to sign the engagement letter, refuse to begin to render services and/or terminate the legal relationship at any time.

4.2 Supplier Data

Purpose

BCREMADES will store personal data for the duration of the services rendered by any services supplier or potential supplier. Normally, the scope of such services will be stipulated in the contract for the provision of services executed by BCREMADES and the supplier of the services. BCREMADES may also process personal data at a pre-contractual stage, such as for the purpose of requesting a services proposal from the services supplier or potential supplier.

Storage Period

The personal data of services suppliers and potential suppliers will be stored in all cases for the duration of the legal relationship with BCREMADES and, subsequently, until the supplier or potential supplier requests its erasure.

In no event shall the exercise of the rights of the supplier or potential supplier condition or limit (i) the performance of a contract with BCREMADES and any legal obligations derived therefrom; and (ii) any payment obligations that the supplier or potential supplier may have with BCREMADES. Accordingly, BCREMADES may deny such rights to the supplier or supplier until the completion of the performance of the corresponding contract, the fulfilment of the corresponding legal or ethical obligations, the collection of any amounts that are due to BCREMADES and/or the termination of any legal actions derived from the above (e.g., administrative, judicial or arbitration actions).

Legal Basis

BCREMADES is entitled to store personal data for the performance of the provision of services contract executed by BCREMADES and the client, as well as for any pre-contractual proceedings (e.g., the preparation of a services proposal). Likewise, BCREMADES’ legal basis is the services provider’s consent, which may be reflected in the services contract executed by BCREMADES and the services supplier.

The processing of personal data is an essential requirement for the execution of the services contract and, therefore, the supplier is obliged to provide it to BCREMADES. Should the supplier not provide its personal data, BCREMADES may refuse to sign the services contract, refuse to begin to receive services and/or terminate the legal relationship at any time.

4.3 Data of Applicants for Internships or Placements

Purpose

BCREMADES shall store personal data and other accompanying materials (e.g., cover letter, curriculum vitae, letter(s) of recommendation, other references and academic transcript) that any applicant for internships or placements may send to BCREMADES. Likewise, the applicant authorizes BCREMADES to analyze, file and store any document or information directly accessible from public sources, such as search engines or social media. The purpose is to maintain contact with the candidate, address his or her information requests and assess his or her candidacy.

Storage Period

The personal data of applicants to internships or placements will be stored for the duration of the selection process. Once the selection process is over, the personal data of any applicant not selected will be stored for a maximum period of two years for the purposes of taking into consideration the applicant for future selection processes, except where the applicant states otherwise.

Legal Basis

BCREMADES is entitled to store personal data of applicants to internships or placements in accordance with the specific consent that all applicants must sign and return. If the applicant refuses to sign the specific consent, the applicant’s data and materials will be erased and he or she will not be considered in future selection processes.

4.4 Data of Persons Requesting Information

Purpose

BCREMADES shall store the personal data and accompanying materials sent by any person and by any means requesting information about the services of BCREMADES. The purpose shall be to respond to the request of the data subject.

Storage Period

The personal data of persons requesting information about the services of BCREMADES, or who by any means request to be informed upon a specific topic, will be stored until the data subject withdraws his or her consent, unless there exists a legal obligation requiring the storage of personal data for a longer period.

Legal Basis

BCREMADES is entitled to store personal data of persons requesting information in accordance with the specific consent that all interested parties must sign and return. If the data subject refuses to sign the specific consent, his or her data and materials will be erased and the request will not be addressed.

4.5 Commercial Communications

Purpose

In the event that BCREMADES were to send commercial communications to a data subject, BCREMADES will request the data subject’s express prior consent for that purpose. The purpose will be to send particular or periodical commercial communications to the data subject, including a newsletter and/or specific communications.

Storage Period

The personal data of persons who agree to receiving commercial communications from BCREMADES will be stored until the data subject withdraws his or her consent, unless there exists a legal obligation requiring the storage of personal data for a longer period.

Legal Basis

BCREMADES is entitled to store personal data of persons interested in receiving commercial communications from BCREMADES in accordance with the specific consent that all data subjects must sign and return. If the data subject refuses to sign the specific consent, their data will be erased and no commercial communications will be sent to him or her.

4.6 Data of Users Who Connect to BCREMADES’ Wi-Fi network

Purpose

BCREMADES will store the session data of any person who connects to the Wi-Fi network of its offices. The data that will be stored will include the following of each device that is connected to the BCREMADES Wi-fi network: name, MAC, IP, channel (wi-fi or ethernet), connection time, duration of the connection and navigation information. The purpose will be to keep a record for the purposes of cybersecurity, as well as to block the connection of unauthorized terminals.

Storage Period

The personal data of any person connecting to BCREMADES’ Wi-Fi network will be stored for a maximum period of five years.

Legal Basis

BCREMADES is entitled to store personal data of users connecting to BCREMADES’ Wi-Fi network in accordance with the specific consent that must be signed and returned by any user. If the user refuses to sign the specific consent their data will be erased and permission to connect to BCREMADES’ Wi-Fi network will be denied.

4.7 Cookies Policy

The web pages of BCREMADES use cookies. When browsing on BCREMADES’ web pages, the user consents to the use of the cookies described, for the periods indicated and in the conditions contained in the Cookies Policy. The Cookies Policy for BCREMADES’ web pages is available here. The Cookies Policy is an integral part of this Privacy Policy, but is presented separately exclusively for the data subject’s convenience.

5. Minors

Children under sixteen years of age need the express authorization of their parents or guardians to send their personal data to BCREMADES and/or exercise the rights of the data subject in this regard. Where no authorization exists, minors under sixteen years of age must refrain from entering their information in the contact form of the BCREMADES website or sending communications of any kind to BCREMADES. If BCREMADES discovers in its files the personal data of a minor without the authorization described above, it will erase and destroy the data, reserving the right to inform those who have custody or guardianship of the minor.

6. Security Notice

BCREMADES has internally adopted the obligations and standards of the current regulations on data protection. However, the security of BCREMADES systems and its website is not impregnable, and there may be fraudulent actions by third parties. All the information and personal data provided by a data subject to BCREMADES will be sent at his or her own risk.

7. Amendments

This Privacy Policy was last edited on 19 March 2019. BCREMADES reserves its right to amend it at any time without prior notice. In such case, BCREMADES will inform through email or an announcement in BCREMADES’ website.