Privacy Policy

ELZABURU, S.L.P. (also Elzaburu), with its registered address at P.º de la Castellana, 259C, 28046 Madrid, Tax ID No. B80181662, phone number 917009400, and email address elzaburu@elzaburu.es, provides you with this information regarding the processing of your personal data so that you may have detailed knowledge of:

Why we need to process your data.
What personal information we may have about you and for how long.
Who we share them with.
How we protect them.
What are your rights in this regard, and how can you exercise them?

Elzaburu processes your personal data to carry out various activities. As such, the same or different personal data about you may be used in various ways and shared with different individuals depending on the specific purposes for which we need it. Below, we provide detailed information about each of these data processing activities that may affect you.

Information for Customers and Users (Individuals)

a) Purpose and Legal Basis for Processing: Your personal data is necessary for the following purposes:

Customer/user management, which includes the provision of services, the sending of communications related to such services, access to the ELZACLOUD platform, and customer service, based on the contractual or precontractual relationship you have with us (accepted proposals, service agreements, general terms and conditions, orders, or requests made).
Accounting and billing purposes, as well as tax and accounting management, based on the contractual relationship you have with us and due to the existence of legal obligations applicable to Elzaburu in this regard (Commercial Code, General Tax Law, and implementing and supplementary regulations).
Sending greetings or other social communications to mark significant occasions (Christmas or other holidays, birthdays, promotions, retirements, and similar events), based on our legitimate interest in maintaining the best possible relationship with our customers and users.
To send you communications from ELZABURU regarding new products, services, and news of interest, provided that you have given us your consent to do so.
To carry out customer loyalty initiatives—through meetings, surveys, and quality questionnaires—in order to improve the professional services we offer, based on the contractual relationship you have with us and our legitimate interest in pursuing such improvements.
Management of our regulatory compliance program. To this end, only in cases required by law, we carry out customer identification and verification (Know Your Client), due diligence (standard, simplified, or enhanced), risk assessment and management of customers, users, and transactions, and monitoring of the business relationship, including: a) verification of identity and, where applicable, beneficial ownership and control structure; b) screening of politically exposed persons (PEPs) and their associates (family members, related parties); c) screening and checks against international sanctions and restrictive measures lists (EU/UN, OFAC, and others), internal lists, and alert lists; d) analysis of transactions, patterns, and red flags; risk assessment; and alert management; e) documentation, evidence, and traceability of compliance actions; f) where applicable, reporting of suspicious transactions or information to the competent authorities as appropriate, as well as handling of requests. All of this is based on the applicable legal obligations regarding the prevention of money laundering and terrorist financing, international sanctions lists, and complementary regulations, as well as on our legitimate interest in upholding our Code of Ethics and our regulatory compliance program.
To share your identifying and contact information with the legal rankings in the European Union and the United Kingdom in which Elzaburu participates (see here) so that they may list and evaluate us in those rankings, based on our legitimate interest in maintaining and strengthening Elzaburu’s competitive, reputational, and commercial standing in the legal market through its participation in professional ranking systems based on verified client reviews.
Transcription and/or recording of online meetings held via Teams in which you participate, provided that you have given your consent by enabling your microphone and, if applicable, your camera after the pop-up notification regarding the transcription/recording appears.
In-house legal advice and representation, including the preparation, analysis, drafting, filing, and defense of claims and legal, administrative, arbitral, and judicial proceedings to protect Elzaburu’s rights, interests, and liabilities. All of this is based on our legal obligations and our legitimate interest in protecting, exercising, and defending Elzaburu’s rights and legitimate interests, as well as in preventing and managing legal risks and providing appropriate internal legal advice.

b) Source and retention period: Thedata has been provided to us by you or your legal representative. As part of our Know Your Client and sanctions list verification processes, we may also obtain data from other sources, such as sanctions lists themselves, the media, and management and alert software.

We will generally retain your data for the duration of our contractual relationship with you and/or, where applicable, for as long as the aforementioned legitimate interest persists; thereafter, the data will be properly blocked for the statutory period required to file or defend against potential claims, in which case it will be retained until the corresponding inspection, proceeding, or claim is definitively closed. If you have consented to the use of your data for the purpose of sending commercial communications, the data necessary for this purpose will be retained until you revoke your consent.

c) The types of data we process, depending on the purposes mentioned, include identifying and contact information, corporate and/or professional information, economic, financial, and insurance information, and transaction-related information. In exceptional cases, in the management of our regulatory compliance program and in internal legal advice and defense, we will also process other types of information that may be relevant to a potential incident, assessment, investigation, or claim (including, only if strictly necessary, data related to criminal convictions and offenses).

d) Disclosure of Your Data: We share your data with the following entities and/or individuals and in the circumstances indicated:

Competent public authorities or agencies in the cases provided for by law, including, where necessary, notaries and registrars, state law enforcement agencies, as well as courts, tribunals, and other dispute resolution bodies (mediators, arbitrators), for the purpose of legitimate self-defense or at the request of these entities.
Financial institutions, if necessary, for the collection or payment of amounts.
Consulting and advisory firms, as needed, for internal legal defense and counsel.
Opposing parties in a negotiation or claim, partner companies, and correspondents outside Spain, if necessary to fulfill the assignment, contract, or request.
Rankings and Directories.

In addition, the following vendors we work with may have access to your personal data depending on the services they provide to us:

Storage providers, the structure of our information systems, IT maintenance and support, and office automation
Communications and advertising agency, as well as providers of our email marketing platform and maintenance services for our corporate website and Elzacloud.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: Your personal data will be transferred outside the European Economic Area (EEA) to the following entities in the cases indicated:

Competent public administrations and agencies, opposing parties in negotiations or claims, as well as suppliers, partner firms, or correspondents outside the EEA, in connection with the performance of a contract or assignment with us. These transfers are protected either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or by Standard Contractual Clauses, or because they constitute an exception, as the transfer of data is necessary to perform a contract between you and Elzaburu, to perform a contract in your interest, or to assert, exercise, or defense of legal claims.
Competent public administrations and agencies, as well as consulting and legal advisory firms outside the EEA, if necessary to defend our interests and rights. These transfers are authorized either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or because they constitute an exception, as the transfer of data is necessary for the establishment, exercise, or defense of legal claims.
Legal and Intellectual Property Rankings and Directories Based in the United Kingdom. This international transfer of your personal data is covered by the European Commission’s Adequacy Decision, which states that the United Kingdom provides an adequate level of data protection (for more information, visit https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?prefLang=es).

You may request more detailed information about these international transfers of your data through the contact point listed at the end of this website privacy policy.

Information for Potential Customers (Individuals)

a) Purpose and Legal Basis for Processing: Yourpersonal data is necessary for the following purposes:

Managing relationships with potential customers, which includes preparing projects, proposals, or quotes; holding sales meetings; and sending surveys based on the pre-contractual relationship they have with us.
Sending greetings or other social messages on the occasion of significant events (Christmas or other holidays, birthdays, promotions, retirements, and similar events), based on our legitimate interest in maintaining the best possible relationship with our prospective customers.
To send you communications from ELZABURU regarding new products, services, and news of interest, provided that you have given us your consent to do so.
Management of our regulatory compliance program. To this end, only in cases required by law, we carry out customer identification and verification (Know Your Client), due diligence (standard, simplified, or enhanced), risk assessment and management of customers, users, and transactions, and monitoring of the business relationship, including: a) verification of identity and, where applicable, beneficial ownership and control structure; b) screening of politically exposed persons (PEPs) and their associates (family members, related parties); c) screening and checks against international sanctions and restrictive measures lists (EU/UN, OFAC, and others), internal lists, and alert lists; d) analysis of transactions, patterns, and red flags; risk assessment; and alert management; e) documentation, evidence, and traceability of compliance actions; f) where applicable, reporting of suspicious transactions or providing information to the competent authorities when appropriate, as well as handling requests. All of this is based on the applicable legal obligations regarding the prevention of money laundering and terrorist financing, international sanctions lists, and complementary regulations, as well as on our legitimate interest in upholding our Code of Ethics and our regulatory compliance program.
Transcription and/or recording of online meetings held via Teams in which you participate, provided that you have given your consent by enabling your microphone and, if applicable, your camera after the pop-up notification regarding the transcription/recording appears.
In-house legal advice and representation, including the preparation, analysis, drafting, filing, and defense of claims and legal, administrative, arbitral, and judicial proceedings to protect Elzaburu’s rights, interests, and liabilities. All of this is based on our legal obligations and our legitimate interest in protecting, exercising, and defending Elzaburu’s rights and legitimate interests, as well as in preventing and managing legal risks and providing appropriate internal legal advice.

We will generally retain your data for as long as the business opportunity with you remains active and, thereafter, for the period required by law to file or defend against potential claims; in such cases, the data will be retained until the corresponding investigation, proceeding, or claim is definitively closed. If you have consented to the use of your data for the purpose of sending marketing communications, the data necessary for that purpose will be retained until you revoke your consent.

c)Depending on the purposes mentioned, the types of data wemay process about you include identifying and contact information, as well as corporate and/or professional information. In exceptional cases, in the management of our regulatory compliance program and in the context of internal legal advice and defense, we will also process other types of information that may be relevant to a potential incident, assessment, investigation, or claim (including, only if strictly necessary, data relating to criminal convictions and offenses).

d) Disclosure of Your Data: We share your data with the following entities and/or individuals and in the circumstances indicated:

Competent public authorities or agencies in the cases provided for by law, including, where necessary, notaries and registrars, state law enforcement agencies, as well as courts, tribunals, and other dispute resolution bodies (mediators, arbitrators), for the purpose of legitimate self-defense or at the request of these entities.
Partner firms and correspondents outside Spain, if necessary based on the existing pre-contractual relationship.
Consulting and advisory firms, as needed, for internal legal defense and counsel.

In addition, the following vendors we work with may have access to your personal data depending on the services they provide to us:

Storage providers, the structure of our information systems, IT maintenance and support, and office automation
Communications and advertising agencies and providers of our email marketing platform.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: Your personal data will be transferred outside the European Economic Area (EEA) to the following entities in the cases indicated:

Partner firms or correspondents outside the EEA, based on the pre-contractual relationship we have with you. These transfers are protected either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or by Standard Contractual Clauses, or because they constitute an exception, as the transfer of data is necessary for the performance of precontractual measures or for the establishment, exercise, or defense of legal claims.
Competent public administrations and agencies, as well as consulting and legal advisory firms outside the EEA, if necessary to defend our interests and rights. These transfers are authorized either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or because they constitute an exception, as the transfer of data is necessary for the establishment, exercise, or defense of legal claims.

You may request more detailed information about these international transfers of your data through the contact point listed at the end of this website privacy policy.

Information for Suppliers and Potential Suppliers (Individuals)

a) Purpose and Legal Basis for Processing: Yourpersonal data is necessary for the following purposes:

General and administrative management of suppliers, including onboarding and registration in our systems, approval and evaluation processes, and the sending of communications regarding the services provided, based on the contractual or precontractual relationship you have with us.
Compliance with tax and accounting obligations, which, among other procedures, includes the recording of invoices, payments, and settlements, as well as the filing and payment of taxes, based on the existing contractual relationship and the applicable legal obligations in these matters that apply to Elzaburu (Commercial Code, General Tax Law, and implementing and supplementary regulations).
Sending greetings or other social messages to mark significant occasions (Christmas or other holidays, birthdays, promotions, retirements, and similar events), based on our legitimate interest in maintaining the best possible relationship with our suppliers.
Management of our regulatory compliance program. To this end, only in cases required by law do we carry out supplier identification and verification processes, due diligence, assessment and management of supplier-related risks, and monitoring of the business relationship, including: a) verification of identity and, where applicable, beneficial ownership and control structure; b) verification of politically exposed persons (PEPs) and their connections (family members, associates); c) screening and checks against international sanctions and restrictive measures lists (EU/UN, OFAC, and others), internal lists, and watchlists; d) analysis of transactions, patterns, and red flags; risk assessment; and alert management; e) documentation, evidence, and traceability of compliance actions; f) where applicable, reporting of suspicious transactions or information to the competent authorities as appropriate, as well as handling of requests. All of this is based on the applicable legal obligations regarding the prevention of money laundering and terrorist financing, international sanctions lists, and complementary regulations, as well as on our legitimate interest in upholding our Code of Ethics and our regulatory compliance program.
Transcription and/or recording of online meetings held via Teams in which you participate, provided that you have given your consent by enabling your microphone and, if applicable, your camera after the pop-up notification regarding the transcription/recording appears.
In-house legal advice and representation, including the preparation, analysis, drafting, filing, and defense of claims and legal, administrative, arbitral, and judicial proceedings to protect Elzaburu’s rights, interests, and liabilities. All of this is based on our legal obligations and our legitimate interest in protecting, exercising, and defending Elzaburu’s rights and legitimate interests, as well as in preventing and managing legal risks and providing appropriate internal legal advice.

b) Source and retention period: Thedata has been provided to us by you, your legal representative, or third-party sources, and we will generally retain it for the duration of our contractual relationship with you and thereafter for the period prescribed by law for filing or defending against potential claims; in such cases, the data will be retained until the corresponding inspection, proceeding, or claim is definitively closed. In our due diligence and sanctions list verification processes, we may also obtain data from other sources, such as sanctions lists themselves, the media, and management and alert software.

c) The types of data wemay process about you include identifying and contact information, corporate and/or professional information, commercial information, economic, financial, and insurance information, and information related to existing transactions with us. In exceptional cases, as part of the management of our regulatory compliance program and in connection with internal legal advice and defense, we may also process other types of information that are relevant to a potential incident, assessment, investigation, or claim (including, only if strictly necessary, data relating to criminal convictions and offenses).

d) Disclosure of Your Data: We share your data with the following entities and/or individuals and in the circumstances indicated:

Competent public authorities or agencies in the cases provided for by law, including, where necessary, notaries and registrars, state law enforcement agencies, as well as courts, tribunals, and other dispute resolution bodies (mediators, arbitrators), for the purpose of legitimate self-defense or at the request of these entities.
Financial institutions, if necessary, for the collection or payment of amounts.
Consulting and advisory firms, as needed, for internal legal defense and counsel.
Elzaburu's customers, suppliers, and partners, when necessary for the performance of the existing contract with you.

In addition, the following vendors we work with may have access to your personal data depending on the services they provide to us: storage providers, providers of our information systems infrastructure, and providers of IT maintenance and support and office automation services.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: Your personal data will be transferred outside the European Economic Area (EEA) to the following entities in the cases indicated:

Elzaburu’s customers, suppliers, and partners outside the EEA, in fulfillment of an existing contract. These transfers are protected either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or by Standard Contractual Clauses, or because they constitute an exception, as the transfer of data is necessary to perform a contract between you and Elzaburu, or to perform a contract in your interest.
Competent public administrations and agencies, as well as consulting and legal advisory firms outside the EEA, if necessary to defend our interests and rights. These transfers are authorized either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or because they constitute an exception, as the transfer of data is necessary for the establishment, exercise, or defense of legal claims.

You may request more detailed information about these international transfers of your data through the contact point listed at the end of this website privacy policy.

Information for recipients of communications about our latest news, services, and topics of interest (newsletters and marketing communications)

a) Purpose and legal basis for processing: To send you communications from ELZABURU regarding new developments, services, and news of interest, based on the consent you have provided to us.

b) Source and retention period: Thedata has been provided to us by you or your legal representative, and we will retain it until you revoke your consent or request to be removed from the mailing list for this type of communication.

c) The types of data weuse in this processing are identifying and/or contact information.

d) Disclosure of Your Data: Unless required by law, we do not disclose your personal data to third parties. However, the following service providers may have access to your data in connection with the services they provide to us:

Storage providers, the structure of our information systems, IT maintenance and support, and office automation
Communications and advertising agencies and providers of our email marketing platform.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: None are planned.

Information for Job Applicants

a) Purpose and Legal Basis for Processing: Yourpersonal data is necessary for the selection, hiring, and termination of employment contracts, based on the existing preliminary contract at your request or on our legitimate interest in identifying professional or job candidates for the firm’s positions.

b) Source and retention period: Thedata has been provided to us by you or your legal representative or by other sources, and we will generally retain it until the end of the selection process in which the candidate is participating and, thereafter, for up to 1 year for any other potential processes that may be initiated.

c) The types of data wemay process about you include identifying information, personal characteristics (date of birth and/or age and nationality), academic or professional information, and employment information.

d) Disclosure of Your Data: Unless required by law, we do not disclose your personal data to third parties. However, the following service providers may have access to your data in connection with the services they provide to us:

Storage providers, the structure of our information systems, IT maintenance and support, and office automation
A provider of recruitment process management services.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: None are planned.

Information for parties involved in cases (opposing parties, notaries, registrars, witnesses, experts, etc.)

a) Purpose and Legal Basis for Processing: We processyour personal data in order to manage our clients’ cases and provide them with our advisory, consulting, defense, and protection services. We are authorized to do so based on our clients’ legitimate interest, which consists of the legitimate defense of their rights and interests.

b) Source and retention period: Thedata has been provided to us by you or by other sources, and we will retain it for as long as negotiations, proceedings, claims—whether out-of-court or in court—or arbitration and/or mediation proceedings on behalf of or for the benefit of our clients remain active; and, once these have been definitively concluded, for the period prescribed by law for filing or defending against potential claims that could directly affect Elzaburu; in such cases, the data will be retained until the corresponding proceeding or claim is definitively closed.

c) The types of data we may use in this processing include identifying and contact information, corporate, employment, or professional data, personal characteristics, social circumstances (age of majority, nationality), economic, financial, and insurance data, transaction-related data, and data related to criminal convictions and offenses.

d) Disclosure of Your Data: We share your data with the following entities and/or individuals and in the circumstances indicated:

Competent public authorities or agencies in the cases provided for by law, including, where necessary, notaries and registrars, state law enforcement agencies, as well as courts, tribunals, and other dispute resolution bodies (mediators, arbitrators), for the legitimate defense of our clients or at the request of these entities.
Other individuals or entities associated with Elzaburu (customers, suppliers, attorneys, experts, etc.).

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: Your personal data will be transferred outside the European Economic Area (EEA) to the following entities in the cases indicated:

Competent public authorities or agencies and partner firms or correspondents located outside the EEA, provided that such transfers are covered either by an Adequacy Decision regarding the destination of the data or because the transfer is necessary for the establishment, exercise, or defense of legal claims.
Other individuals or entities associated with Elzaburu (customers, suppliers, attorneys, experts, etc.) who are involved in negotiations, claims, or litigation, and where the transfer of data is necessary for the conclusion or performance of a contract with you or in your interest, or for the establishment, exercise, or defense of legal claims.

Information for representatives and contact persons at organizations with which we do business (customers, suppliers, partners, etc.)

a) Purpose and Legal Basis for Processing: Yourpersonal data is necessary for:

The negotiation and signing of contracts, communication, and the maintenance of a personal relationship with the entity that you represent or for which you work or provide services, which is necessary to fulfill the legitimate interests pursued by Elzaburu, namely, to maintain the relationship described above.
Management of our regulatory compliance program. To this end, only in cases required by law do we carry out processes to identify and verify the entity you represent or provide services to, conduct due diligence (standard, simplified, or enhanced), assess and manage the associated risk, and monitor the business relationship, including: a) verification of identity and, where applicable, beneficial ownership and control structure; b) verification of politically exposed persons (PEPs) and their connections (family members, associates); c) screening and checks against international sanctions and restrictive measures lists (EU/UN, OFAC, and others), internal lists, and alert lists; d) analysis of transactions, patterns, and red flags; risk assessment; and alert management; e) documentation, evidence, and traceability of compliance actions; f) where applicable, reporting of suspicious transactions or information to the competent authorities as appropriate, as well as handling of requests. All of this is based on the applicable legal obligations regarding the prevention of money laundering and terrorist financing, international sanctions lists, and complementary regulations, as well as on our legitimate interest in upholding our Code of Ethics and our regulatory compliance program.
Sending greetings or other social messages to mark significant occasions (Christmas or other holidays, birthdays, promotions, retirements, and similar events), based on our legitimate interest in maintaining the best possible relationship with our contacts.
To share your identifying and contact information with the legal rankings in the European Union and the United Kingdom in which Elzaburu participates (see here) so that they may list and evaluate us in those rankings, based on our legitimate interest in maintaining and strengthening Elzaburu’s competitive, reputational, and commercial standing in the legal market through its participation in professional ranking systems based on verified client reviews.
Transcription and/or recording of online meetings held via Teams in which you participate, provided that you have given your consent by enabling your microphone and, if applicable, your camera after the pop-up notification regarding the transcription/recording appears.
In-house legal advice and representation, including the preparation, analysis, drafting, filing, and defense of claims and legal, administrative, arbitral, and judicial proceedings to protect Elzaburu’s rights, interests, and liabilities. All of this is based on our legal obligations and our legitimate interest in protecting, exercising, and defending Elzaburu’s rights and legitimate interests, as well as in preventing and managing legal risks and providing appropriate internal legal advice.

b) Source and retention period: Thedata has been provided to us by you or by third parties, and we will generally retain it for the duration of the contractual or business relationship with the entity you represent or for which you work, and subsequently for the period prescribed by law for the possible defense against or filing of claims; in such cases, the data will be retained until the corresponding inspection, proceeding, or claim is definitively closed. As part of our Know Your Client, due diligence, and sanctions list verification processes, we may also obtain data from other sources, such as sanctions lists themselves, the media, and management and alert software.

c) The types of data wemay process about you include identifying and contact information, corporate or professional information, and employment information. In exceptional cases, as part of the management of our regulatory compliance program and in connection with internal legal advice and defense, we may also process other types of information that are relevant to a potential incident, assessment, investigation, or claim (including, only if strictly necessary, data relating to criminal convictions and offenses).

d) Disclosure of Your Data: We share your data with the following entities and/or individuals and in the circumstances indicated:

Competent public authorities or agencies in the cases provided for by law, including, where necessary, notaries and registrars, state law enforcement agencies, as well as courts, tribunals, and other dispute resolution bodies (mediators, arbitrators), for the purpose of legitimate self-defense or at the request of these entities.
Consulting and advisory firms, as needed, for internal legal defense and counsel.
Opposing parties in a negotiation or claim, partner companies, and correspondents outside Spain, if necessary to fulfill the commitments we have made.
Rankings and Directories.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: Your personal data will be transferred outside the European Economic Area (EEA) to the following entities in the cases indicated:

Competent public administrations and agencies, opposing parties in negotiations or claims, as well as suppliers, partner firms, or correspondents outside the EEA, when necessary for the fulfillment of the commitments we have undertaken. These transfers are protected either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or by Standard Contractual Clauses, or because they constitute an exception, as the transfer of data is necessary to fulfill a contract in your interest or for the establishment, exercise, or defense of legal claims.
Competent public administrations and agencies, as well as consulting and legal advisory firms outside the EEA, if necessary to defend our interests and rights. These transfers are authorized either by the existence of an Adequacy Decision declaring that the destination of the data provides a level of protection equivalent to that in Europe, or because they constitute an exception, as the transfer of data is necessary for the establishment, exercise, or defense of legal claims.
Legal and Intellectual Property Rankings and Directories Based in the United Kingdom. This international transfer of your personal data is covered by the European Commission’s Adequacy Decision, which states that the United Kingdom provides an adequate level of data protection (for more information, visit https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?prefLang=es).

You may request more detailed information about these international transfers of your data through the contact point listed at the end of this website privacy policy.

Information for Registrants and Attendees of Conferences and Events

a) Purpose and Legal Basis for Processing: Yourpersonal data is necessary for the following purposes:

To organize the event, manage capacity and attendance, and notify you of any updates or changes regarding the event, as this is necessary to fulfill our obligations arising from your registration for the event.
To send you documentation related to the event at a later date (presentations or documents discussed during the event), based on our legitimate interest in ensuring the complete satisfaction of those who registered.
To obtain statistical information about the event—including by requesting feedback for that purpose—and to analyze its results in order to develop future informational and/or commercial strategies, based on our legitimate interest in doing so.
Only if you have given your consent by checking the corresponding box on the registration form—provided that the form and box are available—will we send you communications from ELZABURU regarding new developments, services, and news of interest, including via email.
Only if you have given your consent by checking the corresponding box on the registration form—provided that the form and box are available—will we share your information with our event partner(s) so that they may send you marketing communications, including electronically.

b) Source and retention period: The data has been provided to us by you or your legal representative (typically through the event registration form), and we will retain it, in the context of the event, until the event concludes—including, where applicable, the sending of related documentation and its analysis—and thereafter, with the data duly blocked, for the statutory period in effect at any given time for the possible defense against or filing of claims; in such cases, the data will be retained until the corresponding investigation, proceeding, or claim is definitively closed.

If you have consented to the use of your data for the purpose of sending commercial communications, the data necessary for that purpose will be retained until you revoke your consent.

c) The types of data wemay process about youinclude identifying information, contact information, and employment information (job title and company). If there is an event registration form, the data will consist of the information you provide on that form. If registration is enabled via a social media login, we also receive data regarding your interests collected by that social media platform, provided you have given your consent for this purpose.

d) Disclosure of Your Information: We shareyour personal information with the following entities and/or individuals:

Only if you have given your consent to this effect on the corresponding registration form will we share your information with our event partners so that they may send you marketing communications, including by electronic means.
Government agencies, other public bodies, and entities authorized by law, when required or necessary.

In addition, the following service providers have access to some of your personal data in order to provide us with the contracted services, but we ensure that they apply high standards of protection and that they may only use such data to the extent strictly necessary in relation to the purposes detailed above:

Storage providers, the structure of our information systems, IT maintenance and support, and office automation.
Service providers responsible for the management, maintenance, and communications related to our databases.
Web hosting providers for registration and email delivery platforms.

If you need more detailed information about any of these recipients of your data, please feel free to contact us through the contact point listed at the end of this privacy policy.

e) International data transfers: None are planned.

Information for Users of Our Website

a) Purpose and Legal Basis for Processing: Yourpersonal data is necessary, in each case, for:

To process and respond to the message you submitted via our online contact form based on our legitimate interest in providing adequate service to our customers and users.
To send you our Case Law Yearbook, based on the consent you provide when you register and submit the web form provided for that purpose.
Cookies – We process data derived from the use of cookies and similar technologies (collectively, “cookies”) for the purposes described in our Cookie Policy. Technical or strictly necessary cookies are used based on our legitimate interest in ensuring the functionality, security, and availability of the website, or because they are necessary to provide a service you have expressly requested. All other cookies will be used only when you have given your consent.

Regarding the registration form for our newsletter and the checkboxes used to consent to receiving communications from ELZABURU about new developments, services, and news of interest ( checkboxes that can be found on the aforementioned web forms), please see the section titled “Information for Recipients of Communications About Our New Developments, Services, and News of Interest (Newsletter and Marketing Communications).”

b) Source and retention period: Thedata has been provided to us by you or your legal representative, and we will retain it for as long as necessary to address your communication or request and, thereafter, for the period prescribed by law for the possible defense against and filing of claims; in such cases, the data will be retained until the corresponding inspection, proceeding, or claim is definitively closed. With regard to personal data processed through cookies, such data will be retained for the duration of each cookie’s validity period.

c) The types of data we may process about you are those you provide to us through the relevant web forms and, with regard to cookies, your device’s IP address, other device identifiers, operating system, browser, logs, security data, connection and diagnostic data, browsing and visit data, and preferences.

Storage providers, the structure of our information systems, IT maintenance and support, and office automation
Cookie providers as listed in our Cookie Policy.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: As described in our Cookie Policy.

Information for Visitors to Our Offices

a) Purpose and Legal Basis for Processing: If you visit our offices, Elzaburu will process your data for access control for security purposes, including recording your image for video surveillance, based on our legitimate interest in carrying out identification, control, and security activities within our facilities, which aligns with the public interest.

b) Source and retention period:Your data will be retained for these purposes for a maximum period of one month from the date it is collected, except in cases where it must be retained to prove that acts have been committed that threaten the safety of persons, property, or facilities.

c) The types of personal data wemay process about you are identifying data, including the collection of your image.

d) Disclosure of Your Information: We share your information with the following entities and/or individuals and under the following circumstances:

Competent public authorities or agencies in the cases provided for by law, including state law enforcement agencies, as well as courts, tribunals, and other dispute resolution bodies (mediators, arbitrators), for the purpose of legitimate self-defense or at the request of these entities.
The owner or manager of the building where our offices are located, so that they can carry out the necessary security checks and grant access.

In addition, the following vendors may have access to your data in connection with the services they provide to us:

Storage providers, the structure of our information systems, IT maintenance and support, and office automation
Our video surveillance and security system provider.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: Noneare planned.

Users of our internal information system (reporters)

a) Purpose and Legal Basis for Processing: If you do not choose to file an anonymous report, we will process your personal data to handle your report, conduct the necessary internal investigation to monitor the possible commission of criminal or irregular acts in accordance with the external and internal regulations applicable to ELZABURU, and, where appropriate, take the necessary administrative or legal actions.

We are authorized to process your data based on the provisions of Law 02/2023, which regulates the protection of individuals who report regulatory violations and combats corruption, due to the public interest in internal reporting systems, as well as because it is necessary for our legitimate interest in monitoring potential illegal or irregular activities that may affect the company, and, in certain cases, to comply with other legal obligations.

b) Source and retention period: The data is provided to us by you or your legal representative through the complaint filed. We will retain your personal information until the conclusion of the investigations if the allegations have not been proven, provided that it is not necessary for other purposes or for evidentiary purposes related to proper control and supervision in the prevention of crimes. If the facts are proven, the data will be retained for as long as necessary for the company to exercise its rights in court. However, your data will only be retained in our Internal Information System for 3 months and in accordance with applicable regulations.

c) With whom we share your data: Your data will be treated with the utmost confidentiality, and only in the event that the reported incident gives rise to administrative or judicial proceedings, the information provided may be disclosed to the competent authorities for investigation and enforcement (courts and tribunals or other dispute resolution bodies, law enforcement agencies, the Public Prosecutor’s Office, or competent public administrations), as well as to the relevant parties involved in the subsequent investigation.

In addition, the following vendors we work with may need access to some of your personal data that we use so that they can provide their services to us: •

Consulting and legal firms that represent our interests and defend our rights.
Attorneys for legal representation in court proceedings.
Our technology solution provider for our Internal Information System.

ELZABURU applies strict controls in the selection and hiring of its suppliers to ensure that they may access your personal data solely for the purpose of providing the contracted service, in accordance with our instructions, applying strict security measures, and without using such data for any other purpose or, in general, sharing it with third parties.

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

d) International data transfers: In connection with the stated purpose, your data will not be processed or accessed from outside the European Economic Area (EEA), except in the event that we must handle a claim and/or legal action outside the EEA, in which case we will share your data with our advisors and representatives in the location where the proceedings take place, as well as with the competent public authorities in that jurisdiction. This transfer of your data is lawful because it is necessary for reasons of public interest and/or for the establishment, exercise, or defense of legal claims.

Information for Individuals Seeking to Exercise Their Data Protection Rights and Those Involved in Potential Information Security Incidents

a) Purpose and legal basis for processing: To manage, process, and resolve requests to exercise rights related to personal data protection, as well as incidents and security breaches involving personal data, in accordance with the legal obligation arising from data protection regulations and our legitimate interest in resolving these situations in the best possible manner.

b) Source and retention period: The data is provided to us by you or your legal representative, when you are the one submitting the request or notification, or by third parties who submit them. We will retain the data for as long as it is necessary to process the request or incident and, thereafter, for the period required by law to defend against or file any potential claims.

c) The types of personal data wemay process about you include identifying and contact information, as well as information related to your request or issue and any other information necessary to analyze, address, and resolve the request or issue, depending on its nature.

d) Disclosure of Your Information: We share your information with the following entities and/or individuals and under the following circumstances:

Competent public authorities or agencies in the cases provided for by law, including the Spanish Data Protection Agency and the State law enforcement agencies.
Entities or individuals associated with Elzaburu to whom, if applicable, the data subject to erasure, rectification, or restriction in accordance with the provisions of Article 19 of the GDPR may have been disclosed.

In addition, the following vendors may have access to your data in connection with the services they provide to us: storage providers, providers of infrastructure for our information systems, and providers of IT maintenance, support, and office automation services

You can request more detailed information about all of these third parties with whom we may share your data by contacting the point of contact listed at the end of this website privacy policy.

e) International data transfers: None are anticipated, unless, pursuant to Article 19 of the GDPR, data must be disclosed to entities or individuals outside the EEA, in which case such international data transfer would be permitted because it is necessary for the resolution of the complaint filed.

Contact Information on Our Social Media Channels

a) Purposes and Legal Basis for Processing: Your data will be processed to interact with you on our social media platforms. This processing will be carried out at all times within the context of the respective social media platform and in accordance with and based on that platform’s Terms and Conditions.

b) Source and retention period of your data: Your personal data will consist of the information you provide, either through your profile and public posts or directly to our account on the social network, and will only be used within that platform based on your interactions with Elzaburu through the mechanisms available on the social network.

This processing will continue as long as you interact with us through the features available on the respective social media platform—for example, the “Follow,” “Connect,” “Like,” or similar buttons.

c) Types of data: The types of data we collect from you include identifying information, contact information, and any other information you choose to voluntarily provide to us through the social media platform.

d) Disclosure of Your Data: We will not share your data with third parties. However, please note that social media platforms themselves process your personal data for their own purposes—including to allow you to use that social media platform—and that they may disclose your personal data to third parties.

For more information, please refer to the privacy policy of the relevant social media platform.

e) International data transfers: We will not disclose your data to third parties outside the European Economic Area. However, please note that the platform through which you interact with us may do so; therefore, we recommend that you review the privacy notice of the relevant social media platform for more information.

GENERAL INFORMATION

a) What are your rights regarding the processing of your data?:

Right to Information: You have the right to request that Elzaburu confirm whether or not we are processing personal data concerning you and, if so, to obtain the information provided in this document.

Rights to access, correct, and delete your data: You have the right to access your personal data, as well as to request the correction of any inaccurate data or, where applicable, to request the deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.

Right to Restriction of Processing: Under certain circumstances, you may request that we restrict the processing of your data; in such cases, we will retain it solely for the purpose of asserting or defending legal claims.

Right to Object: With respect to the purposes set forth in this website privacy policy that are based on a legitimate interest or a public interest, under certain circumstances and for reasons related to your particular situation, you may object to the processing of your data, in which case we will cease processing it, unless there are compelling legitimate grounds or it is necessary for the exercise or defense of potential claims.

Right to Data Portability: Under certain circumstances, you have the right to have the data we process about you—based on the consent you have provided or pursuant to a contract entered into with you—transferred to you or directly to another company of your choice in a structured, commonly used, and machine-readable format (interoperable format).

Withdrawal of Consent: With regard to the processing of your data that we carry out based on the consent you have provided to us, you have the right to withdraw that consent at any time and free of charge. Once such withdrawal has taken place, unless there is another legal basis for the processing, it will cease; however, the withdrawal will not have retroactive effect, meaning it will not affect any processing that had already taken place up to that point.

b) How can you exercise any of the above rights to which you are entitled?

To exercise any of these rights, please contact ELZABURU, S.L.P. at the following mailing address: P.º de la Castellana, 259C, 28046 Madrid, Spain, or via email at protecciondedatos@elzaburu.es.

We also inform you that you have the right to file a complaint with the competent supervisory authority—in our case, the Spanish Data Protection Agency (www.aepd.es)—if you believe there has been any violation regarding the processing of your personal data.

c) Your participation is important:

At Elzaburu, we strive to continuously monitor, to the best of our ability, the proper use of the personal data for which we are responsible by third parties to whom we have had to provide it. For this reason, we ask that, if you become aware of or suspect that any of the entities with whom we share your data or any of our aforementioned suppliers is misusing your personal information, you notify us immediately so that we can take the appropriate action.

Furthermore, to ensure that the information we have about you is accurate and up to date, we ask that you notify us as soon as possible if there are any changes to your information (for example, a change of address or phone number, or similar), or if, for any reason, you notice that any of your information on file is incorrect, so that we can update it accordingly.

d) Security: Elzaburu has implemented appropriate security measures to ensure the integrity and confidentiality of your personal data, including, among others:

Antivirus and/or firewall.
Granting Permissions.
Periodic audits.
Encrypted communications (VPN).
Physical and/or logical access controls.
Backups and data protection.
Media Management.
Premises and/or equipment in good condition.
Appropriate policies and/or protocols.
Device Locking Protocol.
Security Manager.
Use of up-to-date software.

In addition, we are certified under ISO 27001:2022 and conduct periodic reviews of the effectiveness of the security measures we have implemented, updating, supplementing, and improving them as appropriate based on the results of relevant risk analyses of the data processing activities we carry out.

e) Point of contact for any inquiries or additional information regarding the processing of your data:

For additional information, or for any other questions regarding the processing of your data, please feel free to contact us at:

Address: P.º de la Castellana, 259C, 28046 Madrid, Spain.

Phone: 917009400

Email: protecciondedatos@elzaburu.es