Privacy Policy
This privacy policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), as well as, to the extent that it does not conflict with the aforementioned regulations, Organic Law 15/1999 on the Protection of Personal Data (LOPD) and its implementing regulations, and/or any laws that may replace or update them in the future.
Our organization is committed to protecting the privacy of your personal data. The personal data you provide is necessary for us to provide our services and is processed in a lawful, fair, and transparent manner, ensuring adequate security of that data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage through the implementation of technical and organizational measures.
Through this document, we wish to provide you, in a transparent and fair manner, with all the necessary information regarding this organization’s processing of your personal data.
I. DATA CONTROLLER.
IDENTITY: CONSULTORES FINANCIERO LABORALES, S.L.
Tax ID No. (C.I.F. / N.I.F.): B03664158
REGISTERED ADDRESS: C/ LA VIA, 25 BAJO, 03700 DENIA (ALICANTE)
PHONE: 966420060
E-MAIL: consultores@cflconsultores.com
DATA PROTECTION OFFICER: dpo@procoden.es
II. RECIPIENTS OF PERSONAL DATA.
1. The personal data provided will not be disclosed to any third party unless otherwise specified in the specific data processing procedures.
2. Optionally, when contracting cloud computing services and/or email, communication, and other related IT services, personal data may be:
transferred to IT service providers located within the European Economic Area (EEA) or,
In the event that any of our suppliers or service providers are located outside the European Economic Area (EEA), we guarantee that international data transfers will be carried out in accordance with applicable regulations. In particular, in the case of providers located in the United States, such transfers may be covered by the EU-U.S. Data Privacy Framework (EU-U.S. Data Privacy Framework, https://www.dataprivacyframework.gov), the adequacy of which was recognized by the European Commission on July 10, 2023, or under standard contractual clauses approved by the European Commission.
3. Optionally, to government agencies and other entities when required to comply with
legal obligations.
III. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA. For each specific instance of personal data processing, we will inform you of the legal basis that authorizes it.
IV. RIGHTS.
4.1. RIGHT OF ACCESS.
It is the right to obtain confirmation from the data controller as to whether or not personal data concerning the data subject are being processed and, if so, the right to access the personal data and the following information: the purposes of the processing, the categories of personal data involved, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the retention period or the criteria used to determine that period, the existence of the right to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning the data subject or to object to such processing, the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the existence, where applicable, of automated decision-making, including profiling; and, when data is transferred to third countries, the right to be informed of the appropriate safeguards applied.
4.2. RIGHT TO CORRECTION.
You have the right to request the correction of your personal data if it is inaccurate, including the right to complete any information that is incomplete. Please note that by providing us with your personal data through any means, you guarantee that it is true and accurate and agree to notify us of any changes or modifications to it. Therefore, any damage caused by providing erroneous, inaccurate, or incomplete information on the website’s forms will be the sole responsibility of the individual concerned.
4.3. RIGHT TO ERASURE.
This is the right to request the erasure of your personal data when, among other circumstances, it is no longer necessary for the purpose for which it was collected, or is being processed for other purposes, or you withdraw your consent. Please note that erasure will not apply when the processing of personal data is necessary, among other cases, to comply with legal obligations or to establish, exercise, or defend legal claims.
4.4. RIGHT TO RESTRICTION.
This is the right to request that the processing of your personal data be restricted, which means that, in certain cases, you may ask us to temporarily suspend the processing of your personal data or to retain it beyond the necessary period when you may need it.
4.5. RIGHT TO WITHDRAW CONSENT.
You have the right to withdraw the consent you provided by signing—either by hand or digitally—at any time, as specified in the corresponding section “Exercising Your Rights” or in the specific terms regarding the processing of marketing communications or newsletters. Please note that this right will not apply if, among other cases, the processing of personal data is necessary for compliance with a legal obligation, the performance and maintenance of a contractual relationship, or for the establishment, exercise, or defense of legal claims. Furthermore, the withdrawal of consent will not have
retroactive effect; that is, it will not affect the lawfulness of processing based on consent given prior to its withdrawal.
4.6. RIGHT TO DATA PORTABILITY.
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller, provided that: the processing is based on your consent and is carried out by automated or computerized means.
4.7. RIGHT TO OBJECT.
This is your right to object to the processing of your personal data based on our legitimate interest. We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
4.8. RIGHT TO FILE A COMPLAINT WITH A SUPERVISORY AUTHORITY.
If you believe we are processing your personal data incorrectly, you may contact us or you also have the right to file a complaint with the Spanish Data Protection Agency (AEPD):
https://www.agpd.es/portalwebAGPD/index-ides-idphp.php
4.9. EXERCISING YOUR RIGHTS.
You may exercise your rights by sending a letter to the mailing address listed above or by emailing consultores@cflconsultores.com; in both cases, please attach a copy of your Tax ID Number (NIF), Foreign Resident ID Number (NIE), passport, or similar document.
V. SECURITY MEASURES
The data controller implements appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of the data.
VI. PROCESSING OF PERSONAL DATA.
6.1. GENERAL PROVISIONS.
The personal data requested for each specific processing activity is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed, thereby complying with the principle of data minimization.
The personal data requested for each specific processing activity is strictly necessary; refusal to provide it would mean that we would be unable to provide the requested service.
The disclosure of personal data provided for in each specific processing activity is, in some cases, necessary for the performance and maintenance of a contract and, in other cases, for compliance with a legal obligation applicable to the data controller.
6.2. BASIC TREATMENTS.
INVOICING The personal data included in the invoice will be processed for accounting, tax, and administrative purposes; to comply with legal and contractual obligations; and to contact the customer or supplier in the event of issues or to clarify details regarding the invoice.
The legal basis for the processing of personal data is the performance of the contract or the provision of the service indicated on the invoice, as well as compliance with legal obligations regarding tax, accounting, and commercial matters, and the legitimate interest of the data controller in properly managing the commercial and administrative relationship.
No transfers of data to third parties are anticipated, except where required by law or where necessary for the provision of the service. In the latter case, the data may be processed by third parties that provide services to the data controller (such as consulting firms, technology providers, or financial institutions), with whom the corresponding data processing agreements have been signed, ensuring the confidentiality and security of the information. Data will be transferred to public authorities with fiscal or tax jurisdiction, as well as to banks for the processing of payments or collections.
No international data transfers are anticipated.
The data is obtained directly from the data subject or the service provider who performed the transaction. No data is obtained from external sources, and no particularly sensitive data is processed unless express consent is given or there is a legal obligation to do so.
Personal data will be retained for as long as the relationship between the parties continues or for as many years as necessary to comply with legal obligations.
EMAIL
The personal data included in the email will be processed to maintain communications related to inquiries, requests for information, quotes, orders, deliveries, billing, or support. To manage the contractual, precontractual, or commercial relationship.
The legal basis for the processing of personal data is the performance of precontractual measures or a contract when it relates to a request for a quote, an order, an invoice, or an incident (Art. 6.1.b GDPR). Consent from the data subject to receive certain types of communications (Art. 6.1.a GDPR). Legitimate interest in responding to inquiries (Art. 6.1.f GDPR).
Data will not be disclosed to third parties, except to email and cloud storage providers, or to third-party companies when it is necessary to disclose the data to process the request (carriers, administrative agencies, banks) or when required by law.
International data transfers from GOOGLE, LLC. take place when using the email application, GMAIL. Data processors: IT services.
Data is collected directly from the data subject or from authorized sources in connection with the provision of services or products. Data is not obtained from third parties without consent, nor is particularly sensitive data processed unless expressly authorized.
Personal data will be retained for as long as necessary to fulfill the purpose for which it was collected, and for as long as legal liabilities may arise from such processing; after that period ends, the data will be retained for an additional two years, without prejudice to your right to exercise your rights as a data subject.
PROFESSIONAL ORDER FORM.
The client’s personal data will be processed to formalize and manage the professional relationship arising from the engagement letter, to provide the contracted services and monitor their performance, to carry out related administrative, accounting, and tax management, and to comply with legal and ethical obligations arising from professional practice.
The legal basis for the processing of personal data is the express consent provided upon signing the corresponding professional engagement letter, the performance of the contract, and compliance with legal obligations.
As a necessary contractual requirement, personal data will be disclosed to external partners and agencies, public officials, public registries, and other third parties in general to ensure the successful completion of the assignment, as well as to third-party companies for the provision of services to the consulting/advisory firm.
Personal data is obtained directly from the client or the legal representative through the signed professional engagement letter, prior communications by phone, email, or web form. Data is not obtained from external sources, nor is particularly sensitive data processed, except when it is essential for the contracted service, in which case explicit consent will be requested.
Personal data will be retained until you withdraw your consent, unless it must be retained to maintain the relationship between the parties or for the number of years necessary to comply with legal obligations. In the case of sensitive data, such as health or legal matters, it will be retained for the periods established by sector-specific regulations.
CLIENT REGISTRATION – CONSULTING.
The personal data of the data subjects (including that contained in their digital certificate) will be processed for the following purposes:
Clients: Management of appointments, collections, payments, billing, and monitoring the relationship between the parties. Tax Consulting: Handling tax matters with the relevant authorities through any authorized procedure, including electronic filing, as well as any other formalities or procedures that may be necessary to successfully complete the assignment;
Labor Consulting: Management of payroll and Social Security, occupational risk prevention, oversight of health monitoring services, as well as other related services.
Administrative Services: Management of permits, vehicles, certificates, as well as other related services. Legal Services: Assistance and management of legal matters across various areas of law—including civil, commercial, labor, and tax law, among others—and at all stages of legal proceedings.
The legal basis that legitimizes the processing of personal data is the express consent provided by signing the corresponding authorization for the processing of personal data, as well as the performance of a service agreement and compliance with legal obligations.
As a necessary contractual requirement, personal data may be disclosed to external partners and, in compliance with legal obligations, to government agencies, public officials, public records, as well as any third party, in general, necessary for the successful completion of the assignment.
The data is provided directly by the customer or the customer’s legal representative via the registration form.
Personal data will be retained until you withdraw your consent, unless it must
be retained to maintain the relationship between the parties or for the number of years necessary to comply with legal obligations.