Privacy policy

Data controller

MARTINANDINO, S.L., Spanish tax identification number B-85762318, with its address at Edificio Cuzco IV, Paseo de la Castellana, 141, 19th floor, 28046 Madrid, Spain, is the controller of the personal data covered by this policy. For questions about processing or to exercise your rights, please contact info@martinandino.com.

The firm processes data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, and Spanish Organic Law 3/2018 of 5 December on personal data protection and digital rights. The controller’s identity does not change with the language used to consult the website.

You may also write to the postal address above, marking your correspondence “Data protection”. These channels may be used for questions about this policy, updates to your personal data and requests to exercise your rights.

Scope

This policy explains the processing associated with browsing www.martinandino.com and initial enquiries sent through the firm’s contact channels. If a professional engagement is agreed, further information will be provided about the processing required to perform it.

This information does not replace specific notices provided when services are engaged, a matter is handled or data is processed outside website browsing and initial contact. Those situations depend on the purposes and circumstances of the relevant processing, including data about people other than the client where required for the matter.

Personal data

When you contact the firm, we process the identification and contact details you provide, relevant professional information and the content of your communication. Please provide only the data needed to explain your enquiry and avoid sending particularly sensitive documents or unnecessary information about third parties in an initial communication.

Depending on the enquiry, data may include names, email addresses, telephone numbers, company details, job roles and information about the matter raised. You do not need to provide all these categories for an initial enquiry: only provide what is relevant to receiving a response or assessing your request.

If your communication includes information about other people, you must have a lawful basis for sharing it and comply with any information duties that apply to you. The firm will determine its own obligations, including those applicable to information obtained from third parties. Sending information does not authorise use for unrelated purposes.

Enquiry information is obtained primarily from the person contacting the firm. Where a representative is involved, information may also come from that representative or the organisation on whose behalf they act. If the firm obtains personal data from another source, it will provide the information required by Article 14 GDPR, subject to the conditions and exceptions set out in that provision.

Purposes and legal bases

We use your data to respond to your enquiry, maintain the necessary communications and, where appropriate, consider accepting an engagement. When you request advice in your own name, processing is based on steps taken at your request before entering into a contract, under Article 6(1)(b) of the General Data Protection Regulation. For enquiries from company representatives or contacts and other professional communications, processing is based on the firm’s legitimate interest in responding and managing professional relationships, under Article 6(1)(f) and, where applicable, Article 19 of Spanish Organic Law 3/2018.

Data may also be processed to comply with legal obligations or to establish, exercise or defend legal claims, on the appropriate basis under Articles 6(1)(c) and 6(1)(f) of the General Data Protection Regulation. Browsing the website or accepting this policy does not, in itself, constitute consent to other purposes.

Pre-contractual steps apply when an individual requests action with a view to engaging services in their own name. Where a contact acts for a company, the legitimate interest concerns communications and the relationship with that entity, rather than use of their details for personal purposes unrelated to their professional role.

Legitimate interests are not an unlimited authorisation: processing must be necessary for the stated purpose and balanced against individuals’ rights and interests. Legal obligations relied upon must derive from legislation applicable to the firm or the relevant activity.

If special category data or information about criminal convictions or offences exceptionally needs to be processed, the relevant conditions under Articles 9 or 10 of the GDPR and applicable law will also be assessed. Receiving information unsolicited does not remove those requirements.

Information you provide

You provide the information needed to address an enquiry voluntarily. Without contact details or the information essential to understand it, the firm may be unable to respond or assess an engagement. Sending an enquiry does not subscribe you to marketing communications.

Where you act for an entity, your role and information verifying your authority to submit the enquiry may be needed. If further details are requested, their purpose and, where applicable, whether they are mandatory and the consequences of not providing them will be explained.

Please keep your contact details current and notify us of corrections relevant to your request. You do not need to send a copy of an identity document for an ordinary enquiry. Any additional documentation required for a professional engagement will be requested through appropriate channels.

Technical data

Providers supporting the website may process technical connection data, such as IP addresses, access dates and times, and browser or device information. To the extent that this processing is carried out on the firm’s behalf, its purpose is to enable access, maintain the website and prevent security incidents, based on the legitimate interest in operating a secure website.

This policy does not, in itself, permit technical data to be used for advertising or to assign visitors a commercial profile. If functions with other purposes are introduced, the relevant information will be provided and consent obtained where required. Information about storing or accessing information on your device is set out in the Cookie Policy.

Retention

Initial enquiry data is retained for the time needed to respond and conclude the relevant communications. If an engagement is agreed, relevant data will be processed within that professional relationship. Once the initial purpose has ended, only information required by legal obligations or to address potential liabilities will be retained for the applicable periods, with access restricted through statutory blocking where required. Technical data will be retained only as long as necessary to operate and secure the website or investigate a specific incident, taking account of their purpose and applicable obligations.

Retention depends on the nature of the enquiry, any subsequent engagement and applicable limitation or statutory retention periods. Not every communication requires all its documents to be retained for the same period. Once the relevant period ends, data will be deleted or anonymised so that the individual cannot be identified.

Where statutory blocking under Article 32 of Spanish Organic Law 3/2018 applies, data will be reserved to address liabilities arising from processing and will not be used for ordinary management of new enquiries or communications. An erasure request does not prevent retention needed to comply with a legal obligation or defend legal claims.

Recipients

Hosting, email, IT support and other necessary service providers acting on the firm’s behalf may access data for these purposes, subject to the appropriate contractual data protection obligations. Data may also be disclosed to authorities, courts or other recipients where legally required or necessary to establish, exercise or defend legal claims. Disclosures connected with a professional engagement will be subject to the information applicable to that engagement.

Providers acting as processors may access only the data needed for their contracted services and are subject to the controller’s instructions and Article 28 of the GDPR. This does not authorise them to use data for their own purposes.

Disclosures to independent controllers will be assessed according to their purpose and legal basis. Describing categories of recipients does not mean that data from every enquiry is routinely shared with all of them.

International transfers

Where processing involves international transfers outside the European Economic Area, transfers will comply with Chapter V of the General Data Protection Regulation, relying on a European Commission adequacy decision or the appropriate safeguards, including standard contractual clauses approved by the European Commission. You may request further information about transfers and, where applicable, a copy of the safeguards by contacting info@martinandino.com.

The location of a provider, its systems or its support teams may require assessment of access or disclosures from third countries. Where relevant, the firm will assess the transfer mechanism and any necessary additional safeguards. Using a technological tool does not remove these requirements.

Location and external services

The contact page includes a link to open Google Maps in a separate tab. No embedded map is loaded and visiting that page alone does not establish a connection to Google. If you follow the link, you will access the external service, and Google may receive connection data and process them under its privacy policy at https://policies.google.com/privacy.

You can view the address and contact the firm by email or telephone without accessing Google Maps. The external service’s terms and privacy options apply to processing carried out by its provider under its own responsibility.

Cookies and similar technologies

Information about cookies and other technologies that store information on or access your device is provided in the separate Cookie Policy. Technologies strictly necessary to provide a service you request are distinguished from other uses that require consent. Where consent is required, it must be given through an affirmative action and may be withdrawn using the available controls. Browsing the website or submitting an enquiry does not constitute such consent.

Automated decisions

For the processing described in this policy, the firm does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Security and confidentiality

Processing must be subject to technical and organisational measures appropriate to the risk under Article 32 of the GDPR. The assessment takes account of the nature of the data, potential harm to individuals and the systems used. Authorised persons and providers accessing information on the firm’s behalf are subject to the applicable confidentiality obligations.

Particularly sensitive documents should not be sent through a channel whose suitability has not been agreed beforehand. If you notice a misdirected communication or a potential security incident relating to the firm, please contact info@martinandino.com so that it can be assessed and appropriate action taken.

Your rights

You may exercise rights of access, rectification, erasure, objection, restriction and portability where the legal conditions apply, by writing to info@martinandino.com or the address above. In particular, you may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Please identify the right you wish to exercise and provide sufficient information to locate the relevant processing. A copy of an identity card or passport is not routinely required. If there are reasonable doubts about your identity, only the additional information necessary to confirm it will be requested, in accordance with Article 12(6) GDPR. You may act through a duly authorised representative. Requests will generally be answered within one month of receipt.

If you believe that processing breaches data protection law, you may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es, without prejudice to contacting the firm first.

Access allows you to find out whether your data is processed and obtain the relevant information and a copy where appropriate. Rectification allows inaccurate data to be corrected and incomplete data completed. Erasure and restriction apply in the circumstances set out in the GDPR and may be subject to retention needed for legal obligations or legal claims.

Portability applies to data provided by the individual where processing is based on consent or a contract and carried out by automated means. It does not apply indiscriminately to all the firm’s documents and must not adversely affect other people’s rights and freedoms.

Where you object to processing based on legitimate interests, processing will stop unless compelling legitimate grounds override your interests or the data is needed to establish, exercise or defend legal claims. Withdrawal of consent affects only processing relying on that consent.

Exercising rights is free, subject to statutory exceptions for manifestly unfounded or excessive requests. For complex or numerous requests, the response period may be extended by up to two further months; you will be informed within the first month of the extension and its reasons. If a request cannot be fulfilled, the reasons and available complaint routes will be explained.

Updates

This policy may be updated when processing activities or applicable legal requirements change. The current version will be available on this page, showing its update date.

Updates will be published accessibly. An update does not, by itself, justify a new incompatible purpose or replace information or consent that must be provided or obtained under applicable law.

If a change materially affects the processing of your data, additional information will be provided through an appropriate channel where required. Continued browsing or failure to respond to a communication will not be treated as acceptance of new processing. The Spanish and English versions provide equivalent information; legal references are to be interpreted in accordance with EU and Spanish law.