1. DATA CONTROLLER INFORMATION

Company Name: APNA ADVOCATS, S.L.P. (hereinafter, the “Company” or the “Controller”).

Tax ID: B67183491

Address: Plaza Tetuán, No. 40-41, 1st Floor – Office 1, Postal Code 08010 Barcelona – Spain

Telephone: +34 936 32 32 36 Email for communications regarding Data Protection: info@martinezcaballero.com or our Data Protection Officer: equaldpo@equalprotecciondedatos.com.

1.1. Applicable Regulations

Our Privacy Policy has been designed in accordance with the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights.

By providing us with your data, you declare that you have read and are aware of this Privacy Policy, giving your unequivocal and express consent to the processing of your personal data in accordance with the purposes and terms expressed herein.

The Company may modify this Privacy Policy to adapt it to legislative, jurisprudential, or interpretative developments of the Spanish Data Protection Agency. These privacy conditions may be supplemented by the Legal Notice, Cookie Policy, and General Conditions that, where applicable, are provided for certain services, such as online consultations, if such access involves any special features regarding the protection of personal data.

2.- PRINCIPLES IN ACCORDANCE WITH THE EUROPEAN DATA PROTECTION REGULATION

We undertake to process the personal data (hereinafter “data”) provided in accordance with the following principles set out in the General Data Protection Regulation (GDPR):

• Lawfulness: we will only collect your personal data for specific, explicit, and legitimate purposes, and will not process your personal data in a manner incompatible with those purposes.

• Legality: in accordance with Article 6 of the General Data Protection Regulation, your personal data will be processed whenever you give your express consent to the processing of such data as a manifestation of your will and free and informed consent. Your personal data may be necessary to formalize a contract, agreement, or service to which the data subject is a party, to comply with legal obligations, to protect the vital interests of the data subject and another natural person, to fulfill a task carried out in the public interest or in the exercise of official authority vested in the controller, or to satisfy the legitimate interests pursued by the controller when these do not override the fundamental rights and freedoms of the data subject or the protection of the data subject’s personal data.

• Fairness and transparency: in accordance with Article 5 of the General Data Protection Regulation as a manifestation of transparency, evidenced by the fact that the data subject is informed of the existence of the processing operation and its purposes.

• Data minimization: we limit the collection of personal data to what is strictly relevant and necessary for the purposes for which it has been collected.

• Purpose limitation: we will only collect your personal data for specific, explicit, and legitimate purposes, and we maintain the manner in which we process it.

• Accuracy: we will keep your personal data accurate and up to date.

• Data security: we apply appropriate technical and organizational measures to ensure an adequate level of security taking into account the risks and nature of the data in order to prevent them from being disclosed or accessed by unauthorized personnel, or in the event of any loss or alteration. In short, any form of unlawful processing.

• Any person who, having given their consent to the collection of data, wishes to request any action regarding the processing, is recognized and may exercise: the right of access, rectification, objection, erasure, restriction of processing, portability, and not to be subject to individualized decisions. Its exercise will be free of charge and such request will be addressed within one month, extendable by a further two months in exceptional circumstances such as, for example, the number of requests, complexity, or other similar circumstances.

• Principle of storage limitation: data will be kept for the time necessary and for the purposes of processing without undue delay, and during which the data of users and clients will be available to them upon request.

3. PURPOSE OF PERSONAL DATA PROCESSING

The processing we carry out of your personal data responds to the following purposes:

– To provide you with information related to legal services offered by our firm and detailed on this website.

– To manage social media. The Controller has a presence on social media. If you become a follower on the Controller’s social media, the processing of personal data will be governed by this section, as well as by those terms of use, privacy policies, and access regulations that belong to the relevant social network in each case and that you have previously accepted.

3.1. Data Retention Period

We will retain your personal data from the time you give us your consent until you revoke it or request restriction of processing. In such cases, we will keep your data blocked for the legally required periods.

In the event of contracting the firm’s services, the information provided by the client will be previously authorized by them, with the company fulfilling the duty of information set out in Articles 13 and following of the GDPR, and will be kept for the time necessary to provide the service, and in any case during the mandatory legal limitation period.

4. LEGAL BASIS AND DATA COLLECTED

The legal basis for processing your data is the express consent given through a positive and affirmative act (completing the relevant form and checking the acceptance box of this policy or calling or sending an email providing your data for a consultation) at the time of providing us with your personal data.

4.1. Consent to process your data

By completing the forms, checking the box “I accept the Privacy Policy” and clicking to submit the data, or by sending emails to the Company through the accounts enabled for this purpose, the User declares that they have read and expressly accepted this privacy policy, and gives their unequivocal and express consent to the processing of their personal data in accordance with the purposes indicated.

4.2. Categories of data

The data collected refers to the category of identifying data, such as: Name, Telephone, Email, as well as the IP address from which the data collection form is accessed.

Only in the event of contracting our services may it be necessary to process special category data, obtaining prior express consent for this purpose.

5. SECURITY MEASURES

As part of our commitment to guarantee the security and confidentiality of your personal data, we inform you that the necessary technical and organizational measures have been adopted to ensure the security of personal data and prevent their alteration, loss, processing, or unauthorized access, taking into account the state of technology, the nature of the data stored, and the risks to which they are exposed, in accordance with Article 32 of GDPR EU 679/2016.

6. DATA DISCLOSURE

No data disclosures or international data transfers are foreseen for data collected through this website, except those authorized by tax, commercial, and telecommunications legislation, as well as in cases where a judicial authority requires it.

7. USER RIGHTS

Any data subject has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, request their erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected. In certain circumstances, data subjects may request restriction of processing of their data, in which case we will only retain them for the exercise or defense of claims. For reasons related to their particular situation, data subjects may object to the processing of their data. The Controller will cease processing the data, except for compelling legitimate grounds, or the exercise or defense of possible claims.

We also remind you that, if you are a client, you may revoke your consent or object to receiving commercial communications by any means and at any time, by sending an email to info@martinezcaballero.com or our Data Protection Officer: equaldpo@equalprotecciondedatos.com.

If you consider that your request has not been properly addressed or your data is not being processed appropriately, you may direct your complaints to the Spanish Data Protection Agency, the supervisory authority in this matter in Spain.

Below, we provide you with detailed information about the aforementioned rights, with direct access to their exercise using the links of the Spanish Data Protection Agency:

A)- RIGHT OF ACCESS

Article 15 of the General Data Protection Regulation recognizes the right of the data subject to know whether their personal data is being processed or not and the purposes of the processing, the categories of data, the recipients, the origin of the data, the retention period, and the criteria for determining such period. Thus, the data controller will provide a copy of the personal data being processed in electronic format upon submission of the request.

They may also request from the controller: rectification, erasure, or restriction of data and processing.

In order to facilitate the exercise of this right, we provide you through the following link the form you must complete for your request:

https://www.aepd.es/media/formularios/formulario-derecho-de-acceso.pdf

B)- RIGHT OF RECTIFICATION AND ERASURE

Articles 16 and 17 of the General Data Protection Regulation establish regarding rectification and erasure of personal data that the client or user may request the rectification of their personal data if they consider them inaccurate or that they be completed or deleted if they are not necessary for the purposes for which they were collected and processed.

In order to facilitate the exercise of this right, we provide you through the following link the form you must complete for your request:

https://www.aepd.es/media/formularios/formulario-derecho-de-rectificacion.pdf

https://www.aepd.es/media/formularios/formulario-derecho-de-supresion.pdf

C)- RIGHT TO RESTRICTION OF PROCESSING

The data subject shall have the right to obtain from the controller restriction of processing of the data whenever they contest the accuracy of the personal data. That is, the data may only be processed, with the exception of storage, with the data subject’s consent, for the exercise or defense of claims, to protect the rights of another natural or legal person, or for reasons of public interest of the Union or of a particular Member State. In addition, they will be informed by the controller before the lifting of such restriction.

In order to facilitate the exercise of this right, we provide you through the following link the form you must complete for your request:

https://www.aepd.es/media/formularios/formulario-derecho-de-limitacion.pdf

1. D)- RIGHT TO DATA PORTABILITY

Article 20 of the General Data Protection Regulation recognizes the right of the data subject to receive the personal data concerning them, that is, to have it transmitted directly from controller to controller where technically feasible, in a structured, commonly used, and machine-readable format without hindrance from the controller to whom it was provided, when consent has been expressly given or there is a contract.

In order to facilitate the exercise of this right, we provide you through the following link the form you must complete for your request:

https://www.aepd.es/media/formularios/formulario-derecho-de-acceso.pdf

8. CONFIDENTIALITY

The personal data that may be collected will be processed with absolute confidentiality, with the Company undertaking to maintain secrecy regarding them and guaranteeing the duty to keep them by adopting all necessary measures to prevent their alteration, loss, and unauthorized processing or access, in accordance with applicable legislation.

To this end, the Controller guarantees that it will maintain signed confidentiality commitments with any persons involved in any phase of the processing of the personal data collected.

9. INTERNATIONAL DATA TRANSFERS

International Data Transfer is understood as the communication of your personal data to countries located outside the European Union, and more specifically outside the European Economic Area (EEA). There are exceptions for countries outside this European area that are not considered an international transfer as the recipient countries are considered adequate by the European Data Protection Commission for complying with European standards on data protection.

In the event that the Company transfers personal information outside the EEA, either because data storage is hosted on a server outside the borders of the EEA, or for any other reason, it ensures that the contractual clauses regulating such international transfer will be maintained, ensuring that the provider that may host or process personal information complies with the minimum security standards and principles set out in the GDPR.