1. INFORMATION ABOUT THE DATA CONTROLLER

Company Name: APNA ADVOCATS, S.L.P. (hereinafter, the “Company” or the “Data Controller”).

Tax ID: B67183491

Address: Plaza Tetuán, No. 40-41, 1st Floor – Office 1, 08010 Barcelona, Spain

Phone: +34 936 32 32 36 Email for communications regarding data protection: info@martinezcaballero.com or our Data Protection Officer: equaldpo@equalprotecciondedatos.com.

1.1. Applicable Regulations

Our Privacy Policy has been designed in accordance with the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council, dated April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and Organic Law 3/2018 of December 5, on the Protection of Personal Data and the Guarantee of Digital Rights.

By providing us with your information, you acknowledge that you have read and understand this Privacy Policy and give your unequivocal and express consent to the processing of your personal data in accordance with the purposes and terms set forth herein.

The Company may modify this Privacy Policy to bring it into line with new legislation, case law, or interpretations by the Spanish Data Protection Agency. These privacy terms may be supplemented by the Legal Notice, Cookie Policy, and General Terms and Conditions that, where applicable, are provided for certain services—such as online consultations—if such access involves any specific requirements regarding the protection of personal data.

2. PRINCIPLES IN ACCORDANCE WITH THE EUROPEAN DATA PROTECTION REGULATION

We are committed to processing the personal data (hereinafter the “data”) provided in accordance with the following principles set forth in the General Data Protection Regulation (GDPR):

• Lawfulness: We will collect your Personal Data only for specific, explicit, and legitimate purposes, and we will not process your Personal Data in a manner incompatible with those purposes.

• Lawfulness: In accordance with Article 6 of the General Data Protection Regulation, your personal data will be processed provided that you give your express consent to the processing of such data as an expression of your free and informed will and consent. Your personal data may be necessary to enter into a contract, agreement, or service to which you are a party; to comply with legal obligations; to protect the vital interests of the data subject or another natural person, to fulfill a mission in the public interest, or in the exercise of public authority vested in the data controller, or to satisfy the legitimate interests pursued by the data controller when such interests do not infringe upon the fundamental rights and freedoms of the data subject or the protection of the data subject’s personal data.

• Loyalty and transparency: In accordance with Article 5 of the General Data Protection Regulation, transparency is demonstrated by informing the data subject of the existence of the processing operation and its purposes.

• Data minimization: We limit the collection of personal data to what is strictly relevant and necessary for the purposes for which it was collected.

• Purpose Limitation: We will collect your personal data only for specific, explicit, and legitimate purposes, and we will maintain these purposes when processing it.

• Accuracy: We will keep your personal information accurate and up to date.

• Data Security: We implement appropriate technical and organizational measures to ensure an adequate level of security, taking into account the risks and the nature of the data, in order to prevent its disclosure or unauthorized access, as well as any loss or alteration. In short, we prevent any form of unlawful processing.

• Any person who, having given consent to the collection of data, wishes to request any action regarding the processing of that data, is recognized as having the right to exercise the following rights: the right of access, rectification, objection, erasure, restriction of processing, data portability, and the right not to be subject to automated individual decision-making. Exercising these rights is free of charge, and such requests will be addressed within one month, which may be extended by an additional two months in exceptional circumstances, such as the number of requests, their complexity, or other similar factors.

• Principle of data retention limitation: Data will be retained for as long as necessary for the purposes of processing, without undue delay, and during that time, users’ and customers’ data will be made available to them upon request.

3. PURPOSE OF PERSONAL DATA PROCESSING

We process your personal data for the following purposes:

– To provide you with information about the legal services offered by our firm, as detailed on this website.

-To manage social media. The Data Controller maintains a presence on social media. If you follow the Data Controller on social media, the processing of your personal data will be governed by this section, as well as by the terms of use, privacy policies, and access rules of the applicable social media platform in each case, which you have previously accepted.

3.1. Retention Period for Your Data

We will retain your personal data from the time you provide your consent until you revoke it or request that we restrict its processing. In such cases, we will keep your data on hold for the periods required by law.

If you engage the firm’s services, any information provided by the client will be authorized by the client in advance, and the firm will comply with the duty to inform set forth in Articles 13 et seq. of the GDPR, and will be retained for as long as necessary to provide the service, and in any event for the mandatory statutory limitation period.

4. LEGITIMACY AND DATA COLLECTED

The legal basis for the processing of your data is the express consent you provide through a positive and affirmative action (filling out the corresponding form and checking the box to accept this policy, or calling or sending an email with your information to make an inquiry) at the time you provide us with your personal data.

4.1. Consent to Process Your Data

By filling out the forms, checking the box “I Accept the Privacy Policy,” and clicking to submit the information, or by sending emails to the Company through the accounts provided for that purpose, the User confirms that they have read and expressly accepted this privacy policy, and grants their unequivocal and express consent to the processing of their personal data in accordance with the stated purposes.

4.2. Data Categories

The data collected falls under the category of identifying information, such as: name, phone number, email address, as well as the IP address from which you access the data collection form.

Only if you contract our services may it be necessary to process special-category data, in which case we will first obtain your express consent to do so.

5. SAFETY MEASURES

As part of our commitment to ensuring the security and confidentiality of your personal data, we hereby inform you that we have implemented the necessary technical and organizational measures to ensure the security of personal data and prevent its alteration, loss, or unauthorized processing or access, taking into account the state of the art, the nature of the data stored, and the risks to which it is exposed, in accordance with Article 32 of the GDPR (EU Regulation 679/2016).

6. DATA TRANSFER

We do not anticipate any disclosure or international transfer of the data collected through this website, except as authorized by tax, commercial, and telecommunications laws, or in cases where a judicial authority requires us to do so.

7. USER RIGHTS

Any data subject has the right to obtain confirmation as to whether or not we are processing personal data concerning them. Data subjects have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected. Under certain circumstances, data subjects may request the restriction of the processing of their data, in which case we will retain it solely for the purpose of exercising or defending legal claims. For reasons related to their particular situation, data subjects may object to the processing of their data. The Data Controller will cease processing the data, except for compelling legitimate grounds or the exercise or defense of potential claims.

We would also like to remind you that, if you are a customer, you may revoke your consent or object to receiving marketing communications by any means and at any time by sending an email to info@martinezcaballero.com or to our Data Protection Officer at: equaldpo@equalprotecciondedatos.com.

If you believe that your request has not been handled properly or that your personal data is not being processed appropriately, you may file a complaint with the Spanish Data Protection Agency, the regulatory body responsible for this matter in Spain.

Below, we provide additional information about these rights, with direct access to the procedures for exercising them via the links provided by the Spanish Data Protection Agency:

A) — RIGHT OF ACCESS

Article 15 of the General Data Protection Regulation recognizes the data subject’s right to know whether or not their personal data is being processed, as well as the purposes of the processing, the categories of data, the recipients, the source of the data, the retention period, and the criteria for determining that period. Accordingly, the data controller shall provide a copy of the personal data being processed in electronic format upon receipt of a request.

They may also request from the data controller: the rectification, erasure, or restriction of data and processing.

To make it easier for you to exercise this right, we are providing the form you must complete to submit your request via the following link:

https://www.aepd.es/media/formularios/formulario-derecho-de-acceso.pdf

B) — RIGHT TO CORRECTION AND DELETION

Articles 16 and 17 of the General Data Protection Regulation establish, with regard to the rectification and erasure of personal data, that a customer or user may request the rectification of their personal data if they consider it to be inaccurate, or request that it be completed or erased if it is no longer necessary for the purposes for which it was collected and processed.

To make it easier for you to exercise this right, we are providing the form you must complete to submit your request via the following link:

https://www.aepd.es/media/formularios/formulario-derecho-de-rectificacion.pdf

https://www.aepd.es/media/formularios/formulario-derecho-de-supresion.pdf

C) – RIGHT TO RESTRICTION OF PROCESSING

The data subject has the right to obtain from the data controller the restriction of data processing whenever he or she challenges the accuracy of the personal data. That is, the data may only be processed—with the exception of storage—with the data subject’s consent, for the purpose of asserting or defending legal claims, protecting the rights of another natural or legal person, or for reasons of public interest of the Union or of a specific Member State. In addition, the data subject will be informed by the controller before such restriction is lifted.

To make it easier for you to exercise this right, we are providing the form you must complete to submit your request via the following link:

https://www.aepd.es/media/formularios/formulario-derecho-de-limitacion.pdf

1. D) – RIGHT TO DATA PORTABILITY

Article 20 of the General Data Protection Regulation recognizes the data subject’s right to receive the personal data concerning him or her, that is, to have it transmitted directly from one controller to another whenever technically feasible, in a structured, commonly used, and machine-readable format, without obstruction by the controller to whom the data was originally provided, when consent has been expressly granted or a contract is in place.

To make it easier for you to exercise this right, we are providing the form you must complete to submit your request via the following link:

https://www.aepd.es/media/formularios/formulario-derecho-de-acceso.pdf

8. CONFIDENTIALITY

Any personal data that may be collected will be treated with absolute confidentiality; the Company undertakes to maintain the confidentiality of such data and guarantees its protection by taking all necessary measures to prevent its alteration, loss, or unauthorized processing or access, in accordance with applicable law.

To this end, the Data Controller guarantees that it will ensure that the relevant confidentiality agreements are signed by any individuals involved in any phase of the processing of the collected personal data.

9. INTERNATIONAL DATA TRANSFERS

An “International Data Transfer” is defined as the transfer of your personal data to countries located outside the European Union, and more specifically outside the European Economic Area (EEA). There are exceptions for countries outside this European area that are not considered international transfers, as the recipient countries are deemed adequate by the European Data Protection Commission for complying with European data protection standards.

In the event that the Company transfers personal information outside the EEA—whether because the data is stored on a server outside the EEA or for any other reason— it is ensured that the contractual clauses governing such international transfers will be in place, ensuring that any provider that may host or process personal information complies with the minimum security standards and principles set forth in the GDPR.