Privacy Policy

At ECIJA, we are committed to regulatory compliance and to respecting users’ privacy. In furtherance of our duty of transparency, we set out below the personal data processing activities that we may carry out, as well as the rights recognized under applicable law.

Should you have any questions or require additional information, you may contact our Data Protection Officer at dpo@ecija.com.

Who is the Data Controller?

• Owner: ECIJA Verein (hereinafter, “ECIJA Verein”)
• Registered office: Calle Serrano 69, 28006 Madrid.
• Data Protection Officer (hereinafter, “DPO”): dpo@ecija.com

ECIJA provides professional services in Spanish- and Portuguese-speaking markets through ECIJA Verein, a duly incorporated entity under Swiss law comprising its various offices and associated firms.

Each of the firms comprising ECIJA Verein is a separate legal entity, with its own independent legal personality, providing legal and professional services in accordance with the laws of the jurisdictions in which it operates.

ECIJA Verein does not itself provide legal services of any kind to clients and is not responsible for the acts or omissions of the firms that comprise it.

Each office or associated firm acts as Data Controller in respect of the data it processes independently, in accordance with the data protection regulations applicable in the jurisdiction in which it operates. Hereinafter, all offices and associated firms shall be referred to collectively as “ECIJA”.

From whom do we collect personal data?

The personal data processed through www.ecija.com (the “Website”) are provided directly by the user through the forms made available for such purpose or through the communication channels indicated in each section of the Website.

The user represents and warrants that the data provided are true, accurate, complete and duly kept up to date, so that such information reflects the user’s actual circumstances.

Where the user provides third-party data, the user represents that he or she has a lawful basis to do so and undertakes to provide such third party with the information contained in this Privacy Policy, holding ECIJA, its offices and associated firms harmless from any liability in this regard. Notwithstanding the foregoing, ECIJA may carry out such checks as are necessary to verify this circumstance, adopting the appropriate due diligence measures in accordance with data protection regulations.

Data marked with an asterisk (*) in the forms made available on the Website shall be required in order to carry out the purpose for which the data are collected. If the user does not provide such data, the relevant processing activity cannot be carried out (e.g., registration for events organized by ECIJA).

What categories of data do we process?

Taking into account the different purposes and processing activities carried out through the Website and the contact channels specified therein, ECIJA shall process the following categories of personal data:

• Identification and contact data: first name and surname, email address, postal address and telephone number.
• Employment details: professional category, job title, company for which the user provides services, and corporate contact details.
• Academic and professional data: where the user submits a CV or is interested in any recruitment process carried out by the different offices or associated firms, data relating to education/qualifications, academic record, professional experience, and membership in professional associations or bar associations may be processed in recruitment processes.
• Data used for profiling purposes: information relating to use of the Website, subscription to ECIJA’s newsletter, registration through the Website for seminars and working breakfasts, requests for information regarding services, or participation in quality surveys.
• Browsing data: IP address, advertising ID and user behavior on the Website.
• Any other data provided directly by the user in communications through the channels enabled for such purpose.

For what purposes do we process personal data?

ECIJA shall process the data provided by the user for the following purposes:

• To manage and respond to contact requests submitted by the user, whether through the forms enabled for such purpose on the Website, corporate email addresses or any other contact methods indicated.
• To manage subscriptions to the newsletter made through ECIJA’s Website, as well as to periodically send electronic commercial communications regarding services, events and news related to the professional activity of its different offices and associated firms, unless otherwise indicated or unless the user objects or withdraws consent.
• To periodically send commercial and/or promotional information related to the sector of the contracted services and value-added services for end users, by electronic and/or conventional means, unless otherwise indicated or unless the user objects or withdraws consent.
• To manage the user’s registration for and attendance at events organized by ECIJA.
• Where the user submits a CV or applies for different job vacancies of the different offices and associated firms published on the Website through the means indicated for such purpose, to assess and manage the employment application and, where applicable, to carry out the necessary actions for recruitment and hiring in order to offer positions fitting the user’s profile.
• To prepare anonymous statistical reports regarding access habits, preferences and user behavior on the Website.
• To create a commercial profile based on the information provided by the user to ECIJA in order to send personalized commercial communications regarding the services offered by the different offices and firms associated with ECIJA. The user may object at any time to the processing of his or her data for this purpose by ECIJA and to commercial actions.
• To conduct quality and satisfaction surveys relating to the quality of and satisfaction with the services provided by ECIJA, as well as to analyze the reports and statistics obtained from the responses.
• To comply with legally established obligations and to verify compliance with contractual obligations, including fraud prevention.

What is the legal basis for processing personal data?

ECIJA processes the user’s data on the following legal bases:

• To manage and respond to contact requests submitted by the user: the processing of data arising from this purpose is based on the user’s consent, which may be withdrawn at any time. If the user withdraws consent, the inquiry or request submitted may not be processed.
• To manage subscriptions to ECIJA’s newsletter made through the Website, as well as to periodically send electronic commercial communications: the processing of data for marketing purposes relating to the services of the different offices and associated firms, for their clients, shall be based on legitimate interest pursuant to the exception provided under Article 21.2 of the Spanish Law on Information Society Services and in accordance with Recital 47 of the General Data Protection Regulation. Such legitimate interest is based on direct marketing activities aimed at offering the user products and services that may be of interest and thereby promoting user loyalty. Notwithstanding the foregoing, the user has the right to object to such processing at the time of providing his or her data and at any time thereafter.

Where services have not previously been provided to the user by ECIJA and there is no prior contractual or pre-contractual relationship, the data shall be processed on the basis of the consent given by the user. Likewise, processing arising from subscription through the form enabled for receipt of newsletters that ECIJA may send shall be carried out on the basis of consent.

If the user wishes to stop receiving commercial or promotional communications from ECIJA, the user may unsubscribe by sending an email to comunicacion@ecija.com or by clicking the link included at the bottom of the commercial communications sent.

• To manage registration for and attendance at events organized by ECIJA: the processing of data arising from this purpose is based on consent, which the user may withdraw at any time.
• Where the user submits a CV or applies for different vacancies: if the application is spontaneous, the data shall be processed on the basis of consent and, where the user applies for a specific vacancy, on the basis of the implementation of pre-contractual measures at the request of the data subject.
• To prepare anonymous statistical reports regarding access habits, preferences and user behavior on the Website: all processing arising from this purpose shall be based on legitimate interest, as recognized for the data controller under data protection regulations. Such legitimate interest is based on being able to offer users ECIJA’s services with the highest possible quality and best possible experience.
• To create a commercial profile: the processing arising from this purpose is legitimized by legitimate interest based on the information provided by the user and information relating to the user’s activity on the Platform, in order to send personalized commercial communications based on the user’s tastes and preferences. Notwithstanding the foregoing, the user has the right to object to this processing at any time.
• To conduct quality and satisfaction surveys relating to quality and satisfaction: the processing arising from this purpose shall be based on legitimate interest, as recognized for the data controller under data protection regulations.

Such legitimate interest is based on being able to offer users ECIJA’s services with the highest possible quality and best possible experience. The information obtained shall be deleted once the relevant statistical report has been prepared, which shall in no case contain personal data. Notwithstanding the foregoing, the user has the right to object to this processing at any time.

• To comply with legally established obligations: all processing arising from this purpose shall be based on compliance with a legal obligation.

The consents obtained for the aforementioned purposes are independent; therefore, the user may withdraw only one of them without affecting the others.

How long do we retain personal data?

The user’s personal data shall be retained by ECIJA for the following periods:

• To manage and respond to contact requests submitted by the user: the data shall be retained for the period necessary to process and respond to the request and, thereafter, shall be blocked for the limitation period applicable to legal actions arising from such request.
• To manage subscriptions to the newsletter made through ECIJA’s Website, as well as to periodically send electronic commercial communications: the data shall be processed until the user objects to receiving such communications or withdraws consent.
• To manage registration for and attendance at events organized by ECIJA: the data shall be retained for the period necessary to manage the event and, thereafter, shall be blocked for the limitation period applicable to legal actions arising from such request.
• Where the user submits a CV or applies for different vacancies: if the application is spontaneous, the data shall be processed for a period of one year and, where the user applies for a specific vacancy, until the recruitment process has concluded.
• To prepare anonymous statistical reports regarding access habits, preferences and user behavior on the Website: the information shall be used in aggregate form for the preparation of reports, statistics and analyses for the period necessary to process and prepare such reports, statistics and/or analyses and, thereafter, shall be blocked for the limitation period applicable to legal actions arising therefrom.
• To create a commercial profile: the data shall be processed for such purpose until the user objects to the processing and, in any event, shall not relate to a period exceeding one (1) year.
• To conduct quality and satisfaction surveys relating to quality and satisfaction: the data provided for this purpose shall be retained for the duration of the surveys and, once completed, shall be blocked for the limitation period applicable to any legal actions that may arise therefrom.
• To comply with legally established obligations: the data provided in order to comply with obligations arising from the services offered by ECIJA shall be retained for the legally established periods.

To which recipients may personal data be disclosed?

ECIJA informs the user that his or her personal data may be disclosed to the other offices and associated firms of ECIJA Verein for the purpose of responding to requests, managing the services contracted, and informing the user about services, events and news related to professional activity, as well as for ECIJA administrative and management purposes, on the basis of the legitimate interest recognized under Article 48 of the General Data Protection Regulation. Such recipients may be located within or outside the European Economic Area, depending on the geographical location of the offices and associated firms; in the latter case, the relevant international data transfers shall be duly authorized under applicable law.

Where the user registers for events organized by ECIJA together with other business partners, suppliers or third parties, the data provided by the user may be disclosed, where there is a sufficient lawful basis, under the terms that may be communicated in the relevant registration processes.

In addition, please note that certain data, within the framework of applicable regulations or the contractual relationship in place, may be disclosed to:

• Public authorities, in the cases provided for by law, on the basis of compliance with a legal obligation.
• Courts and tribunals, in the cases provided for by law, on the basis of compliance with a legal obligation.
• Law enforcement authorities, in the cases provided for by law, on the basis of compliance with a legal obligation.
• Banks and financial institutions, for the collection of fees for services provided by ECIJA to its clients.
• Other legal professionals, where such disclosure is required by law or necessary for the performance of the contracted services.

Furthermore, ECIJA shall rely on the cooperation of third-party service providers that may have access to users’ personal data and that shall process such data on behalf of and for the account of ECIJA in connection with the provision of services. ECIJA follows rigorous supplier selection procedures in order to comply with its data protection obligations, including the execution of the corresponding data processing agreement pursuant to Article 28 of the GDPR.

Where are personal data processed?

In light of ECIJA’s own structure and the geographical location of its offices and associated firms, the personal data provided by the user may be processed outside the European Economic Area, depending on the requests made, the contractual relationship in place, participation in recruitment processes or registration for events organized by such offices.

ECIJA and its associated firms have adopted the necessary legal, technical and organizational measures to protect the personal data provided, ensuring the standards established under the various applicable regulations through the execution of the relevant Standard Contractual Clauses, in accordance with European Commission Decision 2021/914 on the new set of standard contractual clauses for the transfer of personal data to third countries pursuant to the General Data Protection Regulation.

Where ECIJA engages service providers for Website maintenance that are located outside the European Union, such international transfers are regularized through the execution of the aforementioned Standard Contractual Clauses, in accordance with ECIJA’s commitment to the protection, integrity and security of users’ personal data and with the applicable legal requirements.

What security measures are adopted to protect personal data?

In accordance with ECIJA’s commitment to protecting personal data and users’ privacy, the necessary security measures have been adopted to prevent loss, manipulation, disclosure or alteration of such data.

• Encryption of communications between the user’s device and ECIJA’s servers.
• Encryption of information on ECIJA’s own servers.
• Other measures aimed at preventing third-party access to users’ data.

What rights does the data subject have?

The user may, at any time and free of charge, exercise the following rights by submitting a written request to ECIJA at Calle Serrano 69, 28006 Madrid (Spain), or by email to dpo@ecija.com:

a) Right of access:

The user shall have the right to be informed by ECIJA as to whether or not ECIJA is processing his or her personal data and, where applicable, to access such data and receive information regarding the purposes of processing, the categories of data concerned, the recipients to whom the personal data have been disclosed and the envisaged retention period, among other information.

b) Right to rectification and erasure:

The user shall have the right to request the erasure of personal data where the statutory requirements are met, and the rectification of inaccurate data concerning him or her where, among other grounds, such data are no longer necessary for the purposes for which they were collected.

c) Restriction of processing, withdrawal of consent and full or partial objection to processing:

In certain circumstances, for example where the applicant contests the accuracy of his or her data while such accuracy is being verified, the user may request that the processing of his or her personal data be restricted, in which case such data shall only be processed for the establishment, exercise or defense of legal claims.

The user shall also have the right to withdraw the consent granted and to object to processing at any time, on grounds relating to his or her particular situation, where the processing is based on our legitimate interest or on the legitimate interest of a third party, including processing for direct marketing purposes and the corresponding profiling. In such case, ECIJA shall cease processing the data, unless compelling legitimate grounds are demonstrated.

d) Right to data portability:

The user shall have the right to receive the personal data that he or she has provided to ECIJA in a structured, commonly used and machine-readable format, and to transmit such data to another controller without hindrance from the controller to whom the data were provided, in the cases legally provided for such purpose.

e) Automated individual decision-making:

In addition to the aforementioned rights, where automated decisions are made, including profiling, the user shall have the right to obtain human intervention from ECIJA, to express his or her point of view and to challenge the decision.

f) Other rights:

Likewise, where personal data are transferred to a third country or to an international organization, the user shall have the right to be informed of how to access or obtain a copy of the appropriate safeguards relating to the transfer.

The user may also lodge a complaint concerning the protection of his or her personal data before the Spanish Data Protection Agency at C/ Jorge Juan, 6, 28001 Madrid, where the data subject considers that ECIJA has infringed the rights recognized under applicable data protection regulations.

g) Exercise of rights before offices and associated firms acting as independent Data Controllers:

Where the user wishes to exercise the aforementioned rights in relation to data processed directly by the offices and associated firms in their capacity as independent Data Controllers, the user may contact them through the contact email address or registered office indicated in the “Contact” section of the Website, in accordance with the national data protection regulations applicable to them.

Changes to this Privacy Policy

In order to ensure that data protection guidelines at all times comply with current legal requirements, ECIJA reserves the right to make such amendments as may be necessary to remain aligned with applicable law.

Last updated: May 23, 2024

© ECIJA Verein. All rights reserved.

Source: ECIJA Website, click here

Terms and Conditions

Terms and Conditions – Events

In accordance with applicable data protection regulations, we inform you that, as an attendee of this event organized by ECIJA Costa Rica, S.A. (ID 3-101-731963), the data you provide shall be processed for the purpose of managing the organization of, and your participation in, the event, as well as keeping you informed about services, events and news related to your professional activity that may be of interest and added value to you.

We remind you that you may object at any time to the processing of your data for such purpose by contacting ECIJA at dpo@ecija.com or through the relevant link included in the electronic communications sent.

We inform you that this event may be recorded by ECIJA and disseminated on LinkedIn, Facebook, X, Instagram and the Website. By activating your camera or microphone during the session, you authorize ECIJA to capture, fix, use and publish your image and voice, and to process your data for such purpose. If you do not wish your image and voice to be processed by ECIJA, please deactivate your microphone and camera during the session; you may still interact or submit your questions through the chat.

We remind you that you may exercise your data protection rights by submitting a written request to ECIJA Costa Rica, S.A., Torre Lexus, 3rd Floor, Avenida Escazú, San José, or by email to dpo@ecija.com, attaching a copy of your identification document.

As part of our commitment to regulatory compliance and your privacy, should you have any questions regarding the processing of your personal data, please do not hesitate to contact us. Further information is available at: https://ecija.com/politica-de-privacidad/

Source: ECIJA Website, click here

In order to ensure the highest level of transparency regarding compliance with the good practices established within the framework of our Management System, we make the following communication channels available to the general public for the purpose of resolving questions, complaints, reports of malpractice, incidents or general inquiries:

• For matters relating to privacy and the protection of personal data: dpo@ecija.com (you may consult our Privacy Policy here).
• For matters relating to information security, the use of artificial intelligence systems and business continuity: seginfo@ecija.com.

In addition, if you wish such communication to be made anonymously, you may use our whistleblowing channel through the following link.