Privacy policy

At ECIJA, we are committed to regulatory compliance and the protection of user privacy. In line with our duty of transparency, we outline the processing of personal data that we may carry out, as well as the rights granted by applicable regulations.

If you have any questions or require additional information, you can contact our Data Protection Officer at the following email address: dpo@ecija.com.

Who is responsible for the data?

Holder: ECIJA Verein (hereinafter, “ECIJA Verein”)
Registered address: Calle Serrano 69, 28006 Madrid.
Data Protection Officer (hereinafter, “DPO”): dpo@ecija.com

ECIJA offers its professional services in Spanish- and Portuguese-speaking markets through ECIJA Verein, an entity validly incorporated under Swiss law, comprising its various offices and associated firms.

Each of the firms that make up ECIJA Verein is a separate legal entity with its own independent legal personality, providing legal and professional services in accordance with the laws of the jurisdictions in which they operate.

ECIJA Verein itself does not provide legal services of any kind to clients and is not responsible for the actions of the firms that comprise it.

Each office or associated firm acts as the Data Controller for any data it processes independently, in accordance with the applicable data protection regulations in the jurisdiction in which it operates. Hereinafter, we will refer to all offices or associated firms as “ECIJA.”


From whom do we obtain personal data?

The personal data processed through www.ecija.com (the "Website") are provided directly by the user through the forms provided for this purpose or through the communication channels detailed in each of the sections of the site.

The user guarantees that the data provided are true, exact, complete and that the information provided is kept suitably updated, in such a way that it corresponds to the user's real situation.

In the event that the user provides third party data, he/she states that he/she has a legitimate reason for doing so and undertakes to pass on the information contained in this privacy policy, exempting ECIJA, its offices and associated firms from any liability in this regard. However, ECIJA may carry out checks to verify this fact, adopting the corresponding due diligence measures, in accordance with data protection regulations.

The data marked with an asterisk (*) on the forms provided on the Website are necessary to carry out the purpose for which the data are collected. If the user does not provide them, it will not be possible to carry out the processing (e.g. registration in events organised by ECIJA).


From whom do we obtain personal data?

The personal data processed through www.ecija.com (the “Website”) is provided directly by the user through the forms enabled for this purpose or via the communication channels detailed in each section of the Website.

The user guarantees that the data provided is true, accurate, complete, and kept duly updated, so that it reflects their actual situation.

In the event that the user provides data relating to third parties, they declare that they are legally authorized to do so and undertake to inform such third parties of the content of this privacy policy, exempting ECIJA, its offices and associated firms from any liability in this regard. However, ECIJA may carry out the necessary verifications to confirm this, applying the appropriate due diligence measures in accordance with applicable data protection regulations.

The data marked with an asterisk (*) in the forms available on the Website is necessary for the purpose for which the data is collected. If the user does not provide such data, the corresponding processing cannot be carried out (e.g., registration for events organized by ECIJA).


What categories of data do we process?

Depending on the different purposes and types of processing carried out through the Website and the contact channels specified therein, ECIJA may process the following categories of personal data:

  • Identification and contact data: name and surname, email address, postal address, and telephone number.

  • Employment-related data: professional category, job title, company of employment, and corporate contact details.

  • Academic and professional data: in cases where you send us your CV or are interested in any of the recruitment processes conducted by ECIJA offices or associated firms, data relating to education/qualifications, academic history, professional experience, and membership in professional associations may be processed.

  • Data used for profiling: information regarding the use of the Website, subscription to ECIJA’s newsletter, registration for workshops or breakfasts via the Website, requests for service information, or participation in quality surveys.

  • Browsing data: IP address, advertising ID, behavior on the Website.

  • Other data: any other data directly provided by the user in communications through the available contact channels.



For what purpose will we process personal data?

ECIJA will process the data provided by the user for the following purposes:

  • To manage and respond to contact requests made by the user, whether through the forms enabled for this purpose on the Website, corporate email addresses, or other contact methods provided.

  • To manage subscriptions to the newsletter via the ECIJA Website and to send regular electronic commercial communications about services, events, and news related to the professional activities of its various offices and associated firms, unless otherwise indicated or the user objects or withdraws consent.

  • To send regular commercial and/or promotional information related to the contracted service sector and of added value for end users, via electronic and/or conventional means, unless otherwise indicated or the user objects or withdraws consent.

  • To manage user registration and attendance at events organized by ECIJA.

  • If the user submits their CV or applies for job opportunities at ECIJA offices or associated firms published on the Website, to assess and manage the job application and, if applicable, carry out necessary actions for selection and recruitment in order to offer suitable job positions.

  • To produce anonymous statistical reports on user access habits, preferences, and behavior on the Website.

  • To create a commercial profile based on information provided by the user to ECIJA in order to send personalized commercial communications about services offered by ECIJA’s various offices and associated firms. The user may object to this processing at any time.

  • To conduct quality and satisfaction surveys regarding the services provided by ECIJA, as well as to analyze the reports and statistics derived from the responses.

  • To comply with legally established obligations, and to verify compliance with contractual obligations, including fraud prevention.


On what legal basis will we process personal data?

ECIJA processes user data based on the following legal grounds:

  • Managing and responding to contact requests: The legal basis for this processing is the user’s consent, which may be withdrawn at any time. If consent is withdrawn, the request or query cannot be addressed.

  • Sending regular commercial communications: Processing of data for marketing purposes, related to services offered by ECIJA offices and associated firms, is based on legitimate interest under the exception provided in Article 21.2 of the Information Society Services Act and Recital 47 of the GDPR. This legitimate interest is based on conducting direct marketing to offer relevant products and services and build loyalty. However, the user has the right to object at any time.

  • If the user has not previously received services from ECIJA and there is no contractual or pre-contractual relationship, the data will be processed based on the user’s consent.

  • Managing newsletter subscriptions: The legal basis for this processing is the user’s consent, which may be withdrawn at any time. If the user wishes to stop receiving communications from ECIJA, they can unsubscribe by sending an email to comunicacion@ecija.com or by clicking the link included at the bottom of each communication.

  • Managing registration and attendance at events: The legal basis is user consent, which can be withdrawn at any time.

  • Managing job applications and CVs: If the application is spontaneous, the legal basis is user consent. If it responds to a specific offer, it will be based on pre-contractual measures at the user's request.

  • Producing anonymous statistical reports: This processing is based on legitimate interest, as recognized by data protection laws. This interest is grounded in the ability to offer users the best possible quality and experience with ECIJA services.

  • Creating commercial profiles: The legal basis is legitimate interest, based on the information provided by the user and their activity on the Platform, for the purpose of sending personalized commercial communications. The user has the right to object at any time.

  • Conducting quality and satisfaction surveys: The legal basis is legitimate interest, as recognized by data protection regulations.


This legitimate interest is based on ECIJA’s aim to offer its users the highest quality services and best possible experience.
The information obtained will be deleted once the corresponding statistical report has been generated, which will under no circumstances contain personal data. Nonetheless, the user has the right to object to this processing at any time.

Compliance with legal obligations: All processing operations carried out for this purpose are based on compliance with a legal obligation.
The consents obtained for the aforementioned purposes are independent; therefore, the user may withdraw one without affecting the others.


How long do we process the data?

The user's personal data will be retained by ECIJA for the following periods:

  • Managing and responding to contact requests: Data will be kept for the time necessary to process and respond to the request and, thereafter, will be retained in a blocked state for the legal limitation period of actions arising from said request.

  • Managing newsletter subscriptions and sending commercial communications: Data will be processed until the user objects or withdraws their consent.

  • Managing registration and attendance at ECIJA events: Data will be kept as long as necessary to manage the event and, once completed, will be retained in a blocked state for the legal limitation period.

  • Job applications and CV submissions: For spontaneous applications, data will be retained for one (1) year. For specific vacancies, data will be retained until the selection process concludes or, with the user's consent, for one (1) year to participate in future recruitment processes.

  • Anonymous statistical reports on Website usage: Data will be used in aggregated form for generating reports, statistics, and analyses, and will be kept in a blocked state after this purpose is completed for the corresponding legal limitation period.

  • Creating a commercial profile: Data will be processed for this purpose until the user objects and never for more than one (1) year.

  • Quality and satisfaction surveys: Data will be retained for the duration of the surveys and subsequently kept in a blocked state for the applicable legal limitation period.

  • Compliance with legal obligations: Data will be retained for the timeframes established by applicable laws.


To whom will the data be communicated?

ECIJA informs users that their data may be shared with other offices and associated firms belonging to ECIJA Verein in order to handle their requests, manage contracted services, and provide information about services, events, and professional news. This also includes administrative and internal management purposes, based on the legitimate interest set out in Article 48 of the General Data Protection Regulation (GDPR).
These recipients may be located inside or outside the European Economic Area (EEA), depending on the geographic location of the offices and associated firms. In the latter case, appropriate legal safeguards for international data transfers will be in place.

In cases where the user registers for events organized by ECIJA and its commercial partners, service providers, or third parties, the data provided may be shared with these entities based on sufficient legal grounds, as specified in the relevant registration process.

Additionally, please note that certain data, under current regulations or within the scope of the contractual relationship, may be disclosed to:

  • Public administrations, in the cases provided by law, based on legal obligations.

  • Courts and Tribunals, where required by law.

  • Law enforcement authorities, when legally required.

  • Banks and financial institutions, for the collection of payments for services provided by ECIJA.

  • Other legal professionals, where such communication is legally required or necessary for the execution of contracted services.

Furthermore, ECIJA works with third-party service providers who may access and process the user's personal data on behalf of ECIJA. ECIJA follows strict provider selection procedures to ensure compliance with data protection obligations, including the signing of data processing agreements in accordance with Article 28 of the GDPR.


Where is personal data processed?

Given the structure of ECIJA and the geographic distribution of its offices and associated firms, the personal data provided by the user may be processed outside the European Economic Area (EEA), depending on the specific request, contractual relationship, participation in recruitment processes, or registration in events organized by such offices.

ECIJA and its associated firms have adopted the necessary legal, technical, and organizational measures to protect the personal data provided, ensuring compliance with applicable standards through the implementation of Standard Contractual Clauses in accordance with European Commission Decision 2021/914, which establishes the new set of clauses for international transfers of personal data under the General Data Protection Regulation (GDPR).

In cases where ECIJA engages service providers located outside the European Union for the maintenance of the Website, such international data transfers are covered by the aforementioned Standard Contractual Clauses, reaffirming ECIJA’s commitment to the protection, integrity, and security of users' personal data, in compliance with legal requirements.


What security measures are adopted to protect personal data?

In line with ECIJA’s commitment to protecting personal data and user privacy, the following security measures have been implemented to prevent loss, manipulation, unauthorized disclosure, or alteration:

  • Encryption of communications between the user's device and ECIJA servers.

  • Encryption of information stored on ECIJA’s own servers.

  • Other measures to prevent third-party access to user data.


What rights does the data subject have?

The user may exercise the following rights at any time and free of charge by writing to ECIJA at Calle Serrano 69, 28006 Madrid (Spain), or via email at: dpo@ecija.com:

a) Right of Access:
The user has the right to obtain confirmation from ECIJA as to whether their personal data is being processed and, if so, to access such data and receive information regarding the processing purposes, categories of data, recipients, and the anticipated retention period, among other details.

b) Right to Rectification and Erasure:
The user may request the erasure of personal data when legally appropriate, and the rectification of inaccurate data, particularly if such data is no longer necessary for the purposes for which it was collected.

c) Right to Restrict Processing, Withdraw Consent, and Object (in whole or in part):
In certain situations (e.g., when accuracy is contested), the user may request restriction of processing, in which case data will only be processed for legal claims. The user also has the right to withdraw consent or object to processing at any time for reasons related to their personal circumstances, particularly when based on legitimate interest or direct marketing. In such cases, ECIJA will cease processing unless legitimate grounds prevail.

d) Right to Data Portability:
The user has the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where legally applicable.

e) Rights in Relation to Automated Decision-Making:
Where automated decisions, including profiling, are involved, the user has the right to request human intervention, express their viewpoint, and contest the decision.

f) Additional Rights:
When data is transferred to a third country or international organization, the user has the right to be informed about the appropriate safeguards and how to obtain a copy of them.

Users may also file a complaint with the Spanish Data Protection Agency (AEPD), at C/ Jorge Juan 6, 28001 Madrid, if they believe that ECIJA has violated their data protection rights.

g) Exercising rights with offices and associated firms as independent data controllers:
If the user wishes to exercise these rights in relation to data processed by an associated office or firm acting as an independent controller, they may contact them directly via the email or address listed in the "Contact" section of the Website, in accordance with the applicable national data protection regulations.


Privacy Policy Updates

To ensure compliance with current legal requirements, ECIJA reserves the right to modify this policy as needed to align with applicable regulations at any given time.

Last updated: July 1, 2025
© ECIJA Verein. All rights reserved.