Privacy Policy

At ECIJA we are committed to regulatory compliance and respect for the privacy of users. As part of our duty of transparency, we detail the processing of personal data that we may carry out, as well as the rights recognised by current legislation.

If you have any questions or need additional information, you can contact our Data Protection Officer at the following e-mail address: dpo@ecija.com.

Who is responsible for your data?

Owner: ECIJA Verein (hereinafter referred to as “ECIJA Verein “)
Registered office: Calle Serrano 69, 28006 Madrid.
Data Protection Officer (hereinafter “DPO”): dpo@ecija.com

ECIJA offers its professional services in the Spanish and Portuguese speaking markets through ECIJA Verein, an entity validly constituted under Swiss law of which its different offices and associated firms form part.

Each of the firms that make up ECIJA Verein is a separate legal entity, with its own independent legal personality, providing legal and professional services in accordance with the laws of the jurisdictions in which it operates.

ECIJA Verein does not itself provide legal services of any kind to clients and is not responsible for the actions of its member firms.

Each of the offices or associated firms acts as Data Controller for the data it processes independently, in accordance with the data protection regulations applicable in the jurisdiction in which it operates. Hereinafter, we will refer to all offices or associated firms as “ECIJA“.

From whom do we obtain personal data?

The personal data processed through www.ecija.com (the “Website”) are provided directly by the user through the forms provided for this purpose or through the communication channels detailed in each of the sections of the site.

The user guarantees that the data provided are true, exact, complete and that the information provided is kept suitably updated, in such a way that it corresponds to the user’s real situation.

In the event that the user provides third party data, he/she declares that he/she has a legitimate reason to do so and undertakes to provide the information contained in this privacy policy, exempting ECIJA, its offices and associated firms from any liability in this regard. However, ECIJA may carry out verifications to verify this fact, adopting the corresponding due diligence measures, in accordance with data protection regulations.

The data marked with an asterisk (*) on the forms provided on the Website are necessary to carry out the purpose for which the data are collected. If the user does not provide them, it will not be possible to carry out the processing (e.g. registration in events organised by ECIJA).

What categories of data do we process?

In accordance with the different purposes and the processing carried out from the Website and the contact channels specified therein, ECIJA will process the following categories of personal data:

Identification and contact details: name and surname, e-mail address, postal address and telephone number.
Employment details: professional category, job title, company you work for and corporate contact details.
Academic and professional data: in those cases in which the user sends us his/her CV or is interested in any of the selection processes carried out by the different offices or associated firms, data relating to training/qualifications, student record, professional experience, membership of professional associations or associations, in the case of selection processes, may be processed.
Data used for profiling purposes: information related to the use of the Website, subscription to the ECIJA newsletter, registration through the Website for conferences and working breakfasts, request for information on services or participation in quality surveys.
Browsing data: IP, advertising ID, your behaviour on the Website.
Other data provided directly by the user in communications through the channels provided for this purpose.

For what purposes will we process your personal data?

ECIJA will process the data provided by the user for the following purposes:

Manage and deal with the contact requests made by the user, either through the forms provided for this purpose on the Website, corporate e-mail addresses or other forms of contact indicated.
Manage the subscription to the newsletter through the ECIJA Website, as well as periodically send electronic commercial communications about services, events and news related to the professional activity of its different offices and associated firms, unless otherwise indicated or unless the user opposes or revokes his/her consent.
To periodically send commercial and/or promotional information related to the contracted services sector and of added value for end users, by electronic and/or conventional means, unless otherwise indicated or unless the user objects or revokes their consent.
Manage your registration and attendance at events organised by ECIJA.
In the event that the user sends his/her CV or registers in the different job offers of the different offices and associated firms published on the Website, through the means indicated for this purpose, to assess and manage his/her job application and, where appropriate, to carry out the necessary actions for the selection and recruitment of personnel, in order to offer him/her positions that fit his/her profile.
To produce anonymous statistical reports regarding access habits, preferences and user behaviour on the Website.
To elaborate a commercial profile based on the information provided by the user to ECIJA in order to send him/her personalised commercial communications about the services offered by the different offices and firms associated with ECIJA. The user may object at any time to the processing of his/her data for this purpose by ECIJA and to carry out commercial actions.
To carry out quality and satisfaction surveys regarding the quality and satisfaction with the services provided by ECIJA, as well as to carry out analysis of the reports and statistics obtained from the responses.
Fulfilling legally established obligations, as well as verifying compliance with contractual obligations, including fraud prevention.

On what basis will we process your personal data?

ECIJA processes the user’s data in accordance with the following legitimate bases:

To manage and respond to contact requests made by the user: the processing of data derived from this purpose is the consent that the user may withdraw at any time. In the event that the user withdraws consent, the query or question raised cannot be processed.
Manage the subscription to the newsletter through the ECIJA Website, as well as send periodic electronic commercial communications: the processing of your data for marketing purposes, related to the services of the different offices and associated firms, for their clients, will be based on legitimate interest based on the exception provided for in article 21.2 of the Information Society Services Act and the provisions of recital 47 of the General Data Protection Regulation. The legitimate interest is based on the performance of direct marketing in order to offer the user products and services that may be of interest to him/her and thus gain his/her loyalty. However, the user has the right to object to this processing at the time he/she provides his/her data and at any time thereafter.

When the user is not previously provided with services by ECIJA and there is no previous contractual or pre-contractual relationship, the data will be processed on the basis of the consent provided by the user. On the other hand, the treatment derived from the subscription through the form provided for this purpose for the reception of the newsletters that ECIJA may send, will be carried out on the basis of consent.

In the event that the user wishes to stop receiving commercial or promotional communications from ECIJA, he/she may request cancellation of the service by sending an email to the following email address: comunicacion@ecija.com or by clicking on the link that will appear at the bottom of the commercial communications sent.

Manage your registration and attendance at events organised by ECIJA: the data processing derived from this purpose is the consent that the user may withdraw at any time.
In the event that the user submits a CV or registers for the various offers: if the application is spontaneous, the data will be processed on the basis of consent and, if the user applies for a specific offer, on the basis of the application of pre-contractual measures at the request of the data subject.
To carry out anonymous statistical reports on the access habits, preferences and behaviour of users on the Website: all processing derived from this purpose will be based on the legitimate interest recognised to the data controller by data protection regulations. This legitimate interest is based on being able to offer users ECIJA services with the highest quality and best possible experience.
To draw up a commercial profile: the processing derived from this purpose is legitimised in the legitimate interest based on the information provided by the user himself and the information relating to his activity on the Platform, in order to send personalised commercial communications, based on the user’s tastes and preferences. However, the user has the right to object to this processing at any time.
To carry out quality and satisfaction surveys regarding quality and satisfaction: the processing derived from this purpose will be based on legitimate interest, recognised by the data protection regulations for the data controller.

This legitimate interest is based on being able to offer users ECIJA services with the highest quality and best possible experience. The information obtained will be deleted once the corresponding statistical report has been drawn up, which in no case will contain personal data. However, the user has the right to object to this processing at any time.

To comply with legally established obligations: All processing derived from this purpose will be based on compliance with a legal obligation.

The consents obtained for the aforementioned purposes are independent and the user may revoke only one of them without affecting the others.

How long do we process your data?

The user’s personal data will be kept by ECIJA for the following periods:

Manage and attend to the contact requests made by the user: the data will be kept for the period necessary to process and reply to the request and, once this period is over, the data will be kept blocked for the period of limitation of the legal actions derived from the aforementioned request.
To manage the subscription to the newsletter through the ECIJA Website, as well as to periodically send electronic commercial communications: the data will be processed until the user opposes the sending of these or revokes his/her consent.
To manage your registration and attendance at events organised by ECIJA: the data will be kept for the period necessary to manage the event and, once the event is over, it will be blocked for the period of limitation of legal actions arising from the aforementioned request.
In the event that the user sends his/her CV or registers for the different offers: if the application is spontaneous, his/her data will be processed for a period of one year and, if he/she applies for a specific offer, until the end of the selection process.

To make anonymous statistical reports on the access habits, preferences and behaviour of users on the Website: the information will be used in aggregate form for the preparation of reports, statistics and analyses, for the period necessary to process and prepare the aforementioned reports, statistics and/or analyses, and, once this period has expired, the information will be kept blocked for the period of limitation of the legal actions derived from the aforementioned request.

To draw up a commercial profile: the data will be processed for this purpose until the user objects to the processing and, in no case, for a period of more than one (1) year.

To carry out quality and satisfaction surveys relating to quality and satisfaction: the data provided for this purpose will be kept for the duration of the surveys and, once the survey has ended, will be kept blocked for the period of limitation of the legal actions that may arise from the same,
To comply with the legally established obligations: the data provided to comply with the obligations derived from the services offered by ECIJA will be kept for the legally established periods.

To which recipients will your data be communicated?

ECIJA informs users that their data may be communicated to other offices and firms associated with ECIJA Verein, in order to attend to their requests, manage the services contracted and inform them about services, events and news related to the professional activity, for administrative and management purposes of ECIJA, based on the legitimate interest recognised in article 48 of the General Data Protection Regulation. The aforementioned recipients may be located within or outside the European Economic Area, depending on the geographical location of the offices and associated firms, and in the latter case, international data transfers are duly legitimised.

In those cases in which the user registers for events organised by ECIJA and other commercial partners, suppliers or third parties, the data provided by the user may be communicated, with sufficient legitimacy, in the terms that, where appropriate, are informed in the specific registration processes.

In addition, we inform you that certain data, within the framework of the regulations in force or of the contractual relationship that you maintain, may be communicated to:

Public Administrations, in the cases provided for in the law , on the basis of compliance with a legal obligation.
Courts and tribunals, in the cases provided for by law, on the basis of compliance with a legal obligation.
State Security Forces and Corps, in the cases provided for by law, on the basis of compliance with a legal obligation.
Banks and financial institutions for the collection of the services provided by ECIJA to its clients.
Other professionals in the legal field, when such communication is required by law or for the execution of the contracted services.

In addition, ECIJA will collaborate with third party service providers who may have access to your personal data and who will process your data on behalf of ECIJA in order to provide services to you. ECIJA follows rigorous supplier selection procedures in order to comply with its data protection obligations, including the subscription of the corresponding data processing contract in accordance with art. 28 of the GDPR.

Where are personal data processed?

Due to the structure of ECIJA and the geographical location of the offices and associated firms, the personal data provided by the user may be processed outside the European Economic Area, in response to the requests made, the contractual relationship maintained, participation in selection processes or registration in events organised by these offices.

ECIJA and the associated firms have adopted the necessary legal, technical and organisational measures to protect the personal data it provides, guaranteeing the standards set out in the different regulations, by subscribing to the corresponding Standard Contractual Clauses, in accordance with the European Commission Decision 2021/914, regarding the new set of standard contractual clauses for the transfer of personal data to third countries in accordance with the General Data Protection Regulation.

In those cases in which ECIJA has service providers for the maintenance of the Website that are outside the European Union, these international transfers are regularised through the signing of the aforementioned Standard Contractual Clauses, in accordance with ECIJA’s commitment to the protection, integrity and security of users’ personal data, in accordance with the established legal requirements.

What security measures are taken to protect personal data?

Based on ECIJA’s commitment to the protection of personal data and the privacy of users, the necessary security measures have been adopted to prevent their loss, manipulation, dissemination or alteration.

Encryption of communications between the user’s device and ECIJA servers.
Encryption of the information on ECIJA’s own servers.
Other measures to prevent access to user data by third parties.

What rights does the data subject have?

The user, by writing to ECIJA at Calle Serrano, 69 28006 Madrid (Spain), through the e-mail address dpo@ecija.com, at any time and free of charge, may exercise the following rights:

Right of Access:

You will have the right to be informed by ECIJA whether or not it is processing your personal data and, if so, to have access to such data and to receive information on the purposes for which they are processed, the categories of data affected by the processing, the recipients to whom your personal data were communicated and the foreseen period of data retention, among other information.

Right of rectification and deletion:

You have the right to request the deletion of personal data provided that the legal requirements are met, and the rectification of inaccurate data concerning you when, among other reasons, such data are no longer necessary for the purposes for which they were collected.

Limitation of processing, revocation of consent and total or partial objection to processing:

In certain circumstances (e.g. where the applicant disputes the accuracy of his or her data, while the accuracy of the data is being verified), he or she may request that the processing of his or her personal data be restricted and processed only for the purpose of pursuing or defending claims.

You also have the right to revoke the consent given and to object to the processing at any time, on grounds relating to your particular situation, if the processing is based on our legitimate interest or on the legitimate interest of a third party (including processing for the purpose of direct marketing and profiling). In this case, ECIJA will cease processing, unless legitimate reasons are demonstrated.

Portability of your data:

You will have the right to receive the personal data that you have provided to ECIJA in a structured, common and machine-readable format, and to be able to transmit it to another data controller without being prevented from doing so by the data controller to whom you have provided it, in the cases legally foreseen for this purpose.

Automated individual decisions:

Furthermore, in addition to the above-mentioned rights, in case of automated decisions, including profiling, you have the right to obtain human intervention by ECIJA and to express your point of view and challenge the decision.

Others:

Similarly, where personal data are transferred to a third country or to an international organisation, you have the right to be informed about how you can access or obtain a copy of the appropriate safeguards relating to the transfer.

Likewise, you may lodge a complaint regarding the protection of your personal data before the Spanish Data Protection Agency at C/ Jorge Juan, 6, 28001 – Madrid, when the interested party considers that ECIJA has infringed the rights recognised by the applicable data protection regulations.

Exercising rights with offices and associated firms as independent Data Controllers:

In those cases in which the user wishes to exercise the aforementioned rights in relation to data that are processed directly by the associated offices and firms, in their capacity as independent Data Controllers, he/she may contact them via the contact e-mail address or the address that appears in the “Contact” section of the Website, in accordance with the applicable national data protection regulations.

Changes to the privacy policy

In order to ensure that the data protection guidelines always comply with current legal requirements, ECIJA reserves the right to make changes as necessary to meet current legislation.

Last updated: 21 December 2.022.