Privacy Policy

PRIVACY POLICY – EXTENDED INFORMATION 

Last updated: 06/10/2025 

This Privacy Policy forms an integral part of the General Terms and Conditions governing this website. 

 Who is the Data Controller? 

Uhy Fay & Co Group S.L. Tax ID: B06943443 

Data Protection Officer (DPO) contact: dataprotection@uhy-fay.com 

Registered address: Calle Serrano 1, 4th Floor, 28001 Madrid, Spain. 

Phone: +34 914 260 723 

You may contact us through any of these channels. 

We reserve the right to modify or adapt this Privacy Policy at any time. We encourage you to review it periodically and, if you are a registered user accessing your account or profile, you will be notified of any changes. 

If you belong to any of the following groups, please see the relevant information: 

+ PROFESSIONAL COLLABORATORS  

For what purposes will we process your personal data? 

• Collaborating with other professionals to provide advisory services. 

• Monitoring your activity. 

• Carrying out the relevant transactions. 

• Invoicing and filing the relevant tax returns. 

• Control and debt recovery management. 

What is the legal basis for processing your data? 

The legal basis is contractual. 

+ WEBSITE OR EMAIL CONTACTS 

What data do we collect through the website? 

We may anonymously process your IP address, the operating system or browser you use, and even the duration of your visit. 

If you provide us with data through the contact form, you will be identifying yourself so that we can contact you, should it be necessary. 

For what purposes will we process your personal data? 

• Responding to your enquiries, requests or applications. 

• Managing the requested service, responding to your request or processing your application. 

• Sending information by electronic means regarding your request. 

• Sending commercial or event information by electronic means, provided there is express authorisation. 

• Analysing and improving the website and our products and services. Improving our commercial strategy. 

What is the legal basis for processing your data? 

The acceptance and consent of the data subject: where making a request requires completing a form and clicking the submit button, doing so necessarily implies that you have been informed and have expressly given your consent to the content of the clause attached to that form or accepted the privacy policy. 

All our forms mark mandatory fields with an asterisk (*). If you do not complete these fields, or do not tick the checkbox accepting the privacy policy, the information cannot be submitted. It usually reads as follows: “I am over 14 years of age and have read and accept the Privacy Policy.” 

You may withdraw your consent at any time. 

+ CONTACTS AND POSTS THROUGH SOCIAL MEDIA – EVENTS 

What data do we collect? 

We may process identification data such as name, surname and social media username, as well as images, photographs, and audio and video recordings captured during events organised by the firm. 

Participation in these events may involve the capture of images or videos for informational or corporate communication purposes. In any case, images or recordings in which the data subject is identifiable will only be made public with their prior express consent, which may be given by ticking a specific box (“checkbox”) on the registration forms or by written authorisation at the event itself. 

Where general or ambient images are captured, in which individuals are not the main focus and are not clearly identifiable, processing will be based on the legitimate interest of the firm 

For what purposes will we process your personal data? 

• Managing and responding to requests, enquiries or communications received through web forms or social media. 

• Publishing images, recordings and other content related to the firm’s events. 

• Promoting the firm’s activities, products and services through social media and corporate channels. 

• Carrying out advertising and marketing activities in digital media. 

What is the legal basis for processing your data? 

• Consent of the data subject: for managing requests sent through the website forms and for the public dissemination of images or recordings in which individuals are identifiable, subject to ticking the corresponding box or signing an authorisation. 

All our forms mark mandatory fields with an asterisk (*). If you do not complete these fields, or do not tick the checkbox accepting the privacy policy, the information cannot be submitted.  

• Our legitimate interest: for capturing and disseminating incidental or ambient images at events, provided this does not infringe the rights and freedoms of the data subjects.  

You may withdraw your consent at any time. 

+ NEWSLETTER SUBSCRIBERS 

What data do we collect through the newsletter? 

You can subscribe to our Newsletter on the website: if you provide us with an email address, it will be sent to you. It is only sent to active clients; it is not advertising but contains legislative updates, and it is included as a service under the contract you sign. 

We will only store your email address in our database and will send you emails periodically until you unsubscribe or we stop sending them. 

The Newsletter may contain a web beacon, which gives us statistical confirmation of whether you have opened it, at what time and how many times. This helps us identify the best times to send it and what interests you. 

You will always have the option to unsubscribe in any communication. 

For what purposes will we process your personal data? 

• Managing the requested service. 

• Sending information by electronic means regarding your request. 

• Sending commercial or event information by electronic means, where there is a legal basis to do so.  

• Analysing and improving our email campaigns to enhance our commercial strategy. 

What is the legal basis for processing your data? 

The acceptance and consent of the data subject within the framework of a contractual relationship. Please note that you may withdraw your consent at any time.  

The Newsletter is an information service we provide to you as a client (contractual relationship); it is therefore sent as part of a service you have contracted. Even so, it may contain legislative updates together with an offer of services to address them, to be provided by one of our affiliated companies. Please note that you may unsubscribe from the service at any time or request a change of email address. 

+ CLIENTS 

For what purposes will we process your personal data? 

• Uhy Fay & Co Group S.L. provides an advisory service to clients, studies your specific case and helps you decide which group company can provide the services you need. We also manage appointments, complete the client file and verify your data for anti-money laundering compliance. 

• Providing professional Financial, Legal, Tax and Compliance advisory services to businesses.  

• Preparing quotes and following them up through communications between both parties. 

• Sending information by electronic means regarding your request or contract. To this end, we will monitor the group’s email communications to ensure that the service is being provided to you correctly, and we will provide appropriate coverage and protection for the email server. 

• Sending commercial or event information by electronic means, where there is a legal basis to do so. 

• Loyalty programmes and sending commercial information through a newsletter, based on your basic interests (contracted service, age, services that may interest you). The aim is to avoid sending you information that is not relevant to your situation. No exhaustive profiling or segmentation is carried out. 

• Managing the administrative, communication and logistics services carried out by the Data Controller. 

• Carrying out the relevant transactions. Invoicing and filing the relevant tax returns. Control and debt recovery management. 

What is the legal basis for processing your data? 

• The legal basis is your contractual consent. Please note that you may withdraw your consent at any time. 

• Legitimate interest in sending commercial communications, to which you may also object. 

+ SUPPLIERS 

For what purposes will we process your personal data? 

• Sending information by electronic means regarding your request. 

• Sending commercial or event information by electronic means, provided there is express authorisation. 

• Managing the administrative, communication and logistics services carried out by the Data Controller. 

• Carrying out the relevant transactions. Invoicing and filing the relevant tax returns. Control and debt recovery management. 

What is the legal basis for processing your data? 

The legal basis is the acceptance of a contractual relationship or, failing that, your consent when contacting us or offering us your products by any means. 

+ PARTNERS 

For what purposes will we process your personal data? 

• Organising the actions necessary to achieve the company’s objectives 

• Internal management and the company’s legal compliance. 

• Calling shareholders’ meetings. 

• Carrying out the relevant transactions. 

• Filing the relevant tax returns. 

What is the legal basis for processing your data? 

The legal basis is contractual: the acceptance of a share purchase agreement or similar, or participation in the incorporation of the company. 

+ VIDEO SURVEILLANCE 

For what purposes will we process your personal data? 

• Video surveillance of our premises. 

• Monitoring of our employees. 

• Footage may occasionally be provided to courts and tribunals for the exercise of legitimate legal actions. 

What is the legal basis for processing your data? 

The unequivocal consent of the data subject upon entering our premises after seeing the information sign for the video-monitored area. 

+ SOCIAL MEDIA CONTACTS 

For what purposes will we process your personal data? 

• Responding to your enquiries, requests or applications. 

• Managing the requested service, responding to your request or processing your application. 

• Interacting with you and building a community of followers. 

What is the legal basis for processing your data? 

The acceptance of a contractual relationship within the relevant social network, in accordance with its privacy policies: 

Facebook http://www.facebook.com/policy.php?ref=pf 

Instagram https://help.instagram.com/155833707900388 

Twitter http://twitter.com/privacy 

Linkedin http://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv 

Google* http://www.google.com/intl/es/policies/privacy/ 

*(Google+ and YouTube) 

How long will we keep personal data? 

We can only consult or remove your data in a restricted way, as this depends on a specific profile. We will process them for as long as you allow us to, by following us, being friends or clicking “like”, “follow” or similar buttons. 

Any rectification of your data or restriction of information or posts must be made through your profile or user settings on the social network itself. 

+ JOB APPLICANTS 

For what purposes will we process your personal data? 

• Organising selection processes for recruiting employees. 

• Inviting you to job interviews and assessing your application. 

• If you have given us your consent, we may keep your CV for future job openings. 

• If you have given us your consent, we may share it with collaborating or affiliated companies, with the sole aim of helping you find employment. 

• On the basis of legitimate interest, we will try to find you a position in any company of our group.  

What is the legal basis for processing your data? 

The legal basis is your unequivocal consent when you submit your CV and receive and sign information about the processing we will carry out. Please note that you may withdraw your consent at any time. 
The legitimate interest of our group of companies.  

+ WHISTLEBLOWING CHANNEL 

For what purposes will we process your personal data? 

• Internal detection of possible criminal and administrative offences affecting the legal entity, and compliance with the company’s code of conduct and compliance policies. 

• Management of reports. The whistleblower’s data may be processed anonymously. 

What is the legal basis for processing your data? 

• Performance of a task in the public interest or in the exercise of official authority. 

• Compliance with a legal obligation. 

INFORMATION COMMON TO ALL PROCESSING ACTIVITIES: 

Do we include personal data of third parties? 

No. As a general rule, we only process data provided by the data subjects themselves. If you provide us with third-party data, you must first inform those persons and obtain their consent; otherwise, you release us from any liability for failure to comply with this requirement. 

What about data of minors? 

We do not process data of persons under 14 years of age; therefore, please do not provide your data if you are under that age. 

Will we send communications by electronic means? 

• Only to manage your request, if it is one of the contact methods you have provided. 

• Any commercial communications we send will have been previously and expressly authorised by you. 

What security measures do we apply? 

You can rest assured: we have adopted an optimal level of protection for the Personal Data we handle, and we have implemented all the technical means and measures available to us, in line with the state of the art, to prevent the loss, misuse, alteration, unauthorised access and theft of Personal Data. 

To whom will your data be disclosed? 

Your data will not be disclosed to third parties, except where required by law. Specifically, they will be disclosed to the Spanish Tax Agency (Agencia Estatal de Administración Tributaria) and to banks and financial institutions for the collection of payment for the service provided or product purchased, as well as to the data processors necessary for the performance of the agreement. 

In the event of a purchase or payment, if you choose an application, website, platform, bank card or any other online service, your data will be disclosed to that platform or processed within its environment, always with the highest level of security. 

When instructed by us, the web development and maintenance company or the hosting company will have access to our website. They will have signed a service agreement that obliges them to maintain the same level of privacy as we do. We use applications that may involve an international transfer of data to the United States. Such transfers will only be made to entities that have adhered to the EU-U.S. Data Privacy Framework or, failing that, to those that have demonstrated compliance with the regulations and have undertaken, through Standard Contractual Clauses (SCCs), to comply with the level of protection and safeguards required under the European data protection legislation in force, such as the General Data Protection Regulation, or, failing that, where there is a legal basis for the international transfer.

Uhy Fay & Co Group S.L. provides business advisory services, studying each specific case and helping the client decide which group company will provide the most suitable service for their needs. It also provides services to the other group companies, such as completing the client file and verifying client data for anti-money laundering compliance. This information will be provided to the companies that subsequently deliver the final service to the client, and the data will be shared solely for the purpose of providing the requested service and only where essential to successfully fulfil the request. 

What are your rights? 

• To know whether or not we are processing your data. 

• To access your personal data. 

• To request the rectification of your data if they are inaccurate. 

• To request the erasure of your data if they are no longer necessary for the purposes for which they were collected or if you withdraw the consent given. 

• To request the restriction of the processing of your data in certain cases, in which case we will only retain them in accordance with the regulations in force. 

• To data portability: your data will be provided to you in a structured, commonly used, machine-readable format. If you prefer, we can send them to a new controller of your choice. This only applies in certain cases. 

• To lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe we have not handled your request properly. 

• To withdraw your consent to any processing you have consented to, at any time. 

If any of your data change, please let us know so that we can keep them up to date. 

Would you like a form to exercise your rights? 

• We have forms for exercising your rights; you can request them by email or, if you prefer, use those prepared by the Spanish Data Protection Agency or third parties. 

• If we have your contact details, if you exercise your rights through a channel we have previously used to communicate with you, or if you did not need to identify yourself to receive the service, we will not ask for your ID. 

• If we do not have your contact details, if there has been no prior communication, or if we have doubts as to whether you are really the data subject, the forms must be signed with an electronic signature or accompanied by your ID card or another identification document. We will always try to minimise the data requested.  

• If someone is representing you, you must attach a copy of their ID card, or they must sign with their electronic signature. 

• Forms may be submitted in person, sent by post or by email to the Data Controller’s address shown at the beginning of this text. 

How long will it take us to respond to a request to exercise your rights? 

It depends on the right, but no later than one month from your request, or two months if the matter is very complex and we notify you that we need more time. 

How long will we keep your personal data? 

• Personal data will be kept for as long as you maintain a relationship with us. 

• Once the relationship ends, the personal data processed for each purpose will be kept for the periods provided by law, including the period during which a judge or court may require them, taking into account the limitation period for legal actions. 

• The data processed will be kept until the legal periods mentioned above expire, where there is a legal obligation to retain them or, if there is no such legal period, until the data subject requests their erasure or withdraws the consent given. 

• We will keep all information and communications relating to your purchase or to the provision of our service for as long as the guarantees on the products or services last, in order to handle any claims. 

• For each processing activity or type of data, we provide a specific period, which you can consult in the following table: 

GROUP COMPANIES. 

Each group company provides its services independently, and you will be referred to other group companies depending on the service you request: 

• Fay & Co Advisory, S.L.

Business, financial, legal, audit, accounting and tax advisory, other compliance services and services to group companies. 

• UHY Fay & Co Auditores Consultores, S.L. 

Financial audit, accounting, tax and other financial advisory services. 

• UHY Fay & Co Tax and Legal, S.L.  

Legal advisory and legal services. 

• UHY Fay & Cointegra Soluciones Sostenibles, S.L.  

Sustainability regulatory compliance and non-financial reporting services. 

• Rose & Clavel Chartered Accountants, S.L., UHY Fay & Co Holding Spain, S.L. and UHY Fay & Co Business Services Madrid, S.L. are grouped under the same activity: Business, financial, legal, audit, accounting and tax advisory and other compliance services. 

Please note that, once you receive advice based on your needs, you will be informed which company your data will be sent to. Furthermore, you are under no obligation to engage any of them. 

Updated: 06/10/2025