Privacy Policy
Transparent information about the processing of your personal data.
This Privacy Policy applies to the data processing activities carried out by ABAST as data controller.
1. Who is responsible for processing your personal data?
Your personal data will be processed by the following data controllers that form part of ABAST:
ABAST GLOBAL LEGAL, S.L.U.
NRT: L-715340-S, with address at Passeig Arnaldeta de Caboet, 11, 2nd floor, door 1, (AD700) Escaldes-Engordany, Principality of Andorra.
ABAST GLOBAL SPAIN, S.L.
NIF B75859934, with registered office at Avinguda Diagonal 594, 1st floor, door 1, 08021 Barcelona, Spain.
Point 3 of this Privacy Policy will determine, for each type of processing, which ABAST entity or entities act as data controller.
Our Data Protection Officer
At ABAST, we provide you with the contact details of our Data Protection Officer, to whom you may address any query related to this Privacy Policy or the processing of your personal data.
Contact email: [email protected]
2. What requirements must you meet to provide us with your personal data?
2.1. Minimum age. To provide us with your personal data, you must be of the minimum legal age required in your country of residence and/or, where applicable, have sufficient legal capacity to use this Website.
2.2. Truthfulness. When you provide us with your data, you guarantee that the data and information provided are real, truthful, up to date and, moreover, belong to you and not to third parties.
In addition, you must notify us of any change in the data provided, being responsible in all cases for the truthfulness and accuracy of the data supplied at all times.
2.3. Age and truthfulness checks. ABAST reserves the right to verify your age and identifying information at any time, if necessary, including by requesting an official supporting document or equivalent procedure.
3. What data processing do we carry out through the website and what are its main characteristics?
Below, we explain how we process your personal information and provide you with detailed relevant information concerning your privacy.
3.1. When you contact us
Through our channels (contact form, telephone, email, WhatsApp).
| Who acts as Data Controller? | Your data will be processed by ABAST GLOBAL LEGAL, S.L.U. and/or ABAST GLOBAL SPAIN, S.L. depending on the type and nature of the request made. |
| How is the data collected? | Contact form, telephone, WhatsApp and sending emails. |
| What data do we collect? | Identifying and contact information. We collect your identifying data (first and last name) and email address, as well as any other information you voluntarily include in the communications you send us. We may request additional information if necessary to fulfil your request or requirement. |
| What are the purposes of processing your personal data? | Responding to your requests. The main purpose of processing this data will be to respond to your requests, resolve your queries and/or provide you with the information requested, as well as, where applicable, to follow up on your requests. |
| What is the legal basis that allows us to process your data? Is providing this data mandatory? | Consent. The data provided for the above purposes will be processed on the basis of your consent, granted when you voluntarily contact us through the means made available to you to request information or make a request. The information you must provide on a mandatory basis will be indicated with an asterisk or similar mark. Without such information, it would not be possible to handle your queries or requests. |
| How long do we keep your information? | We will process all your personal information for as long as your requests are being handled and, if necessary, to follow up on them. Once this period has ended, ABAST will keep this information blocked for the periods established by law to address any liabilities and to demonstrate compliance with our obligations. From that moment on, ABAST will only process the information in anonymised form. |
| To whom do we disclose your personal information? | We do not make any additional disclosure for this processing other than those indicated, generally, in point 4. "To whom do we disclose your personal information?". In this regard, we may use service providers to provide certain ancillary services (for example, management software), which act as Data Processors. You will find more information on how these service providers act in point 4, mentioned above. |
3.2. When you apply for a job vacancy
In the "Join the team" section.
| Who acts as Data Controller? | Your data will be processed by ABAST GLOBAL LEGAL, S.L.U. and/or ABAST GLOBAL SPAIN, S.L. depending on the candidate profile. |
| How is the data collected? | "Join the team" form. |
| What data do we collect? | Identifying and contact information. We collect your identifying data (first and last name) and email address. Curricular and professional information. You may add a link to your LinkedIn profile and attach a CV file, where you may include your academic information and professional experience, as well as any other information you voluntarily add to your CV. Personal characteristics and other information. In addition, you have a space where you may include a cover letter or message. |
| What are the purposes of processing your personal data? | Taking part in our staff selection processes. If you send us your application and CV, we will process your personal information to start, where applicable, a selection process for possible hiring and to follow up on it. Selection processes may involve in-person or remote interviews, or practical tests related to the job position or languages in which the work functions must be performed. |
| What is the legal basis that allows us to process your data? Is providing this data mandatory? | Consent. The processing of the data is necessary to assess the application for a job offer. Application of pre-contractual measures. The processing of the data is necessary for the application of pre-contractual measures between the parties. |
| How long do we keep your information? | We will process the personal data provided for as long as necessary to manage the selection process for which you have applied or until you ask us to stop doing so and, subsequently, it will remain blocked for the statutory retention periods while liabilities may exist for ABAST. If the candidate is not selected, the data will be deleted 2 years after the candidate’s registration. |
| To whom do we disclose your personal information? | We do not make any additional disclosure for this processing other than those indicated, generally, in point 4. "To whom do we disclose your personal information?". In this regard, we may use service providers to provide certain ancillary services (for example, management software), which act as Data Processors. You will find more information on how these service providers act in point 4, mentioned above. |
3.3. When you maintain a contractual relationship with ABAST
| Who acts as Data Controller? | Your data will be processed by ABAST GLOBAL LEGAL, S.L.U. and/or ABAST GLOBAL SPAIN, S.L. depending on with whom the contractual relationship is maintained. |
| How is the data collected? | Contracting ABAST services. |
| What data do we collect? | Identifying and contact information. We collect your identifying data (first and last name) and email and/or postal address, as well as any other information you voluntarily include in the communications you send us. Employment details. We may collect data relating to the contact person representing the client company (first and last name, professional email address, position and/or department). |
| What are the purposes of processing your personal data? | Executing and maintaining the contractual relationship between the Parties. The main purpose of processing this data will be to maintain and execute the contractual relationship between the parties, which may include: administrative, tax, legal, accounting and commercial management of client data; provision of services; scheduling meetings and client visits; and payment collection management. |
| What is the legal basis that allows us to process your data? Is providing this data mandatory? | Performance of the contract. The processing of the data is necessary for the performance of the contract between the parties. All data requested and processed by ABAST for the above purposes will be necessary for the indicated purposes. If they are not provided, the services could not be performed nor could the administrative tasks linked to them be carried out. |
| How long do we keep your information? | We will process all personal information for as long as the contractual relationship between the parties lasts. Once this period has ended, ABAST will keep this information blocked for the periods established by law to address any liabilities and to demonstrate compliance with our obligations. |
| To whom do we disclose your personal information? | We do not make any additional disclosure for this processing other than those indicated, generally, in point 4. "To whom do we disclose your personal information?". In this regard, we may use service providers to provide certain ancillary services (for example, management software), which act as Data Processors. You will find more information on how these service providers act in point 4, mentioned above. |
3.4. When you complete KYC forms
| Who acts as Data Controller? | Your data will be processed by ABAST GLOBAL LEGAL, S.L.U. and/or ABAST GLOBAL SPAIN, S.L. depending on with whom the services were requested and with whom the contractual relationship is maintained. |
| How is the data collected? | KYC forms provided by ABAST. |
| What data do we collect? | Identifying and contact information. We collect your identifying data (first and last name), email and/or postal address, as well as information about where you work and the source of funds for the transaction. |
| What are the purposes of processing your personal data? | Executing and maintaining the contractual relationship between the Parties, which may include: administrative, tax, legal, accounting and commercial management of client data; provision of services; scheduling meetings and client visits; and payment collection management. |
| What is the legal basis that allows us to process your data? Is providing this data mandatory? | Legal obligation. ABAST has a legal obligation, in matters of anti-money laundering, to identify its clients and analyse the risk of the transactions it is to carry out on their behalf. |
| How long do we keep your information? | We will process all personal information for as long as the contractual relationship between the parties lasts. Once this period has ended, ABAST will keep this information blocked for the periods established by law to address any liabilities. In particular, for a period of 10 years from the end of the relationship, in order to comply with information retention obligations. |
| To whom do we disclose your personal information? |
We do not make any additional disclosure for this processing other than those indicated, generally, in point 4. "To whom do we disclose your personal information?". In this regard, we may use service providers to provide certain ancillary services (for example, management software), which act as Data Processors. You will find more information on how these service providers act in point 4, mentioned above.
Notwithstanding the above, ABAST may be required to provide your data to the competent authorities in matters of anti-money laundering. |
3.5. When you register for an event
| Who acts as Data Controller? | Your data will be processed by ABAST GLOBAL LEGAL, S.L.U. |
| How is the data collected? | The event registration form and confirmation by email or telephone of participation in the event. |
| What data do we collect? | Identifying and contact information. We collect your identifying data (first and last name) and email address, as well as any other information requested in the collection medium or voluntarily provided by you. If events are recorded, image and voice will be included. |
| What are the purposes of processing your personal data? | Managing participation in the event. This includes the publication on different social networks of images and videos from the event in which your image and voice may appear. It also includes sending images that may be taken of event participants. |
| What is the legal basis that allows us to process your data? Is providing this data mandatory? | Consent. The data provided for the above purposes will be processed on the basis of your consent, granted when you voluntarily register to participate in the event. |
| How long do we keep your information? | We will process all your personal information for as long as event management is being carried out and, in the case of publication of images and videos, for as long as they remain published. Data will be kept for a maximum period of one year from registration for the event. |
| To whom do we disclose your personal information? | We do not make any additional disclosure for this processing other than those indicated, generally, in point 4. "To whom do we disclose your personal information?". In this regard, we may use service providers to provide certain ancillary services (for example, management software), which act as Data Processors. You will find more information on how these service providers act in point 4, mentioned above. |
3.6. When you subscribe to any of our information distribution channels
Newsletter and WhatsApp channel.
| Who acts as Data Controller? | Your data will be processed by ABAST GLOBAL LEGAL, S.L.U. |
| How is the data collected? | The newsletter subscription form and acceptance of receiving commercial communications. |
| What data do we collect? | Identifying and contact information. We collect your identifying data (first and last name) and email address. |
| What are the purposes of processing your personal data? | Managing the sending of commercial communications. |
| What is the legal basis that allows us to process your data? Is providing this data mandatory? | Consent. The data provided for the above purposes will be processed on the basis of your consent. |
| How long do we keep your information? | We will process all your personal information for as long as you remain subscribed to the distribution list, until you request cancellation. |
| To whom do we disclose your personal information? | We do not make any additional disclosure for this processing other than those indicated, generally, in point 4. "To whom do we disclose your personal information?". In this regard, we may use service providers to provide certain ancillary services (for example, management software), which act as Data Processors. You will find more information on how these service providers act in point 4, mentioned above. |
3.7. When you access any of our premises and video surveillance cameras are present
| Who acts as Data Controller? | Your data will be processed by ABAST GLOBAL LEGAL, S.L.U. |
| How is the data collected? | Images obtained through video surveillance cameras. |
| What data do we collect? | Images of people accessing the video-monitored premises. |
| What are the purposes of processing your personal data? | Managing the security of ABAST’s premises. |
| What is the legal basis that allows us to process your data? Is providing this data mandatory? | ABAST’s legitimate interest in protecting its premises and assets. |
| How long do we keep your information? | Maximum 30 days and, if a security incident has been detected, for the time necessary to safeguard ABAST’s interests. |
| To whom do we disclose your personal information? | We do not make any additional disclosure for this processing other than those indicated, generally, in point 4. "To whom do we disclose your personal information?". In this regard, we may use service providers to provide certain ancillary services (for example, management software), which act as Data Processors. You will find more information on how these service providers act in point 4, mentioned above. |
3.8. When you interact with any of our social networks
ABAST is present on different social networks in order to disseminate its activities, products and services, as well as to interact with users, clients and potential interested parties.
Access to and use of such profiles implies that the processing of the user’s personal data will be governed both by this Privacy Policy and by the terms of use and privacy policies of the corresponding social network, the latter also being responsible for the processing of data carried out within its platform.
Users are advised to review such privacy policies before interacting with ABAST profiles.
Data processed
ABAST may process the following user data:
- Public identifying profile data.
- Information voluntarily shared by the user.
- Data derived from interaction with the profile.
ABAST will not under any circumstances access private user information that has not been previously provided or made public by the user.
Purposes
Personal data collected through social networks will be processed for the following purposes:
- Managing ABAST’s presence on social networks.
- Providing information about activities, products, services and news.
- Interacting with users, responding to queries or requests and encouraging participation.
- Analysing user interaction with content to improve the communication strategy.
- Preventing possible abuse or misuse of the profile.
Legal basis
The legal basis that legitimises the processing of data by ABAST is:
- The data subject’s consent, granted by accepting the terms of the social network and voluntarily interacting with ABAST’s profile.
- ABAST’s legitimate interest in maintaining an active presence on social networks and interacting with users.
Recipients
ABAST will not disclose user data to third parties, unless legally required. However, it should be noted that:
- The social network on which the user is registered may process and share information in accordance with its own policies.
- Content published by the user may be visible to other users of the social network.
International transfers
The use of social networks may involve international data transfers, since the providers of these platforms often have servers outside the European Economic Area and/or Andorra.
These transfers are carried out in accordance with the appropriate safeguards required by the applicable regulations, about which the user may obtain more information by consulting the privacy policies of each social network.
Retention
The data will be processed while the user maintains the relationship with ABAST’s profile (for example, while following or interacting with the account). Subsequently, the data may remain blocked for the periods necessary to comply with legal obligations.
4. To whom do we disclose your personal information?
As a general rule, ABAST will not disclose your data to third parties. However, in addition to the disclosures specifically indicated in the section where we explain the characteristics of the different operations (point 3), we inform you of the disclosures that we may make generally and that affect all the previous processing activities and their legal basis.
- Essential service providers. To perform the service we offer you, whether companies of the business group to which ABAST belongs or external service providers (for example, IT hosting companies or platforms for sending commercial communications). These entities have signed the corresponding confidentiality agreements and will only process your data according to our instructions, and may not use them for their own purposes.
- Public bodies. We may disclose to the competent authorities the data and any other information in our possession or accessible through our systems when there is a legal obligation to do so. In such cases, the personal data you provide us would be kept and made available to administrative or judicial authorities.
- In the event of a corporate transaction. In the event of a merger, acquisition, sale of all or part of its assets or any other type of corporate transaction involving a third party, we may share, disclose or transfer user data to the successor entity (even during the stage prior to the transaction).
- To third parties after aggregation or anonymisation. We may disclose or use aggregated or anonymised data (that is, data that cannot be linked to an identified or identifiable natural person) for any purpose.
- To third parties with the user’s consent or another legitimate basis. If we wish to share data with third parties outside the scope of this Privacy Policy, we will in any case request the user’s consent or provide information about such sharing and its legitimate basis.
5. Is your personal data transferred to third countries outside the economic area?
Some of our service providers may be located in countries outside the European Economic Area ("EEA") and/or Andorra. Therefore, ABAST will only carry out international data transfers to providers that offer sufficient safeguards.
6. What rights can you exercise as a data subject?
You may exercise the rights guaranteed to you by law in relation to the processing of your personal data by contacting our Data Protection Officer at [email protected].
Any rights request we receive will be resolved as soon as possible and, in any event, within the maximum period established by the legislation from the time we receive it. In some cases, it will be necessary to request a copy of your identity document or another identification document if identity verification is required.
The rights you have as a data subject are the following:
Right to withdraw granted consent
You may revoke your consent in relation to all processing based on it at any time. However, withdrawal of consent will not affect the lawfulness of processing based on consent prior to its withdrawal.
Right of access
You have the right to know what data is being processed, where applicable, and, if so, to obtain a copy of it, as well as to obtain information concerning: the origin and recipients of the data; the purposes for which it is processed; whether there is an automated decision-making process, including profiling; the data retention period; and the rights provided for by the regulations.
Right to rectification
You have the right to obtain rectification of your personal data or to have it completed when it is incomplete.
Right to erasure
You have the right to request the erasure of your personal data if it is no longer necessary for the purpose for which it was collected or, where applicable, if we are no longer authorised to process it.
Right to data portability
You have the right to request data portability in the case of processing of your data based on your consent or on the performance of a contract, provided that the processing has been carried out by automated means. If you exercise this right, you will receive your personal data in a structured, commonly used and machine-readable format. However, you may also request, where possible, that your data be transmitted directly to another company.
Right to restriction of processing
You have the right to restrict the processing of your data in the following cases:
- When you have requested rectification of your personal data during the period in which we verify its accuracy.
- When you consider that we are not authorised to process your data. In that case, you may ask us to restrict its use instead of requesting its erasure.
- When you consider that it is no longer necessary for us to continue processing your data and you want us to keep it for the purpose of exercising or defending claims.
- In cases where processing is based on our legitimate interest and you have exercised your right to object to it, you may ask us to restrict the use of your data while the prevalence of those interests over yours is verified.
Right to object
You have the right to object at any time to the processing of your personal data based on our legitimate interest, including profiling.
Unsubscribing from commercial communications
Remember that you may object at any time to receiving this type of communication by sending us an email at [email protected]. You may also opt out of this service by following the instructions indicated in the footer of each electronic communication we send you.
Right to lodge a complaint with the Supervisory Authority
Remember that, at any time, if you consider that we have infringed your right to data protection, you may contact the corresponding Supervisory Authority to defend your rights:
- In the case of Spain, the Spanish Data Protection Agency (AEPD).
- If you are resident in Andorra, the Andorran Data Protection Agency (APDA).
7. How do we guarantee the confidentiality of your information?
The security of your personal data is a priority for us. Therefore, ABAST has implemented all necessary security measures to ensure effective use and processing of the personal data provided by the user, safeguarding its privacy, confidentiality and integrity, and uses the technical means necessary to prevent alteration, loss, unauthorised access or processing of your data, according to the state of technology at any given time.
Accordingly, we comply with the recommended security standards to protect it. However, it is impossible to guarantee total security due to the very nature of the Internet and because malicious actions by third parties beyond our control may occur.
We undertake to act swiftly and diligently if data security is endangered or compromised, and to inform you where relevant.
8. Changes to this policy
ABAST may modify the content of the Privacy Policy at any time, especially when legislative, case law or interpretative changes by Supervisory Authorities affect the data processing carried out by ABAST through this Website. Any new version of this Privacy Policy will enter into force on the published effective date.
We recommend that you periodically review this Privacy Policy to stay informed about how your personal data is processed and protected, as well as the rights available to you.