Personal Data Protection and Privacy Policy

In accordance with the principles of legality, fairness, and transparency established by the Organic Law on Personal Data Protection (hereinafter ‘LOPDP‘), AVLABOGADOS CÍA. LTDA. (hereinafter ‘AVL‘ or ‘Data Controller‘) presents the following information in this Personal Data Protection and Privacy Policy (hereinafter ‘Policy‘)

1. DATA CONTROLLER


    • The Data Controller is AVLABOGADOS CÍA. LTDA.

     

     Av. República del Salvador N35-146 y Suecia, Edif. Prisma Norte, Fl. 11.

     

    Telephone: +593 2 2443866

     

    · Email: [email protected].
     

2. PERSONAL DATA PROCESSING

AVL will process Data Subjects’ personal data (hereinafter ‘Data Subjects‘) in accordance with the following:

Data Subjects

Purpose and Types of Processing

Data Category

Legal Basis

 

 

CLIENTS

 

Send price quotes for the provision of services that Data Subjects request from AVL.

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

 

· Implementation of pre-contract measures at the request of the Data Subject (Art. 7.5. LOPDP) 

 

Manage the data entered or registered in AVL’s website forms.

 

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

 

· Implementation of pre-contract measures at the request of the user (Art. 7.5. LOPDP) 

 

Respond to inquiries or requests made on AVL’s official platforms, including its social media (LinkedIn and X).

 

**Please review the privacy policy of each social media platform mentioned above. AVL is not responsible for how these platforms process personal data. **

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

 

· Execution of pre-contract measures at the request of the Data Subject. (Art. 7.5) LOPDP).

 

· Legitimate interest (Art. 7.8. LOPDP).

 

 

 

Evaluate potential clients for preventing money laundering and the funding of crimes.

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

 

· Tax data:

 

§ Income tax declaration

 

· Politically Exposed Person (PEP) Data:

 

§ Marital status

§ Spouse’s identification data

§ Names and surnames

· Compliance with legal obligations (Art. 7.2. LOPDP)

 

Disclose personal data to the competent authorities if necessary, or if requested and required by the appropriate authorities to AVL.

 

· Identification and contact data

 

§ Names and surnames

§ Identity card number

§ Telephone number

§ Email

 

· Compliance with legal obligations (Art. 7.2. LOPDP)

 

· Compliance with court orders (Art. 7.3. LOPDP)

 

 

 

 

Manage legal advice contracts

· Identification and contact data

 

§ Names and surnames

§ Number of identity card or TIN.

§ Telephone number

§ Email

 

· Execution of pre-contract measures at the request of the Data Subject and complying with contractual obligations. (Art. 7.5) LOPDP)

 

Send articles or legal news from AVL’s consulting areas.

 

· Identification and contact data

 

§ Names and surnames

§ Email

 

· Legitimate interest (Art. 7.8. LOPDP)

 

Manage personal data for electronically invoicing services provided by AVL, reimbursing expenses, and collections.

 

· Identification and contact data

 

§ Names and surnames

§ Identity card number or TIN

§ Telephone number

§ Home address 

§ Email

· Financial data:

 

§ Bank account number.

· Compliance with legal obligations (Art. 7.2. LOPDP)

 

· Compliance with contractual obligations. (Art. 7.5) LOPDP)

 

· Legitimate interest (Art. 7.8. LOPDP)

 

Respond to requests, complaints, administrative claims or lawsuits made by or against AVL.

 

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

§ Home Address

 

· Compliance with legal obligations (Art. 7.2. LOPDP)

 

· Compliance with contractual obligations (Art. 7.5. LOPDP)

 

· Legitimate interest (Art. 7.8. LOPDP)

 

 

PROVIDERS AND STRATEGIC PARTNERS

Evaluate potential suppliers and strategic partners for preventing money laundering and the funding of crimes.

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

 

· Tax data:

 

§ Income tax return

 

· Politically Exposed Person (PEP) Data:

 

§ Marital status

§ Spouse’s identification data

§ Names and surnames

· Compliance with legal obligations (Art. 7.2. LOPDP)

 

 

 

Manage payment processes.

 

· Identification and contact data

 

§ Names and surnames

§ Identity card number or TIN

§ Telephone number

§ Home address 

§ Email

· Financial data

 

§ Bank account number

· Compliance with contractual obligations. (Art. 7.5) LOPDP)

 

Respond to inquiries or requests made on AVL’s official platforms, including its social media (LinkedIn and X).

 

**Please review the privacy policy of each social media platform mentioned above. AVL is not responsible for how these platforms process personal data. **

· Identification and contact data

§ Names and surnames

§ Telephone number

§ Email

· Executing pre-contract measures at the request of the user. (Art. 7.5) LOPDP)

 

· Legitimate interest (Art. 7.8. LOPDP)

 

 

Respond to requests, complaints, administrative claims or lawsuits made by or against AVL.

 

 

 

 

 

 

 

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

§ Home Address

 

· Compliance with legal obligations (Art. 7.2. LOPDP)

 

· Compliance with contractual obligations (Art. 7.5. LOPDP)

 

· Legitimate interest (Art. 7.8. LOPDP)

 

 

 

APPLICANTS FOR JOB POSITIONS OR PROFESSIONAL SERVICES 

Manage any process for hiring staff or service providers published on the platform designated by AVL for this purpose.

 

 

· Identification and contact data

 

§ Names and surnames

§ Telephone number

§ Email

 

· Academic and professional data:

 

Degrees:

§ Professional experience

§ Resume

§ Professional references

 

· Sensitive categories:

 

§ Health data

 

 

 

· Compliance with legal obligations (Art. 7.2. LOPDP)

 

· Execution of pre-contract measures, at the request of the Data Subject (Art. 7.5. LOPDP)

 

· Legitimate interest (Art. 7.8. LOPDP)

 

The processing of personal data for AVL’s employees and service providers is independently determined according to their respective employment or professional service contracts.

 In any case, and where applicable, employees and service providers should refer to this Policy whenever their contract, AVL’s policies, codes of conduct, or any regulations issued by AVL independently stipulate it.
 

In the event that AVL processes personal data of Data Subjects not covered by this Policy or engages in processing activities not specified herein, the Data Controller will adequately inform about the processing being conducted or planned and, if necessary, will obtain the required consent.

 

It is important to emphasize that the processing of data related to professionals, merchants, legal representatives of legal entities, partners or shareholders of legal entities, and government employees is accessible to the public. Therefore, the data is subject to processing without the need for a legitimate basis, provided that such processing is linked to AVL’s fulfillment of its corporate purpose.

 

3. DATA PROCESSING METHODS EMPLOYED BY AVL

Regardless of the data processing methods mentioned in the previous section, and in order to fulfill AVL’s established purposes, the Data Controller may collect, compile, obtain, record, organize, structure, store, safeguard, adapt, modify, delete, index, extract, consult, develop, use, distribute, assign, communicate or transfer, access, restrict, erase, and generally process Data Subjects’ personal data in accordance with what is permitted by the LOPDP.

 

Both the data processing methods and the data categories are illustrative; therefore, the specific data processing methods and data categories will be determined and communicated to the Data Subject on a case-by-case basis.

4. DATA RETENTION PERIOD

In the event that a legal relationship with a Data Subject ends, AVL will retain their personal data for at least ten years to allow the Data Controller to defend itself in case of any administrative claim or lawsuit filed by or against it in relation to the services provided.

 

In any case, personal data will be processed only to the extent necessary to fulfill the purposes for which it was collected or to comply with legal requirements. Consequently, the retention period may be adjusted accordingly, either shortened or extended.

 

If the data protection authority (hereinafter “Authority“) establishes specific retention periods, AVL commits to processing the personal data only for the maximum period established by the Authority.

 

However, AVL commits to informing a Data Subject in advance if the processing of their personal data is no longer required or if an internal decision is made to shorten the processing period.

 

The Data Controller will take all necessary security measures to delete, block, pseudonymize, or anonymize personal data as required.

5. AVL'S DATABASES

AVL maintains several digital and physical databases containing personal data, which are populated through various data collection channels, pre-contractual measures, contractual obligations, direct communication between Data Subjects and AVL, among other sources.

6. ORIGIN OF PERSONAL DATA

AVL collects and processes personal information from its employees, service providers, potential clients, clients, suppliers, and strategic partners through various means and interactions, including requests for price quotes, contact forms, professional network interactions, phone calls to AVL, email messages, public sources, etc.

7. PURPOSES OR FURTHER PROCESSING

AVL does not process Data Subjects’ personal data for purposes other than those specified in Section 2 of this Policy. However, if this were to change in the future, the Data Controller commits to informing Data Subjects in advance and, if applicable, obtaining their consent.

8. NATIONAL OR INTERNATIONAL DATA COMMUNICATION OR TRANSFER

AVL may transfer personal data of its clients, suppliers, employees, service providers, strategic partners, etc., if necessary or required by competent authorities.

 

AVL does not communicate or transfer Data Subjects’ personal data internationally.

9. CONSEQUENCES OF PERSONAL DATA, OR DELIVERING IT WITH ERRORS OR INACCURACIES

To fulfill any of the purposes established by AVL, Data Subjects must provide accurate and complete information. Otherwise, AVL will be unable to provide services or process requests adequately.

 

Furthermore, AVL reserves the right to withhold services or requests if the required data is not provided or if submitted with errors, inaccuracies, or is otherwise incorrect.

10. RIGHTS REGARDING THE PROCESSING OF PERSONAL DATA AND HOW TO EXERCISE THEM

10.1 Data Subjects may exercise the following rights concerning the processing of their personal data by the Data Controller:

 

  • Right to information: Data subjects have the right to be informed, by any means, about the processing of their data in accordance with the principles of fairness and transparency.

 

  • Right of access: Data subjects have the right to know and obtain free access to all their personal data and detailed information processed by AVL, without the need to provide any justification.

 

  • Right to rectification and update: Data Subjects have the right to request that the Data Controller rectify or update any inaccurate or incomplete personal data.

 

To exercise this right, the Data Subject must provide the necessary documentation and follow the procedure outlined in Section 11 of this Policy.

 

  • Right to restrict processing: Data Subjects have the right to request that the Data Controller process only the data necessary to achieve a specific purpose.

 

  • Right to erasure: Data Subjects have the right to request that AVL delete their personal data when:

 

  1. The processing of their data does not comply with the principles established in the LOPDP.

 

  1. The processing of their data is no longer necessary or relevant to achieve the intended purpose.

 

iii. Data Subjects’ personal data has fulfilled the purpose for which it was collected or processed.

 

  1. The retention period of their personal data has expired.

 

  1. The processing affects their fundamental rights or individual freedoms.

 

  1. The Data Subjects withdraw their consent or indicate that they did not grant consent for one or more specific purposes, without the need for further justification.

 

vii. There is a legal obligation.

 

In the event that Data Subjects exercise this right, AVL commits to implementing methods and techniques aimed at securely and permanently deleting, rendering unreadable, or anonymizing their personal data. 

 

In compliance with the LOPDP, AVL confirms that Data Subjects may withdraw their consent for the Data Controller to process their personal data at any time, except where limitations specified in section 10.3 of this Policy apply.

 

  • Right to object: Data Subjects have the right to object to or refuse the processing of their personal data. 

 

The Data Controller shall no longer process the Data Subjects’ personal data unless AVL demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subjects, or for the establishment, exercise, or defense of legal claims.

 

  • Right to data portability: Data Subjects have the right to receive their personal data from the Data Controller in a compatible, up-to-date, structured, commonly used, interoperable, and machine-readable format, preserving its characteristics, and have the right to transmit such data to another controller.

 

Data Subjects may request that AVL transfer or communicate their personal data to another data controller, where technically feasible, and without the Data Controller citing any impediments to delay the access, transmission, or subsequent use of the data by the Data Subjects or another data controller. After the data transfer is completed, AVL will proceed with the deletion of the Data Subjects’ personal data, unless they request its retention. The receiving Data Controller will assume the responsibilities outlined in the LOPDP. 

 

For the right to data portability to apply, at least one of the following conditions must be met:

 

  1. When Data Subjects have given their consent for their personal data to be processed for one or more specific purposes. Data transfer or communication will occur between data controllers when technically feasible; otherwise, the data must be transferred directly to the Data Subjects.

 

  1. When the processing is carried out by automated means.

 

  iii. When it involves a significant volume of personal data.

 

This right does not apply to information that has been inferred, derived, created, generated, or obtained from the analysis or processing performed by AVL based on the personal data provided by the Data Subjects. This includes personal data that has undergone processes such as customization, recommendation, categorization, or creation of profiles. Consider the limitations of this right in accordance with section 10.3 of this Policy.

 

When feasible, data transfers will be made in XML, Excel, or any other electronic format and channel commonly accepted by the designated recipient or data controller.

 

  • Right to restriction of processing: Data Subjects have the right to request that the Data Controller suspend the processing of their data under the following circumstances:

 

  1. When Data Subjects contest the accuracy of the personal data, while the Data Controller verifies the accuracy of such data.

 

  1. When the processing is unlawful and Data Subjects oppose the erasure of their personal data, requesting instead to restrict its use.

 

iii. When the Data Controller no longer needs the personal data for processing purposes, but the Data Subjects require it for the establishment, exercise, or defense of legal claims.

 

  • Right not to be subject to decisions based solely or partially on automated valuations: Data Subjects have the right not to be subjected to decisions based solely or partially on valuations produced by automated processes, including creation of profiles, that have legal effects on them or that may infringe upon their fundamental rights and freedoms. To exercise this right, Data Subjects may:

 

  1. Request a reasoned explanation from the Data Controller regarding the decision made by AVL or the data processor.

 

  1. Submit comments.

 

iii. Request the Data Controller to provide the criteria used in the automated valuation program.

 

  1. Request the Data Controller to provide information on the types of data used and their sources.

 

  1. Challenge the decision before AVL or the data processor.


This right shall not apply when:

 

  1. The decision is necessary for the performance or execution of a contract between the Data Subjects and AVL or between the data processor and the Data Subjects.

 

  1. The decision is authorized by applicable law, a court order, resolution, or reasoned mandate from a competent technical authority, for which AVL will implement appropriate measures to safeguard the Data Subjects’ fundamental rights and freedoms.

 

iii. Explicit consent has been obtained from the Data Subjects.

 

  1. The decision does not involve serious impacts or verifiable risks to the Data Subjects.


10.2 Upon receiving a request from the Data Subjects regarding any of the rights established in this Policy, and in accordance with the guidelines outlined in section 11 of this Policy, AVL commits to processing such request within fifteen days.

 

10.3 The Data Controller reserves the right to continue processing Data Subjects’ personal data, and therefore, Data Subjects may not exercise their rights to rectification, updating, deletion, opposition, cancellation, or portability in the following cases:

 

  1. If they are not the owners of the personal data or if their legal representative is not properly accredited.

 

  1. When the personal data is necessary for the fulfillment of a legal or contractual obligation.

 

iii. When the personal data is required to comply with a court order, resolution, or a reasoned mandate from a competent authority.

 

  1. When the personal data is necessary for the formulation, exercise, or defense of claims or legal actions.

 

  1. When the exercise of these rights could harm the rights or legitimate interests of third parties, and this is demonstrated by the Data Controller when responding to the request.

 

  1. When it could obstruct ongoing judicial or administrative proceedings that have been duly notified.

 

vii. When the personal data is necessary to exercise the right to freedom of expression and opinion.

 

viii. In cases where there is a public interest, subject to compliance with applicable international human rights standards, the principles of the LOPDP, and criteria of legality, proportionality, and necessity.

11. EXERCISING RIGHTS OR FILING CLAIMS

To exercise any of the rights outlined herein or to make a complaint regarding the processing of personal data, Data Subjects must send a request to the following email address: [email protected], or alternatively, to the legal address of the Data Controller specified in section 1 of this Policy.

 

The request must include at least the following information:

 

  1. Data Subjects’ full names, identification card or passport number, and their residential or electronic address for notifications. If acting as a legal representative, the representative’s data must also include information about the represented party.

 

  1. If possible, a clear and precise description of the personal data for which the Data Subjects wish to exercise any of the rights mentioned in section 10 of this Policy, along with any other elements or documents that facilitate the location of such personal data.

 

  1. A clear and precise description of the request.

 

  1. The right(s) the Data Subjects wish to exercise.

 

  1. The request must be accompanied by documents that verify the identity of the Data Subjects or, if applicable, their legal or authorized representation. 

 

If the information provided in the request requires clarification or additional details, AVL will request, once and within five days of receiving the request, that the Data Subjects provide such clarification or additional information.

 

The Data Subjects will have ten days from the day following the notification of the request for clarification or additional information to respond.

If the Data Subjects provide the requested clarification or additional information within the specified period, the Data Controller will duly address the request. Otherwise, AVL reserves the right to file the request, and the Data Subjects will be notified of this decision along with the reasons.

 

If needed, the Data Subjects may contact the relevant Authority directly.

12. AUTOMATED VALUATIONS AND DECISIONS AND CREATION OF PROFILES

AVL does not process Data Subjects’ personal data for automated assessments or decision-making, nor does it create profiles using their data.

13. POLICY UPDATES

AVL may update or modify this Policy at any time. Should this occur, AVL is committed to promptly informing Data Subjects of any changes.

Last updated:

December, 2024.

Contact Us
X-twitter Linkedin-in