In accordance with the principles of legality, fairness, and transparency established by the Organic Law on Personal Data Protection (hereinafter ‘LOPDP‘), AVLABOGADOS CÍA. LTDA. (hereinafter ‘AVL‘ or ‘Data Controller‘) presents the following information in this Personal Data Protection and Privacy Policy (hereinafter ‘Policy‘)
Av. República del Salvador N35-146 y Suecia, Edif. Prisma Norte, Fl. 11.
Telephone: +593 2 2443866
· Email: protecciondatospersonales@avl.com.ec.
AVL will process Data Subjects’ personal data (hereinafter ‘Data Subjects‘) in accordance with the following:
Data Subjects | Purpose and Types of Processing | Data Category | Legal Basis |
CLIENTS
| Send price quotes for the provision of services that Data Subjects request from AVL. | · Identification and contact data
§ Names and surnames § Telephone number
| · Implementation of pre-contract measures at the request of the Data Subject (Art. 7.5. LOPDP)
|
Manage the data entered or registered in AVL’s website forms.
| · Identification and contact data
§ Names and surnames § Telephone number
| · Implementation of pre-contract measures at the request of the user (Art. 7.5. LOPDP)
| |
Respond to inquiries or requests made on AVL’s official platforms, including its social media (LinkedIn and X).
**Please review the privacy policy of each social media platform mentioned above. AVL is not responsible for how these platforms process personal data. ** | · Identification and contact data
§ Names and surnames § Telephone number
| · Execution of pre-contract measures at the request of the Data Subject. (Art. 7.5) LOPDP).
· Legitimate interest (Art. 7.8. LOPDP).
| |
| Evaluate potential clients for preventing money laundering and the funding of crimes. | · Identification and contact data
§ Names and surnames § Telephone number
· Tax data:
§ Income tax declaration
· Politically Exposed Person (PEP) Data:
§ Marital status § Spouse’s identification data § Names and surnames | · Compliance with legal obligations (Art. 7.2. LOPDP)
|
Disclose personal data to the competent authorities if necessary, or if requested and required by the appropriate authorities to AVL.
| · Identification and contact data
§ Names and surnames § Identity card number § Telephone number
| · Compliance with legal obligations (Art. 7.2. LOPDP)
· Compliance with court orders (Art. 7.3. LOPDP)
| |
| Manage legal advice contracts | · Identification and contact data
§ Names and surnames § Number of identity card or TIN. § Telephone number
| · Execution of pre-contract measures at the request of the Data Subject and complying with contractual obligations. (Art. 7.5) LOPDP)
|
Send articles or legal news from AVL’s consulting areas.
| · Identification and contact data
§ Names and surnames
| · Legitimate interest (Art. 7.8. LOPDP) | |
| Manage personal data for electronically invoicing services provided by AVL, reimbursing expenses, and collections.
| · Identification and contact data
§ Names and surnames § Identity card number or TIN § Telephone number § Home address · Financial data:
§ Bank account number. | · Compliance with legal obligations (Art. 7.2. LOPDP)
· Compliance with contractual obligations. (Art. 7.5) LOPDP)
· Legitimate interest (Art. 7.8. LOPDP) |
| Respond to requests, complaints, administrative claims or lawsuits made by or against AVL.
| · Identification and contact data
§ Names and surnames § Telephone number § Home Address
| · Compliance with legal obligations (Art. 7.2. LOPDP)
· Compliance with contractual obligations (Art. 7.5. LOPDP)
· Legitimate interest (Art. 7.8. LOPDP) |
PROVIDERS AND STRATEGIC PARTNERS | Evaluate potential suppliers and strategic partners for preventing money laundering and the funding of crimes. | · Identification and contact data
§ Names and surnames § Telephone number
· Tax data:
§ Income tax return
· Politically Exposed Person (PEP) Data:
§ Marital status § Spouse’s identification data § Names and surnames | · Compliance with legal obligations (Art. 7.2. LOPDP)
|
| Manage payment processes.
| · Identification and contact data
§ Names and surnames § Identity card number or TIN § Telephone number § Home address · Financial data
§ Bank account number | · Compliance with contractual obligations. (Art. 7.5) LOPDP) |
| Respond to inquiries or requests made on AVL’s official platforms, including its social media (LinkedIn and X).
**Please review the privacy policy of each social media platform mentioned above. AVL is not responsible for how these platforms process personal data. ** | · Identification and contact data § Names and surnames § Telephone number | · Executing pre-contract measures at the request of the user. (Art. 7.5) LOPDP)
· Legitimate interest (Art. 7.8. LOPDP)
|
Respond to requests, complaints, administrative claims or lawsuits made by or against AVL.
| · Identification and contact data
§ Names and surnames § Telephone number § Home Address
| · Compliance with legal obligations (Art. 7.2. LOPDP)
· Compliance with contractual obligations (Art. 7.5. LOPDP)
· Legitimate interest (Art. 7.8. LOPDP) | |
APPLICANTS FOR JOB POSITIONS OR PROFESSIONAL SERVICES | Manage any process for hiring staff or service providers published on the platform designated by AVL for this purpose.
| · Identification and contact data
§ Names and surnames § Telephone number
· Academic and professional data:
Degrees: § Professional experience § Resume § Professional references
· Sensitive categories:
§ Health data
| · Compliance with legal obligations (Art. 7.2. LOPDP)
· Execution of pre-contract measures, at the request of the Data Subject (Art. 7.5. LOPDP)
· Legitimate interest (Art. 7.8. LOPDP) |
The processing of personal data for AVL’s employees and service providers is independently determined according to their respective employment or professional service contracts.
In any case, and where applicable, employees and service providers should refer to this Policy whenever their contract, AVL’s policies, codes of conduct, or any regulations issued by AVL independently stipulate it.
In the event that AVL processes personal data of Data Subjects not covered by this Policy or engages in processing activities not specified herein, the Data Controller will adequately inform about the processing being conducted or planned and, if necessary, will obtain the required consent.
It is important to emphasize that the processing of data related to professionals, merchants, legal representatives of legal entities, partners or shareholders of legal entities, and government employees is accessible to the public. Therefore, the data is subject to processing without the need for a legitimate basis, provided that such processing is linked to AVL’s fulfillment of its corporate purpose.
Regardless of the data processing methods mentioned in the previous section, and in order to fulfill AVL’s established purposes, the Data Controller may collect, compile, obtain, record, organize, structure, store, safeguard, adapt, modify, delete, index, extract, consult, develop, use, distribute, assign, communicate or transfer, access, restrict, erase, and generally process Data Subjects’ personal data in accordance with what is permitted by the LOPDP.
Both the data processing methods and the data categories are illustrative; therefore, the specific data processing methods and data categories will be determined and communicated to the Data Subject on a case-by-case basis.
In the event that a legal relationship with a Data Subject ends, AVL will retain their personal data for at least ten years to allow the Data Controller to defend itself in case of any administrative claim or lawsuit filed by or against it in relation to the services provided.
In any case, personal data will be processed only to the extent necessary to fulfill the purposes for which it was collected or to comply with legal requirements. Consequently, the retention period may be adjusted accordingly, either shortened or extended.
If the data protection authority (hereinafter “Authority“) establishes specific retention periods, AVL commits to processing the personal data only for the maximum period established by the Authority.
However, AVL commits to informing a Data Subject in advance if the processing of their personal data is no longer required or if an internal decision is made to shorten the processing period.
The Data Controller will take all necessary security measures to delete, block, pseudonymize, or anonymize personal data as required.
AVL maintains several digital and physical databases containing personal data, which are populated through various data collection channels, pre-contractual measures, contractual obligations, direct communication between Data Subjects and AVL, among other sources.
AVL collects and processes personal information from its employees, service providers, potential clients, clients, suppliers, and strategic partners through various means and interactions, including requests for price quotes, contact forms, professional network interactions, phone calls to AVL, email messages, public sources, etc.
AVL does not process Data Subjects’ personal data for purposes other than those specified in Section 2 of this Policy. However, if this were to change in the future, the Data Controller commits to informing Data Subjects in advance and, if applicable, obtaining their consent.
AVL may transfer personal data of its clients, suppliers, employees, service providers, strategic partners, etc., if necessary or required by competent authorities.
AVL does not communicate or transfer Data Subjects’ personal data internationally.
To fulfill any of the purposes established by AVL, Data Subjects must provide accurate and complete information. Otherwise, AVL will be unable to provide services or process requests adequately.
Furthermore, AVL reserves the right to withhold services or requests if the required data is not provided or if submitted with errors, inaccuracies, or is otherwise incorrect.
10.1 Data Subjects may exercise the following rights concerning the processing of their personal data by the Data Controller:
To exercise this right, the Data Subject must provide the necessary documentation and follow the procedure outlined in Section 11 of this Policy.
iii. Data Subjects’ personal data has fulfilled the purpose for which it was collected or processed.
vii. There is a legal obligation.
In the event that Data Subjects exercise this right, AVL commits to implementing methods and techniques aimed at securely and permanently deleting, rendering unreadable, or anonymizing their personal data.
In compliance with the LOPDP, AVL confirms that Data Subjects may withdraw their consent for the Data Controller to process their personal data at any time, except where limitations specified in section 10.3 of this Policy apply.
The Data Controller shall no longer process the Data Subjects’ personal data unless AVL demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subjects, or for the establishment, exercise, or defense of legal claims.
Data Subjects may request that AVL transfer or communicate their personal data to another data controller, where technically feasible, and without the Data Controller citing any impediments to delay the access, transmission, or subsequent use of the data by the Data Subjects or another data controller. After the data transfer is completed, AVL will proceed with the deletion of the Data Subjects’ personal data, unless they request its retention. The receiving Data Controller will assume the responsibilities outlined in the LOPDP.
For the right to data portability to apply, at least one of the following conditions must be met:
iii. When it involves a significant volume of personal data.
This right does not apply to information that has been inferred, derived, created, generated, or obtained from the analysis or processing performed by AVL based on the personal data provided by the Data Subjects. This includes personal data that has undergone processes such as customization, recommendation, categorization, or creation of profiles. Consider the limitations of this right in accordance with section 10.3 of this Policy.
When feasible, data transfers will be made in XML, Excel, or any other electronic format and channel commonly accepted by the designated recipient or data controller.
iii. When the Data Controller no longer needs the personal data for processing purposes, but the Data Subjects require it for the establishment, exercise, or defense of legal claims.
iii. Request the Data Controller to provide the criteria used in the automated valuation program.
This right shall not apply when:
iii. Explicit consent has been obtained from the Data Subjects.
10.2 Upon receiving a request from the Data Subjects regarding any of the rights established in this Policy, and in accordance with the guidelines outlined in section 11 of this Policy, AVL commits to processing such request within fifteen days.
10.3 The Data Controller reserves the right to continue processing Data Subjects’ personal data, and therefore, Data Subjects may not exercise their rights to rectification, updating, deletion, opposition, cancellation, or portability in the following cases:
iii. When the personal data is required to comply with a court order, resolution, or a reasoned mandate from a competent authority.
vii. When the personal data is necessary to exercise the right to freedom of expression and opinion.
viii. In cases where there is a public interest, subject to compliance with applicable international human rights standards, the principles of the LOPDP, and criteria of legality, proportionality, and necessity.
To exercise any of the rights outlined herein or to make a complaint regarding the processing of personal data, Data Subjects must send a request to the following email address: protecciondatospersonales@avl.com.ec, or alternatively, to the legal address of the Data Controller specified in section 1 of this Policy.
The request must include at least the following information:
If the information provided in the request requires clarification or additional details, AVL will request, once and within five days of receiving the request, that the Data Subjects provide such clarification or additional information.
The Data Subjects will have ten days from the day following the notification of the request for clarification or additional information to respond.
If the Data Subjects provide the requested clarification or additional information within the specified period, the Data Controller will duly address the request. Otherwise, AVL reserves the right to file the request, and the Data Subjects will be notified of this decision along with the reasons.
If needed, the Data Subjects may contact the relevant Authority directly.
AVL does not process Data Subjects’ personal data for automated assessments or decision-making, nor does it create profiles using their data.
AVL may update or modify this Policy at any time. Should this occur, AVL is committed to promptly informing Data Subjects of any changes.
Last updated:
December, 2024.
