+34 96 116 39 80 info@grupocandel.com Spain · Mexico · Colombia · Argentina · United States
Legal information

Privacy policy

This policy explains how personal data collected through this website and in the course of our services is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).

Last updated: September 2026

This English version is provided for information purposes. In case of discrepancy, the Spanish version shall prevail.

01Data controller

Controller
ITBA ADVISORS S.L. (ITBA International Tax Business Advisors)
NIF
B93905669
Registered office
Calle Julio Antonio, 31, 2nd floor, 46007 Valencia (Spain)
Phone
+34 96 116 39 80

Data protection officer: ITBA ADVISORS S.L., who can be contacted at info@grupocandel.com or at the registered office above.

02What data we process

  • Contact and enquiry data: full name, email, phone, country of residence, reason for and content of the message.
  • Data needed to provide the service: the client's identification, financial, asset, tax, corporate and, where applicable, family data.
  • Third-party data (shareholders, family members, beneficiaries) provided by the client. The client guarantees that they have informed them and have a legal basis to share it.

We do not request special categories of data unless essential for the engagement, in which case they are processed with the enhanced safeguards required by law.

03Purposes and legal bases

Handling enquiries and diagnosis requests
Consent of the data subject and pre-contractual steps at their request (art. 6.1.a and 6.1.b GDPR).
Providing the contracted services and managing the professional relationship
Performance of a contract (art. 6.1.b GDPR).
Complying with legal obligations
Tax, accounting and anti-money-laundering and counter-terrorist-financing obligations under Law 10/2010 (art. 6.1.c GDPR).

No automated decisions are made and no profiles with legal effects on data subjects are created.

04Retention periods

  • Enquiries that do not lead to an engagement: as long as needed to handle them and at most 12 months.
  • Clients: for the duration of the professional relationship and thereafter for the statutory limitation periods, including 4 years for tax matters (art. 66 General Tax Act), 5 years for personal actions (art. 1964 Civil Code), 6 years for commercial records (art. 30 Commercial Code) and 10 years for anti-money-laundering purposes (art. 25 Law 10/2010).

After these periods, data will be kept blocked under article 32 of the LOPDGDD and deleted once any potential liabilities have lapsed.

05Recipients

Data will not be disclosed to third parties unless required by law or necessary to provide the requested service. The following may access it:

  • Public authorities, courts, notaries, registries and SEPBLAC, where required by law or by the engagement itself.
  • Providers that serve the controller (web hosting, email, management software), as processors under a contract compliant with article 28 GDPR.
  • Correspondent professionals in other jurisdictions, where the engagement requires it.
  • Other Grupo Asesor Candel entities, only when the data subject requests services they provide or has given consent.

06International transfers

Because of the international nature of our services in Mexico, Colombia, Argentina and the United States, some engagements require sharing data with professionals, entities or authorities in those countries. Such transfers are carried out with the safeguards set out in Chapter V GDPR:

  • European Commission adequacy decisions, such as the one for Argentina or, in the United States, the one covering organisations certified under the EU-US Data Privacy Framework.
  • Standard contractual clauses approved by the European Commission.
  • Otherwise, where the transfer is necessary to perform a contract entered into at the data subject's request (art. 49.1.b GDPR).

Data subjects may request information on the safeguards applied by writing to info@grupocandel.com.

07Your rights

Anyone may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability, and the right not to be subject to automated individual decisions. Consent may be withdrawn at any time, without affecting the lawfulness of prior processing.

To exercise them, write to info@grupocandel.com or to the postal address above, with the reference "Data protection" and the information needed to identify you. We will reply within one month, extendable by two further months in complex cases (art. 12.3 GDPR).

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

08Minors

This website is not aimed at children under 14. If we detect that a minor has provided data without the consent of their parents or guardians, it will be deleted (art. 7 LOPDGDD).

09Security and confidentiality

We apply technical and organisational measures appropriate to the risk to ensure the confidentiality, integrity and availability of data (art. 32 GDPR). All staff are bound by confidentiality (art. 5 LOPDGDD) and, where applicable, professional secrecy.

10Changes to this policy

This policy may be updated to reflect changes in the law or in our services. The version in force is the one published on this website.