Privacy policy

Data controller

The data controller is MMW FISCAL ET BUSINESS CONSULTING S.L., tax identification number being issued, registered office Calle Domingo J. Navarro 1, Planta 2, Oficina 5, 35002 Las Palmas de Gran Canaria, Spain.

For any question concerning your data: info@mmwfiscaletbusinessconsulting.com.

The firm has not designated a data protection officer: its processing operations do not fall within the cases in which designation is mandatory. Requests are handled directly by the partners, at the address above.

The data we collect

The site collects only what you write yourself in the contact form. There is no user account, no client area and no browsing tracking.

The form contains two fields that protect against robots: a field deliberately kept invisible, which must remain empty, and a time stamp of the first click inside the form. Neither of them says anything whatsoever about you.

Two technical operations are added, independent of what you write. First, in order to limit automated messages, the server counts the messages received within the hour from a single irreversible fingerprint of the IP address (sha256 with a secret salt): the address itself is recorded nowhere, neither in a file nor in the message that reaches us. Second, the host keeps its own server access logs, which may contain the IP address; those logs fall under its own policy and are not used by the firm for any analysis or measurement purpose.

The site carries out no profiling and no automated decision-making. It cross-references your data with no other source.

• Name — required, so that we know who we are replying to
• Email address — required, it is where the reply will go
• Telephone — optional, only to reach you about this enquiry
• Company — optional, helpful in placing the enquiry
• Subject and message — the content of your enquiry
• Language of the page from which the form was sent
• Consent box, ticked before sending

Why we process your data, on what basis and for how long

Each processing operation serves a specified purpose and rests on a legal basis under the GDPR. The table below summarises them.

Why two years

The retention period for messages received through the form is set at two years from the last exchange, after which the messages are deleted from the firm’s mailbox.

That period is not arbitrary. An enquiry about setting up or restructuring often resurfaces several months after a first contact: finding the initial exchange saves you from having to explain everything again. It also allows the firm to demonstrate, if it ever had to, that an enquiry was indeed dealt with and that consent had been obtained. Beyond that, the interest disappears and retention would no longer be proportionate.

Your address is added to no mailing list. The firm sends no newsletter and does not reuse the contact details received through the form for marketing purposes. If an engagement is subsequently entrusted to the firm, the data enter the professional file and follow the statutory periods specific to that file.

Who has access to your data

Your message arrives in the firm’s professional mailbox. It is read by the partners and, where applicable, by the staff in charge of the file, who are bound by professional confidentiality.

Two technical providers act as processors within the meaning of article 28 of the GDPR: the site’s host, which operates the server from which the message is sent, and the firm’s professional email service, which hosts the mailbox. They act on instructions and have no right to use the data for their own purposes.

No data are sold, rented, exchanged or passed on for advertising purposes. Disclosure to an administrative or judicial authority takes place only in response to a duly made request and within the limits of the law.

Transfers outside the European Union

The site is served from a data centre located in the European Union and the host, Hostinger International Ltd., is established in Cyprus, a Member State of the Union.

The host states that the data entrusted to its services may also be processed in Cyprus, Lithuania, the Netherlands or the United Kingdom, for operation, backup and support. The United Kingdom is covered by an adequacy decision of the European Commission; in the absence of adequacy, transfers rely on the standard contractual clauses adopted by the Commission.

The site links to no outside messaging service. A message sent through the form arrives, like any ordinary email, in the firm’s professional mailbox: that message is not encrypted from end to end and the route it takes, which the firm does not control, may pass through servers outside the Union. Where an enquiry contains sensitive information, the firm indicates, case by case, the appropriate channel for sending it.

Cookies, audience measurement and third-party services

This site sets no cookie, not even a so-called technical or preference cookie. It uses neither local browser storage nor a session identifier: nothing is kept on your device from one visit to the next.

Nor does it load any external resource. The typefaces, style sheets, script and images are installed on the firm’s domain and served from it. The server configuration in fact prevents the browser from loading anything at all from another origin.

The direct consequence: no consent banner appears, because there is nothing to consent to. And no third party learns that you have consulted this site.

• No audience measurement or statistics tool
• No pixel and no social network button
• No map, video or font loaded from an outside service
• No third-party captcha: protection of the form is internal
• No advertising, no retargeting, no sale of data

Security

The site is served exclusively over HTTPS: the data from the form travel encrypted. The security headers of the server restrict the permitted origins and prevent the site from being embedded in a third-party frame.

The form writes to no database: your message exists only in the email received by the firm. The technical logs never contain the content of a message, or a name, or an email address: only an error code and a time.

No measure makes a transmission over the internet absolutely safe. Please do not include identity documents, banking credentials or confidential documents in a first message: we will indicate, where appropriate, a suitable channel for sending them.

Your rights

You have the rights granted by articles 15 to 22 of the GDPR over the data concerning you. You may also withdraw your consent at any time: withdrawal does not affect the lawfulness of the processing carried out before it.

To exercise a right, write to info@mmwfiscaletbusinessconsulting.com with the subject line “Data protection”, preferably from the address used in the form, or by post to the firm’s registered office. Please state the right you wish to exercise.

The firm replies within one month, extendable by two months if the request is complex; it would then tell you so, and why. Exercising these rights is free of charge. If serious doubt remains as to your identity, we may ask for an additional item of verification, without requiring a copy of an identity document.

• Access: knowing what data we hold and obtaining a copy of it
• Rectification: having inaccurate or incomplete data corrected
• Erasure: asking for your message to be deleted
• Restriction: asking for processing to be suspended while a dispute is examined
• Objection: objecting to processing based on legitimate interest
• Portability: receiving your data in a machine-readable format
• Withdrawal of consent: at any time, without giving reasons

Complaint to the supervisory authority

If you consider that the processing of your data does not comply with the rules, you may refer the matter to the Agencia Española de Protección de Datos (AEPD), the supervisory authority competent for Spain.

Information and forms: www.aepd.es. Complaints are preferably filed electronically through the Agency’s electronic portal (sede electrónica), sedeaepd.gob.es, or by post to the attention of the Subdirección General de Inspección de Datos, C/ Jorge Juan 6, 28001 Madrid. The procedure is free of charge.

You may write to us first: the right to complain remains open afterwards, and a direct exchange often settles the question more quickly.

Minors

The site is aimed at professionals and companies. The contact form is not intended for minors and the firm does not knowingly collect their data.

If a message manifestly from a minor reaches us without the involvement of their legal representative, it is deleted.

Changes to this policy

This policy may change if the processing carried out by the site changes, for example if a client area were opened or if a new tool were added. The date of the last update appears at the foot of the page.

A substantial change would be announced on the home page of the site. No new purpose will be applied to data already collected without an appropriate legal basis.