Privacy policy

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and with Spanish Organic Act 3/2018 of 5 December (LOPDGDD), we hereby inform you of how we process your personal data.

1. Data controller

• Identity: Assessoria Tomàs
• VAT/NIF: B-XXXXXXXX
• Address: Carrer Raval Coma, 39 · 25210 Guissona (Lleida), Spain
• Phone: +34 973 550 041
• Email: josep@assessoriatomas.com

2. Purposes of processing

We process the data you provide through this website or at our offices for the following purposes:

• To respond to enquiries and requests received via the contact and immigration forms.
• To handle requests for information about, or visits to, properties listed by Finques Tomàs.
• To maintain the pre-contractual and contractual relationship with the client in our labour, accounting, tax, immigration, homeowner-association and insurance practice areas.
• To comply with applicable legal obligations (commercial, tax, accounting, labour, immigration, anti-money-laundering).
• To send communications strictly related to the contracted service.

3. Legal basis

• Consent of the data subject (art. 6.1.a GDPR), given by ticking the corresponding box, for information requests.
• Performance of a contract or pre-contractual measures (art. 6.1.b GDPR) for the provision of professional services.
• Compliance with legal obligations applicable to the controller (art. 6.1.c GDPR), particularly in tax, accounting, labour and immigration matters.
• Legitimate interest of the controller (art. 6.1.f GDPR) for ordinary management of the professional relationship and IT security of the site.

4. Retention periods

Data is kept only for as long as necessary to fulfil the purpose for which it was collected and thereafter for the legal limitation periods. As a guide:

• Tax records: 4 years (art. 66, General Tax Act 58/2003), up to 10 years for certain transactions.
• Accounting records: 6 years (art. 30, Spanish Commercial Code).
• Labour and Social Security records: 4 years as a general rule (RD-Law 5/2000); up to 5 years for contributions.
• Immigration files: as required by the applicable rules and administrative limitation period.
• Real-estate transactions and AML: 10 years (Act 10/2010).
• Contact requests with no subsequent contract: 1 year from the last communication.

5. Recipients and transfers

Data may be disclosed to:

• Competent public authorities (tax agency, social security, labour inspectorate, police, commercial registry, cadastre, etc.) when required by the rules applicable to the professional engagement.
• Banks, insurers and professional collaborators (lawyers, notaries, registrars) when necessary for the contracted service.
• Technology suppliers acting as data processors (web hosting, email), under written agreements compliant with art. 28 GDPR.

No international data transfers are envisaged. The web and email servers are located within the European Economic Area.

6. Data subject rights

You may exercise the following rights at any time, free of charge:

• Access: obtain confirmation as to whether we process your data and, if so, access to it.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure: request the deletion of data when no longer necessary.
• Objection: object to processing based on legitimate interest.
• Restriction of processing: in the cases provided by art. 18 GDPR.
• Portability: receive the data in a structured format or have it transmitted to another controller.
• Withdrawal of consent at any time, without retroactive effect.

To exercise them, write to josep@assessoriatomas.com or by post to the address in section 1, attaching a copy of your ID document.

If you believe processing is not in line with the rules, you may file a complaint with the Catalan Data Protection Authority (APDCAT) or the Spanish Data Protection Agency (AEPD).

7. Categories of data processed

We process identifying data (name, surname, ID number, address, phone, email), professional and economic data and, where the engagement requires it, special-category data (e.g. health, in specific labour cases) always with the additional safeguards of art. 9 GDPR. We do not carry out automated individual decision-making or profiling.

8. Security measures

We have adopted the technical and organisational measures appropriate to ensure a level of security suited to the risk (art. 32 GDPR): HTTPS encryption of the connection, individual access credentials, periodic backups and internal confidentiality policies binding on all staff.

9. Updates

This privacy policy may be updated when necessary to reflect legislative, judicial or operational changes. The date of the last update appears at the top of this document.