1. Data controller

  • Identity: Avenor Tax & Law SL.
  • Tax ID (CIF): B22633093.
  • Postal address: Calle de Dinamarca, 4. 45005 Toledo, Spain.
  • Email: info@avenor.es
  • Telephone: +34 685 113 295

2. Purposes of processing

Avenor processes the personal data provided by users for the following purposes:

  • Managing enquiries, requests and communications received through our contact channels.
  • Providing the professional services engaged (tax and legal advisory and bookkeeping).
  • Complying with the legal obligations applicable to our professional activity.
  • Sending commercial communications about our services, provided the user has expressly consented.
  • Managing the contractual and commercial relationship with clients, suppliers and collaborators.

3. Legal basis for processing

The legal bases that legitimise the processing of data are:

  • Consent of the data subject (Art. 6.1.a GDPR): for sending commercial communications and handling voluntary enquiries.
  • Performance of a contract (Art. 6.1.b GDPR): for the provision of the professional services engaged.
  • Compliance with a legal obligation (Art. 6.1.c GDPR): for compliance with applicable tax, accounting, registration and professional obligations.
  • Legitimate interest (Art. 6.1.f GDPR): for internal administrative purposes and fraud prevention.

4. Recipients and disclosures of data

Personal data will not be disclosed to third parties except where required by law or with the express consent of the user. The following recipients may have access to the data:

  • Competent public administrations (AEAT, Social Security, commercial registries, etc.) in compliance with legal obligations.
  • Technology providers rendering services to Avenor (web hosting, email, document management) under a data processing agreement pursuant to Art. 28 GDPR.
  • Correspondents and professional collaborators in other jurisdictions, where the client's operation so requires, with prior notice to the client.

No international data transfers are carried out outside the European Economic Area except where required by the provision of the service to the client (operations with a Mexican connection), in which case appropriate safeguards will be applied pursuant to the GDPR.

5. Retention period

Data will be retained for as long as necessary to fulfil the purpose for which it was collected and to determine any liabilities that may arise from that purpose. Following the end of the contractual relationship, data will be kept blocked for the applicable statutory periods (generally, up to 6 years pursuant to tax and commercial regulations) and will subsequently be deleted.

6. Rights of the data subject

Any person has the right to obtain confirmation as to whether Avenor is processing personal data concerning them. Data subjects have the right to:

  • Access their personal data.
  • Request the rectification of inaccurate data.
  • Request erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
  • Object to processing in certain circumstances and on grounds relating to their particular situation.
  • Request the restriction of processing.
  • Request the portability of the data.
  • Withdraw the consent given at any time.

To exercise these rights you may contact info@avenor.es or write by post to the address indicated above, identifying yourself appropriately and indicating the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your data does not comply with the regulations in force.

7. Data security

Avenor adopts the technical and organisational measures necessary to ensure the security of personal data and prevent its alteration, loss, unauthorised processing or access, taking into account the state of technology, the nature of the data stored and the risks to which it is exposed.

8. Modifications

Avenor reserves the right to modify this Privacy Policy in order to adapt it to legislative or case-law developments. In such cases, the changes will be announced indicating the date of the update.

Last updated: May 2026.