PRIVACY POLICY
Last updated: October 2026.
1. Data Controller and Data Protection Officer
The controller responsible for processing your personal data is GRUPO GESTIONA-T GESTORES, S.L. (hereinafter “Gestiona-T”), with Spanish Tax Identification Number (NIF) B86407210 and registered address at Avenida del Doctor Arce 14, 28002 Madrid, Spain. Barcelona office: Calle Platón 6, 1st floor, Unit 5, 08021 Barcelona, Spain.
- Telephone: (+34) 916 754 717
- Email: info@grupogestiona-t.com
Gestiona-T has appointed a Data Protection Officer (DPO), whom you may contact with any questions about the processing of your personal data or the exercise of your rights:
- Email: compliance@grupogestiona-t.com
- Postal address: Data Protection Officer, Avenida del Doctor Arce 14, 28002 Madrid, Spain.
We process your data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and Spain’s Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).
2. What Personal Data We Process and Where It Comes From
We process only the personal data necessary for each specific purpose. Depending on your relationship with us, this may include:
| Category of individuals | Personal data processed | Source of the data |
|---|---|---|
| People who contact us through our website, by email or by telephone | Full name, email address, telephone number, company and details of the enquiry | The individual concerned |
| Individual clients, and representatives, directors, shareholders and beneficial owners of corporate clients | Identification and contact details, identity documents, job title or position, corporate, tax and banking information, details of business activities and source of funds, politically exposed person (PEP) status, and documentation required to provide the contracted services | The individual concerned, the client organisation they represent, and publicly available sources (Commercial Registry, Official Gazette of the Commercial Registry (BORME), beneficial ownership registers and official sanctions lists) |
| Employees and family members involved in international mobility services | Identification details, nationality, immigration or residence status, employment and educational information, and documents required for residence and work permits | The individual concerned or their employer |
| Job applicants | CV details, education, qualifications and professional experience | The applicant |
| Suppliers and business partners | Identification and contact details of their representatives and contact persons, and tax and banking information | The supplier concerned |
| People who use our whistleblowing channel | Information that the reporting person chooses to provide, together with personal data relating to individuals concerned or witnesses named in the report | The reporting person; reports may be submitted anonymously |
| Recipients of marketing communications | Name, email address, company and job title | The individual concerned or their existing relationship with us |
If you provide us with personal data about third parties (for example, your company’s shareholders or beneficial owners, or employees for whom you are applying for a permit), you must have informed them of this Privacy Policy in advance and have a lawful basis for sharing their data with us.
We do not request special categories of personal data unless they are essential for a procedure you have asked us to carry out (for example, certain documents required in immigration applications). In such cases, we process them only with the safeguards required under Article 9 of the GDPR.
When we provide payroll, accounting or employment administration services on behalf of a corporate client, we act as a data processor in relation to the personal data of that client’s employees, customers or suppliers. In these cases, the corporate client is the data controller, its privacy policy applies, and we process personal data solely on its instructions and in accordance with the data processing agreement entered into with it (Article 28 GDPR).
3. Purposes, Legal Bases and Retention Periods
| Purpose of processing | Legal basis (Article 6 GDPR) | Retention period |
|---|---|---|
| Responding to enquiries and requests for information or quotations | Taking steps at the data subject’s request prior to entering into a contract (Article 6(1)(b)) | For as long as necessary to respond and, if no contract is entered into, for a maximum of one year |
| Providing contracted services: sale of ready-made companies, corporate management, registered office services, corporate representation and administration, accounting and tax services, payroll, international mobility and compliance | Performance of a contract (Article 6(1)(b)) | Throughout the contractual relationship and, afterwards, with the data restricted for the applicable statutory limitation periods relating to potential liabilities (generally six years for commercial records and four years for tax matters) |
| Identifying and conducting due diligence on clients and beneficial owners, and meeting other anti-money laundering and counter-terrorist financing obligations | Compliance with a legal obligation (Article 6(1)(c)): Spanish Law 10/2010 | Ten years from the end of the business relationship or completion of the transaction (Article 25 of Law 10/2010) |
| Meeting Gestiona-T’s accounting, tax and commercial law obligations | Compliance with a legal obligation (Article 6(1)(c)) | For the periods prescribed by the relevant legislation |
| Maintaining contact with representatives of clients and suppliers | Legitimate interests (Article 6(1)(f), in conjunction with Article 19 LOPDGDD) | For as long as our relationship with the organisation they represent continues |
| Sending existing clients information, updates and event invitations relating to services similar to those they have purchased | Our legitimate interest in keeping clients informed (Article 6(1)(f) GDPR and Article 21(2) of Spanish Law 34/2002) | Until the client objects, which they may do through any such communication |
| Sending those communications to individuals who are not clients | Consent (Article 6(1)(a)) | Until consent is withdrawn |
| Managing recruitment processes | The applicant’s consent when submitting their CV (Article 6(1)(a)) | For the duration of the recruitment process and, if authorised by the applicant, for one year for future vacancies |
| Managing relationships with suppliers | Performance of a contract (Article 6(1)(b)) | Throughout the relationship and for any subsequent applicable statutory limitation periods |
| Handling reports submitted through our whistleblowing channel and investigating the matters reported | Compliance with a legal obligation (Article 6(1)(c)): Spanish Law 2/2023 on the protection of persons who report breaches of the law | For the time strictly necessary to decide whether an investigation should be opened. If no investigation is initiated, the data is deleted after three months unless retained in anonymised form. Records of reports are kept for no longer than ten years |
Use of our website and cookies is governed by our Cookie Policy.
Once the applicable retention periods have expired, personal data is deleted or, where required by law, retained in a restricted form (known under Spanish law as bloqueo de datos). During the statutory limitation period for potential liabilities, such data will be available only to courts and tribunals, the Public Prosecutor’s Office or the competent public authorities (Article 32 LOPDGDD).
4. Recipients, Data Processors and International Data Transfers
We do not sell or otherwise disclose your personal data to third parties except where required by law or necessary to provide a service you have requested. Recipients may include:
- Public authorities: the Spanish Tax Agency and regional tax authorities, the General Treasury of Social Security, immigration offices and other public bodies with which we deal on your behalf.
- Notaries and official registries (including the Commercial Registry) in connection with corporate transactions you instruct us to undertake.
- Financial institutions for opening and managing bank accounts or collecting payment for our services.
- The Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences (SEPBLAC) and other competent authorities, where required under Law 10/2010.
- Courts, tribunals and the Public Prosecutor’s Office, where legally required.
In addition, certain service providers have access to your personal data as data processors acting on our behalf. Such access does not constitute a disclosure to an independent data controller. We have entered into the agreements required under Article 28 GDPR with these providers, which include suppliers of management and accounting software, email and cloud storage services, website hosting and maintenance, IT support, and the external platform used for our whistleblowing channel.
International data transfers. As a general rule, your personal data is processed within the European Economic Area (EEA). If a technology provider processes personal data outside the EEA, this will only take place in a country covered by an adequacy decision of the European Commission (including transfers to organisations certified under the EU–US Data Privacy Framework) or subject to appropriate safeguards under Article 46 GDPR, such as the European Commission’s Standard Contractual Clauses. You may request information about these safeguards from our Data Protection Officer.
5. Your Rights and How to Exercise Them
You may exercise the following rights at any time:
| Right | What it means |
|---|---|
| Access | Find out whether we process your personal data and obtain a copy of it |
| Rectification | Have inaccurate or incomplete personal data corrected |
| Erasure | Request the deletion of your personal data when it is no longer needed |
| Objection | Object to processing based on legitimate interests and, in all cases, to direct marketing communications |
| Restriction of processing | Ask us to retain your personal data without otherwise processing it while a complaint or dispute is being resolved |
| Data portability | Receive the personal data you provided to us in a structured format where processing is based on consent or a contract |
| Withdrawal of consent | Withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal |
How to exercise your rights. Send your request to compliance@grupogestiona-t.com or by post to Avenida del Doctor Arce 14, 28002 Madrid, Spain, specifying which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for additional information to verify it. We will respond within one month. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension (Article 12(3) GDPR).
Legal limitations. Personal data processed to comply with anti-money laundering legislation is subject to the restrictions set out in Article 32 of Law 10/2010. In particular, Gestiona-T may not inform data subjects of reports made to the authorities. Within our whistleblowing channel, the identity of the reporting person is kept confidential in accordance with Law 2/2023.
Complaints to the supervisory authority. If you believe that we have not properly addressed your rights, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain; www.aepd.es. We recommend that you contact our Data Protection Officer first.
6. Additional Information
Mandatory information. Information marked as mandatory in our forms, and the information required for anti-money laundering due diligence, is essential. If it is not provided, we will be unable to process your request or provide the relevant service. Under Law 10/2010, we cannot establish or maintain a business relationship without completing the identification of the client and its beneficial owner.
Automated decision-making. We do not make decisions based solely on automated processing of your personal data, including profiling, that produce legal effects concerning you. Client risk classifications carried out for anti-money laundering purposes are always reviewed by a person.
Children. Our services are not directed at children under the age of 14, and we do not knowingly collect their personal data.
Security. We implement technical and organisational measures appropriate to the level of risk to protect your personal data against loss, unauthorised access or alteration, in accordance with our internal Data Protection and Information Security Policy. Please inform us of any changes to your details so that we can keep our records up to date.
Updates. We may amend this Privacy Policy to reflect changes in applicable legislation or in our data processing activities. The current version, together with its date, will always be published on this page.