Privacy Policy

ITM Corporate Advisory & Tax S.L. (the “Controller”) informs users and clients of its Privacy Policy regarding the processing and protection of personal data that may be collected through browsing, communications, or the provision of services via the website itmcorporate.com (the “Website”).

By using the Website, you acknowledge and accept this Privacy Policy and the terms included in the Legal Notice.

1. Controller (Data Protection)

Trade name: ITM Corporate Advisory & Tax
Legal entity: ITM Corporate Advisory & Tax, S.L.
Tax ID (NIF): B24916017
Registered office: Campo Volantín 31, Bajo Dcha, 48007 Bilbao (Spain)
Email: liaison@itmcorporate.com (or your official privacy email)
Phone: +34 946 470 667 (format as shown on site)
Company registry: Registered with the Bizkaia Mercantile Registry, Electronic Folio IRUS1000463048359, Sheet BI-86489, Entry 1.

Head Office — Bilbao–Madrid
International presence: Panama (Obarrio, Calle 60, Bv1645 S/N, Floor 12, Unit 12-D)
UK · Netherlands · UAE (Dubai) · Saudi Arabia · Shanghai · Morocco (Tangier) · Mexico · USA (Miami)

2. Applicable Law

The Controller complies with applicable personal data protection laws, including:

• Regulation (EU) 2016/679 (General Data Protection Regulation — “GDPR”)
• Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights (Spain) (“LOPDGDD”)

3. Processing Principles

When processing your personal data, we apply the following principles:

• Lawfulness, fairness and transparency: we process data on a lawful basis and provide clear information.
• Data minimisation: we request only data strictly necessary for the stated purpose.
• Storage limitation: data is kept only for as long as necessary for the purpose and for any legally required retention periods.
• Integrity and confidentiality: data is processed with appropriate security measures to protect confidentiality, integrity and availability and to prevent unauthorised access or misuse.

4. How We Collect Personal Data

You may browse the Website without providing personal data. We collect personal data when you:

• submit a request through contact forms or send emails to us;
• request a confidential call or provide engagement details;
• interact with embedded content or third-party services (subject to their privacy terms);
• accept cookies/analytics (as described in the Cookie Policy).

5. Your Rights

You have the right to:

• access your personal data;
• request rectification of inaccurate data;
• request erasure (where applicable);
• request restriction of processing;
• object to processing;
• request data portability (where applicable).

To exercise these rights, please email liaison@itmcorporate.com (or your privacy contact) and provide valid proof of identity (e.g., a copy of your national ID or equivalent). Rights are personal and must be exercised by the data subject or a duly authorised representative.

You also have the right to lodge a complaint with the supervisory authority, in Spain the Spanish Data Protection Agency (AEPD), if you believe your data protection rights have been infringed.

6. Purposes of Processing

When you contact us, subscribe to updates, or request services, you provide personal data for which the Controller is responsible. This data may include: IP address, name, email address, phone number, role/company, jurisdictions involved, and any information included in your message.

We process personal data for the following purposes, depending on the data collection channel:

1. a) Contact and request forms

To respond to inquiries, requests, concerns, complaints, or matters related to our services, legal texts, and compliance topics.

1. b) Engagement intake / liaison protocol

To screen and verify requests, define scope, manage confidentiality protocols, and coordinate professionals or local advisors when necessary.

1. c) Service provision and client relationship management

To manage the professional relationship, perform contracted services, issue invoices, comply with legal obligations, and maintain proper records.

1. d) Website analytics and improvement

To analyse website usage, improve performance and security, and understand aggregated navigation patterns through cookies and analytics tools (see Cookie Policy).

1. e) Social media management

If you interact with our social media profiles, your data will be processed according to the platform’s terms and our legitimate purpose of managing our presence and communications. We do not use follower profiles to send individualised advertising.

7. Legal Bases for Processing

We process personal data on one or more of the following legal bases:

• Consent (e.g., contact forms, optional subscriptions, cookies where required)
• Contract performance or pre-contractual measures (service requests and engagement intake)
• Legal obligation (tax, accounting, compliance requirements)
• Legitimate interests (security, fraud prevention, business communications, improvement of services and the Website), balanced against your rights.

8. Categories of Personal Data

We may process the following categories:

• Identification and contact data: name, email, phone, company/role
• Technical data: IP address, device/browser information, logs
• Engagement data: jurisdictions involved, time horizon, request summary and related information you provide
  We do not request special category data unless strictly necessary and legally permitted.

9. Data Retention

Personal data will be retained for as long as necessary for the purpose for which it was collected and thereafter for any applicable legal retention periods. Where processing is based on consent, data will be kept until you withdraw consent or request deletion, subject to legal retention obligations.

10. Data Recipients and International Transfers

We may share data with:

• service providers acting as processors (hosting, IT/security, email, CRM, analytics), under appropriate data processing agreements;
• professional collaborators and local advisors, where required for cross-border coordination, subject to confidentiality and on a need-to-know basis;
• public authorities, where required by law.

Where data is transferred outside the EEA, we will ensure appropriate safeguards (e.g., adequacy decisions, Standard Contractual Clauses, or equivalent).

11. Analytics and Cookies

The Website may use analytics tools such as Google Analytics (or equivalent). These tools may use cookies and similar technologies to analyse how users interact with the Website. Information generated by cookies (including IP address) may be transmitted to and stored on servers outside your country.

For detailed information about cookies, purposes, legal basis and how to manage preferences, see our Cookie Policy.

12. Embedded Content from Third Parties

Pages on this Website may include embedded content (videos, images, articles, maps, etc.). Embedded content behaves as if you had visited the external website. These third parties may collect data about you, use cookies, embed additional tracking, and monitor your interaction according to their policies.

13. Security Measures

We implement reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

Hosting provider: [insert your hosting provider name]
(You may consult their privacy policy for more information.)

14. Accuracy of Data

You confirm that the personal data you provide is accurate, complete, and up to date and you undertake to keep it updated. You are responsible for the truthfulness of the data you provide, and the Controller is not liable for inaccuracies resulting from information provided by you.

15. Acceptance, Consent and Withdrawal

By using the Website and submitting information, you confirm you have been informed about data protection conditions and, where applicable, you consent to processing for the purposes described.

You may withdraw consent at any time by contacting us at liaison@itmcorporate.com. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

16. Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy to reflect legislative or case-law developments or industry practices. The updated version will be published on the Website and will remain in force until replaced by a duly published version.