Privacy policy

This English version is a translation provided for information only. In the event of any discrepancy, the Spanish version prevails: Política de privacidad.

1. Data controller

Controller	Asesoría Laboral Fiscal y Contable MAEK, S.L.
Tax ID (CIF)	B44696748
Address	Calle La Unión, 42, bajo, local 4, 29006 Málaga
Data protection contact email	[email protected]

2. What data we process

We process the data you give us when you contact us or engage us for a service, and the data we obtain from public authorities when handling your matters:

• Identification and contact details: name, identity document, NIE or passport, address, phone number and email address.
• Data needed to provide the service: employment, tax, accounting, financial, family and educational data, and data on your administrative status in Spain.
• The content of messages, voice notes and documents you send us by WhatsApp, email or other channels.
• Data about third parties that you provide for your case, such as your employees or family members. In that case, it is your responsibility to inform them and to have the necessary legal basis for sharing their data with us.

We only process special categories of data, such as health data, when they are essential for the service you have engaged us for, for example in a case of temporary incapacity for work or an application for a benefit.

3. Why we use your data and on what legal basis

Answering your enquiries through any channel	Taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
Providing the services you engage us for and handling your cases before the authorities	Performance of the service contract (Art. 6(1)(b) GDPR).
Meeting our legal obligations: invoicing, accounting, tax obligations and the prevention of money laundering	Compliance with legal obligations (Art. 6(1)(c) GDPR), including those under Law 58/2003, the General Tax Act (Ley General Tributaria), and Law 10/2010 on the prevention of money laundering and terrorist financing.
Notifying you of deadlines, notifications and developments affecting your matters	Performance of the contract (Art. 6(1)(b) GDPR).
Processing special categories of data where the service requires it	Your explicit consent or, depending on the case, compliance with obligations in the field of employment and Social Security law and the establishment, exercise or defence of legal claims (Art. 9(2)(a), (b) and (f) GDPR).

We do not create profiles for marketing purposes, nor do we take decisions based solely on automated processing that produce legal effects concerning you.

4. Communication via WhatsApp

If you write to us on WhatsApp, your messages reach our number through the WhatsApp Business platform of Meta Platforms Ireland Limited, which acts as data processor for the transmission of messages. By using WhatsApp you also accept WhatsApp's terms and privacy policy, which govern the data that platform processes as controller.

We store the messages, voice notes and documents you send us in our systems, together with your file, in order to answer your enquiry and provide the service. Voice notes may be transcribed into text on our own servers so they can be added to your file.

To organise enquiries and prepare replies we use software tools, including artificial intelligence tools, always under the supervision of our team. An automated assistant may acknowledge your messages or ask you for basic documents, and will tell you when it does so. Answers on the substance of your case are always reviewed by a member of the firm.

If you prefer not to use WhatsApp, you can contact us by phone, by email or at our offices.

5. Who we share your data with

We do not sell or transfer your data. We only disclose it:

• To the public authorities and bodies before which we handle your matters (the Spanish Tax Agency (Agencia Tributaria), the General Treasury of the Social Security (Tesorería General de la Seguridad Social), the National Social Security Institute (Instituto Nacional de la Seguridad Social), the State Public Employment Service (Servicio Público de Empleo Estatal), immigration offices (oficinas de extranjería), the Companies Registry (Registro Mercantil), the Andalusian regional government (Junta de Andalucía) and others), to the extent necessary for each procedure.
• To judges, courts and authorities where required by law.

We also work with providers that process data on our behalf as data processors, under a contract and with safeguards in accordance with Article 28 GDPR: web hosting, email, messaging (WhatsApp Business), practice management software and IT tools, including artificial intelligence tools.

6. International transfers

Some technology providers may process data outside the European Economic Area, for example in the United States. In those cases the transfer is covered by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by standard contractual clauses approved by the Commission.

Part of the administrative handling of files is carried out by our management centre in Tetouan (Morocco), operated by MAEK BPO SARLAU, registered in the Tetouan Commercial Register under no. 40561 (ICE 004003481000097), which processes data on behalf of MAEK as data processor, following our instructions and with the same security measures. Morocco does not have an adequacy decision from the European Commission, so this transfer is covered by the standard contractual clauses approved by the Commission (Commission Implementing Decision (EU) 2021/914), incorporated into the data processing agreement. You can ask us for a copy of these safeguards by writing to [email protected].

7. How long we keep your data

We keep your data for as long as the professional relationship lasts and, afterwards, for the periods required by law and for as long as any liability may arise. These include:

• Documents relevant for tax purposes: four years, the limitation period under the General Tax Act.
• Business books, correspondence and supporting documents: six years, under the Commercial Code (Código de Comercio).
• Anti-money laundering documentation: ten years, under Law 10/2010.

If you consult us but do not go on to engage us, we delete your data once it is no longer needed to deal with your enquiry.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting the lawfulness of processing carried out before its withdrawal. Write to us at [email protected] stating which right you wish to exercise and providing proof of your identity.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es).

9. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration, and we restrict access to the members of the team who need it for your case.

10. Changes to this policy

We may update this policy to reflect changes in the law or in our services. The version in force is always the one published on this page.

Last updated: 5 November 2026