Privacy and Data Protection Policy | Política de Privacidad y Protección de Datos

1. Data Controller

The data controller responsible for processing personal data is:

Voixa Consultors S.L.
Carrer de Pallars 193
08005 Barcelona
Spain
NIF: B24744351
Email: info@voixa.es
Phone: +34 610 52 07 25

Voixa Consultors S.L. complies with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable Spanish data protection legislation.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identification data (name, surname)
• Contact data (email address, phone number)
• Company data (company name, tax ID, position)
• Billing and payment data
• Communication data (information provided via contact forms or email)
• Technical data (IP address, browser type, device information, cookies)
• Any other information voluntarily provided by the user

We do not intentionally collect special categories of personal data unless strictly necessary for legal or contractual obligations.

3. Purposes of Processing

Personal data is processed for the following purposes:

• Responding to inquiries submitted via contact forms or email
• Providing consulting and corporate services
• Preparing contracts, invoices, and service documentation
• Complying with legal, tax, and regulatory obligations
• Managing client relationships
• Improving website functionality and security
• Marketing communications (only where lawful and with consent if required)

4. Legal Basis for Processing

Processing is based on one or more of the following legal grounds:

• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)
• Compliance with legal obligations (Art. 6(1)(c) GDPR)
• Legitimate interests pursued by the company (Art. 6(1)(f) GDPR)
• Consent of the data subject (Art. 6(1)(a) GDPR), where applicable

Where processing is based on consent, it may be withdrawn at any time.

5. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, including:

• Duration of the contractual relationship
• Mandatory legal retention periods (e.g., accounting and tax laws in Spain)
• Period necessary to resolve disputes or enforce agreements

After expiration of retention periods, data will be securely deleted or anonymised.

6. Data Sharing and Recipients

Personal data may be shared with:

• Tax advisors, auditors, and legal advisors
• IT service providers and hosting providers
• Payment service providers
• Public authorities where legally required

All third-party processors are bound by data processing agreements in accordance with Article 28 GDPR.

Personal data will not be sold to third parties.

7. International Data Transfers

If personal data is transferred outside the European Economic Area (EEA), such transfer will only occur:

• To countries with an adequacy decision by the European Commission; or
• Under appropriate safeguards such as Standard Contractual Clauses (SCCs); or
• Where another lawful transfer mechanism under GDPR applies.

8. Data Subject Rights

Data subjects have the following rights under GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time

Requests may be submitted via email to: [insert contact email]

Data subjects also have the right to lodge a complaint with the Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD)
www.aepd.es

9. Data Security

Voixa Consultors S.L. implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Secure hosting infrastructure
• Encrypted communication (SSL/TLS)
• Access control policies
• Confidentiality agreements with staff and contractors

10. Cookies

Our website may use cookies and similar technologies to enhance user experience and analyse website traffic.

Detailed information is provided in our separate Cookie Policy.

11. Mandatory Provision of Data

Where personal data is required to enter into a contract or comply with legal obligations, failure to provide such data may result in inability to provide services.

12. Updates to This Policy

This Privacy Policy may be updated from time to time to reflect legal, regulatory, or operational changes. The current version will always be available on our website.