Privacy policy

Website and professional relationships

Version 1.2 · 25 October 2026

This policy explains which personal data COMPASS ADVISERS processes, why we use it, for how long and how you can exercise your rights. It applies to browsing the website, enquiries received through the form and our contact channels, voluntary subscriptions and professional relationships in which we act as controller.

1 Data controller

COMPASS ADVISERS, S.L.P. ('COMPASS' or the 'Firm'), tax identification number B65897407. Registered office: calle Joan Torras 1, 08030 Barcelona. Office and contact address: Avinguda Meridiana 350, 11th floor, door A, 08027 Barcelona. Phone: 93 73 72 999. Contact and data protection email: info@compassadvisers.eu.

Registered in the Barcelona Commercial Registry, volume 43457, folio 215, sheet B430515, entry 1.

When we process data on behalf of a client, for example when managing their payroll, we act as processor under the specific data protection agreement. In that case, the client as controller must provide processing information to the individuals concerned, with our assistance where appropriate.

2 Purposes of processing

We use the information needed to answer enquiries, prepare proposals, provide contracted accounting, tax, employment, legal and consultancy services, manage invoices and payments, and fulfil legal obligations. We may also process it to handle complaints and defend rights.

Newsletters, legislative updates and promotional communications will only be sent to people who have consented. Communications essential to carrying out an engagement are not an advertising subscription. Each purpose relies on the legal basis stated below.

On the website we also process technical data to deliver pages, maintain the service and prevent automated or abusive submissions, and to manage and record cookie preferences. Google Analytics 4 is planned to help understand website use; it is not yet activated as of this version's date.

3 Legal bases and nature of the data

Legitimate interests will be used after assessing necessity and balancing them against your rights. You may object as described in section 8.

Website operation and security rely on the legitimate interest in maintaining an available service protected against abuse (GDPR Article 6(1)(f)), limited to what is necessary. Managing and recording consent choices fulfils obligations under GDPR Articles 5(2) and 7(1) and Article 22.2 of Spain's LSSI (GDPR Article 6(1)(c)). Optional analytics, when introduced, will require prior consent (GDPR Article 6(1)(a) and LSSI Article 22.2).

Required fields will be identified on each form. If necessary information is missing, we may be unable to reply or provide the service. Optional data and newsletter subscriptions are voluntary; declining does not prevent engaging our services. Reading this policy does not constitute consent to all processing.

4 Categories and sources of data

Through the contact form we process the data you provide: full name, company, email, phone and, if supplied, job title, service or need, approximate turnover and a description of the situation. We also record the information and communication choices you select. We do not request an identity-document copy for a simple enquiry. When starting a professional relationship, we may require identity, representation, beneficial ownership and billing data, together with the economic, tax, accounting, employment or legal data needed for the engagement.

Browsing may involve processing your IP address, browser and device information, requested page, request source and technical logs needed to provide and protect the service. The cookie manager records acceptance or rejection, the date and policy version. This data comes from your browser and interaction with the website.

Data comes from the individual and, where relevant to the service, the entity they represent, the client supplying documents, other participating professionals, or registers and authorities we lawfully access. We will identify the specific source and data categories obtained where required.

Avoid including health data, trade-union membership or other particularly sensitive information in general forms, as well as criminal records or unnecessary third-party data. If an engagement requires such information, we will explain how to provide it appropriately and the legal authorisation for processing it.

Unsolicited submission of sensitive data does not itself authorise its use. It will only be processed if necessary and supported by an Article 6 GDPR basis and an applicable Article 9 exception, such as establishing or defending legal claims. Criminal data is subject to Article 10 GDPR and enabling legislation. Without authorisation, we will limit use to lawfully handling receipt and secure deletion or return.

5 Data retention

We do not apply a single period to all information. We retain each item for as long as necessary for its purpose and afterwards where required by law or to address liability. The criteria are set out below.

Where blocking is required, data will be reserved for the legally specified purposes and recipients. Once the periods expire, it will be deleted or irreversibly anonymised. Closing the client portal does not mean immediate deletion.

Enquiries stored in Webflow follow the retention criteria above: using the platform does not justify indefinite retention. The preference cookie has the lifetime stated in the Cookie policy. According to its documentation, iubenda retains technical access logs only when needed to monitor the service, for at most 15 days; if its consent evidence log (CPL) is enabled, it specifies a maximum of five years, which may be reduced. Before Analytics is activated, we will state the retention period selected in its settings.

6 Recipients and international transfers

Data access and disclosures

Tax and social security authorities, courts and competent authorities may receive data where legally required or authorised. Banks, court representatives, notaries, registries and other professionals may receive data needed to manage payments or carry out work within the engagement, under the relevant legal basis.

Web hosting, email, document management, professional software, technical support and newsletter providers accessing data on our behalf will be subject to a processing agreement covering instructions, confidentiality, security and, where applicable, subcontracting. A confidentiality undertaking alone does not replace that agreement.

Professionals determining their own purposes and means act as controllers of their processing, not as processors merely because they collaborate with COMPASS. We will provide the appropriate information on disclosures needed for each service.

Transfers outside the European Economic Area

If processing involves transferring data outside the European Economic Area, an adequacy decision or another GDPR safeguard will apply, such as standard contractual clauses and supplementary measures where necessary. Statutory derogations will be used only where their conditions are met.

Using Webflow involves processing and storing data in the United States, including form submissions. Webflow publishes its participation in the EU–US Data Privacy Framework and provides for standard contractual clauses in its processing agreement. Cloudflare and Google services and providers' subprocessors may also involve processing outside the European Economic Area. Applicable safeguards depend on the recipient, service and country, as documented in the links in this section; it is not assumed that all data remains in Europe.

You may request information and, where appropriate, a copy of the applicable safeguards at info@compassadvisers.eu, with third-party data and unrelated confidential information protected.

7 Professional secrecy and security

COMPASS will protect information confidentiality and applicable professional secrecy. It will apply technical and organisational measures proportionate to risk, taking account of the nature of the data and service. Access will be limited to those who need it and are subject to the relevant obligations.

Measures will be reviewed to preserve confidentiality, integrity and availability. Where a breach must be notified to the supervisory authority or communicated to affected individuals, this will be done within the statutory terms and deadlines.

Profiling and automated decisions

COMPASS does not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated bot checks protect the form. Planned browsing analytics will be used for website statistics, with consent, not for decisions about engaging services or your financial situation.

8 Rights and how to exercise them

You may exercise the following rights where the legal requirements are met:

Write to info@compassadvisers.eu or Avinguda Meridiana 350, 11th floor, door A, 08027 Barcelona, stating your name, the right requested and a means of reply. If acting through a representative, their authority must be evidenced.

We will not automatically require an identity-document copy. Proportionate additional information will only be requested where there are reasonable doubts about identity. Requests are free of charge, except for the legally specified exceptional cases of manifestly unfounded or excessive requests.

We will respond without undue delay and within one month of receipt at the latest. If complexity or the number of requests requires it, this may be extended by a further two months; we will explain the extension and reasons within the first month. If we cannot fulfil the request, we will explain why and the available complaint routes.

To stop receiving newsletters, use the unsubscribe option in each message or write to the email address above. Unsubscribing from marketing does not stop communications needed to manage a contracted service.

9 Complaints to the supervisory authority

If you consider that processing infringes your rights, you may complain to the Spanish Data Protection Agency through its electronic office at https://www.aepd.es. You need not complain to COMPASS first, although we may be able to help resolve the issue.

10 Browsing and cookies

We use iubenda to display the banner, manage preferences and remember your choice. Cookies and similar technologies, their purposes, duration and providers are detailed in the Cookie policy. You can accept, reject or change non-essential options and withdraw consent through the preferences panel. Reading this policy or submitting an enquiry does not constitute acceptance of analytics cookies or marketing communications.

11 Updates to this policy

This policy may be updated to reflect legal or processing changes. The published version will state its date. If data is to be used for a new purpose, the relevant information will be provided and another legal basis or consent obtained where necessary. Publication of a new version does not itself constitute your consent.

Explanatory appendix

Your privacy at a glance

Abrir infografía a tamaño completo ↗