PRIVACY POLICY – EXTENDED INFORMATION
Last updated: October 6, 2025
This Privacy Policy forms an integral part of the General Terms and Conditions governing this website.
Who is the Data Controller?
Uhy Fay & Co Group S.L. (Tax ID: B06943443) Data Protection Officer (DPO) Contact: dataprotection@uhy-fay.com Registered Address: Calle Serrano 1, 4th Floor, 28001 Madrid, Spain.Phone: +34 914 260 723 You may reach out to us through any of the channels provided.
We reserve the right to modify or adapt this Privacy Policy at any time. We encourage you to review it periodically. If you are a registered user accessing your account or profile, you will be notified of any material changes.
+ PROFESSIONAL COLLABORATORS
Purposes of processing your personal data:
Providing professional advisory services through collaborative efforts.
Monitoring professional activity.
Executing relevant financial transactions.
Invoicing and fulfillment of tax obligations.
Control and debt recovery management.
Legal basis for processing: Contractual necessity.
+ WEBSITE OR EMAIL CONTACTS
What data do we collect via the Website? We may anonymously process technical data such as your IP address, operating system, browser type, and duration of your visit. If you provide information via our contact forms, we will process your identification data to facilitate necessary communication.
Purposes of processing your personal data:
Responding to your inquiries, requests, or queries.
Managing the requested service or processing your application.
Electronic communications regarding your request.
Marketing or event information via electronic means, subject to your express consent.
Analyzing website performance to improve our products, services, and commercial strategy.
Legal basis for processing: The user’s consent and acceptance. By clicking the “Submit” button on our forms, you confirm that you have been informed and have expressly consented to the terms provided. Our forms identify mandatory fields with an asterisk (*). Failure to provide this information or accept the Privacy Policy will prevent the submission of the form. This typically includes the acknowledgement: “I am over 14 years of age and have read and accept the Privacy Policy.” You may withdraw your consent at any time.
+ SOCIAL MEDIA CONTACTS & EVENTS
What data do we collect? Identification data such as name, surname, social media handle, as well as images, photographs, and audio/video recordings captured during events organized by the firm. Participation in these events may involve the capture of media for corporate communication purposes. Public dissemination of identifiable media is subject to prior express consent, obtained via specific checkboxes or written authorization. For general ambient footage where individuals are not the primary focus, processing is based on the entity’s legitimate interest.
Purposes of processing:
Managing requests and communications received via forms or social media.
Publishing content related to firm events.
Promoting activities, products, and services via corporate channels.
Digital advertising and marketing initiatives.
Legal basis for processing:
Consent: For managing web form requests and the public dissemination of identifiable media.
Legitimate Interest: For capturing ambient event footage that does not infringe upon the rights and freedoms of the data subjects.
+ NEWSLETTER SUBSCRIBERS
What data do we collect? Subscription to our Newsletter is available via our website. We process the email address of active clients to provide legislative updates as part of our service agreement. Web beacons may be used to provide statistical data on open rates and engagement to help us optimize our content and delivery times. You may opt out of these communications at any time.
Purposes of processing:
Managing the requested service and electronic communication.
Providing commercial or event-related information, where authorized.
Analyzing newsletter performance to enhance our commercial strategy.
Legal basis for processing: Contractual relationship. Newsletters are provided as a service to our clients. You may unsubscribe or request a change of email address at any time.
+ CLIENTS
Purposes of processing:
Providing specialized advisory services (Financial, Legal, Tax, and Compliance).
Managing client appointments, maintaining client files, and verifying identity for Anti-Money Laundering (AML) compliance.
Budget preparation and communication.
Electronic communications regarding contracts; this includes monitoring group email communications to ensure service quality and provide appropriate server protection.
Marketing communications, including newsletters, based on your interests (service type, age, etc.). We do not perform exhaustive profiling or complex segmentation.
Administrative, logistics, and communication management.
Executing transactions, invoicing, and tax declarations.
Legal basis for processing: Contractual performance and legitimate interest for commercial communications (to which you may object).
+ SUPPLIERS
Purposes of processing:
Electronic communications regarding requests and services.
Commercial/event information, subject to express authorization.
Administrative, logistics, and communication management.
Financial transactions, invoicing, and tax declarations.
Legal basis for processing: Contractual relationship or your consent upon contacting us.
+ PARTNERS (SOCIOS)
Purposes of processing:
Organization of activities to fulfill corporate objectives.
Internal management and legal compliance.
Calling and holding shareholder meetings.
Financial transactions and tax declarations.
Legal basis for processing: Contractual relationship (share purchase agreement or participation in incorporation).
+ VIDEO SURVEILLANCE
Purposes of processing: Facility surveillance and employee conduct monitoring. Footage may be submitted to courts and tribunals for the exercise of legitimate legal actions.
Legal basis for processing: Unequivocal consent upon accessing premises marked with mandatory information signage regarding video surveillance.
+ SOCIAL MEDIA CONTACTS (INTERACTION)
Purposes of processing: Responding to inquiries, managing service requests, and fostering a community of followers.
Legal basis for processing: Contractual terms within the respective social media platforms (Facebook, Instagram, Twitter, LinkedIn, Google/YouTube). Data is retained as long as you maintain the “follow” or “like” status. Rectification or restriction must be handled via your own profile settings on those platforms.
+ JOB APPLICANTS
Purposes of processing: Managing recruitment processes, scheduling interviews, and evaluating candidates. With your consent, we may retain your CV for future openings or share it with affiliated companies to assist in your job search. We also act under legitimate interest to explore placement opportunities within our group.
Legal basis for processing: Unequivocal consent upon submission of your CV and signing of relevant processing disclosures.
+ WHISTLEBLOWING CHANNEL
Purposes of processing: Internal detection of potential criminal or administrative offenses affecting the legal entity and ensuring compliance with the Code of Conduct and corporate compliance policies.
Legal basis for processing: Public interest/powers and compliance with legal obligations.
+ GENERAL PROVISIONS
Third-party data: As a general rule, we only process data provided by the data subjects themselves. If you provide us with third-party data, you must first obtain their consent, or you indemnify us against any liability resulting from your failure to do so.Minors: We do not process data of persons under 14 years of age.Security measures: We have implemented industry-standard technical and organizational measures to prevent the loss, misuse, alteration, unauthorized access, or theft of personal data.
Data Recipients and International Transfers
Data is not shared with third parties except under legal obligation (e.g., Tax Authorities, financial institutions). We may share data with service providers (web development, hosting) under strict confidentiality agreements. Some applications may involve international transfers to the U.S. These transfers are strictly limited to entities adhering to the EU-U.S. Data Privacy Framework or those demonstrating equivalent protection via Standard Contractual Clauses (SCCs).
Uhy Fay & Co Group S.L. acts as an advisory hub, evaluating client needs to route requests to the most appropriate group entity. Data may be shared between group entities solely to provide the requested service.
Your Rights
Access, rectification, erasure, and restriction of processing.
Data portability (provided in a structured, machine-readable format).
Right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
Right to withdraw consent at any time.
Requesting Rights: We provide standardized forms for exercising these rights. You may request them via email. We will process requests within one month (extendable to two months for complex cases).
Data Retention
Data is retained for the duration of the relationship and subsequently for the period required by law (e.g., tax prescription periods, judicial statutes of limitations).
Data Retention Periods
| Category | Documents / Records | Retention Period |
| Clients | Invoices | 10 years |
| Forms and coupons | 15 years | |
| Contracts | 5 years | |
| Human Resources | Payroll, TC1, TC2, etc. | 10 years |
| CVs | Until end of selection process + 1 year (w/ consent) | |
| Dismissal/Severance docs, Contracts, Temporary worker data | 4 years | |
| Employee file | Up to 5 years after termination | |
| Marketing | Web visitor databases | For the duration of processing |
| Suppliers | Invoices | 10 years |
| Contracts | 5 years | |
| Access/Surveillance | Visitor list | 30 days |
| Video recordings | 30 days (blocking), 3 years (destruction) | |
| Accounting | Accounting books and documents, Board/Shareholder agreements, Statutes, Minutes, Financial statements, Audit reports, Grant records | 6 years |
| Tax | Tax administration, payment/withholding records | 10 years |
| Intra-group pricing information | 18 years | |
| Intra-group transactions for pricing agreements | 8 years | |
| Health & Safety | Medical records | 5 years |
| Environment | Hazardous substances/chemicals info | 10 years |
| Environmental permits | During activity + 3 years after closure | |
| Crimes (statute of limitations) | 10 years | |
| Recycling/Waste records | 3 years | |
| Cleanup grants (rights/obligations/receipts/payments) | 4 years | |
| Accident reports | 5 years | |
| Insurance | Policies | 6 years (general), 2 years (damages), 5 years (personal), 10 years (life) |
| Purchases | VAT records (goods/services/intra-community/import/export) | 5 years |
| Legal | Intellectual/Industrial Property, Contracts/Agreements | 5 years |
| Permits, licenses, certificates | 6 years after expiration | |
| Criminal (statute of limitations) | 10 years | |
| Confidentiality/Non-compete agreements | Duration of obligation | |
| Data Protection (GDPR) | Data processing (if different from AEPD notification) | 3 years |
| Employee data (networks/computers/access control/management systems) | 5 years | |
| Whistleblowing | Internal reports, compliance program (corporate criminal liability) | 3 months (general) / 10 years (statute of limitations) |
GROUP ENTITIES
Each entity provides services independently:
Fay & Co Advisory, S.L.: Business, financial, legal, audit, accounting, and compliance advisory.
UHY Fay & Co Auditores Consultores, S.L.: Financial audit, accounting, tax, and financial advisory.
UHY Fay & Co Tax and Legal, S.L.: Legal and tax advisory services.
UHY Fay & Cointegra Soluciones Sostenibles, S.L.: Sustainability and non-financial reporting compliance.
Rose & Clavel Chartered Accountants, S.L.; UHY Fay & Co Holding Spain, S.L.; UHY Fay & Co Business Services Madrid, S.L.: Business advisory and compliance.
You will be explicitly informed which group entity will handle your specific case. There is no commitment to engage any specific entity until formal service terms are agreed upon.