1.- Data Controller and Purpose of data processing

In compliance with (i) the Act 34/2002 of 11 July on Information Society Services and Electronic Commerce; (ii) the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ( “GDPR”); and (iii) the Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights, we inform you that MANUBENS Y ASOCIADOS, S.L.P. (hereinafter referred to as the “Data Controller”) will process your personal data (contact details) for commercial or direct marketing purposes to keep you informed of any news or legal event that may be of interest to you, and to maintain contact and a commercial relationship with you (and, where appropriate, with the company you work for). This includes the sending of newsletters and articles of legal nature, as well as commercial or advertising communications or promotional offers, by electronic means, both from the MANUBENS Group and from PRAGMA, the international network of law firms to which the Data Controller belongs.

The companies which make up the MANUBENS Group are MANUBENS Y ASOCIADOS, S.L.P., MANUBENS MADRID ABOGADOS, S.L.P. and MANUBENS MÁLAGA ABOGADOS, S.L.P.

We remind you that you can object at any time to the processing of your personal data for promotional or direct marketing purposes as well as, in particular, to the sending of said newsletters and electronic commercial communications through the exercise of your right to object, by sending a regular mail to MANUBENS Y ASOCIADOS, S.L.P. to the following address: Avenida Diagonal, 682, 3ª planta, Barcelona (08034) – Spain; or by sending an email to: lopd@manubens.com.

As indicated above, the Data Controller is MANUBENS Y ASOCIADOS, S.L.P., with Tax Id No. (CIF) B62185632, with registered office at Avenida Diagonal, 682, 3ª planta, Barcelona (08034) – Spain, and email address for the purposes of this Personal Data Protection Policy: lopd@manubens.com.

2.- Legitimisation of data processing

The legal basis that enables MANUBENS Y ASOCIADOS, S.L.P. to process your personal data (contact details) to send you newsletters, articles of legal nature and commercial communications or promotional offers by electronic means is the legitimate interest of the firm to keep you informed of any news or legal event that may be of interest to you, and to maintain contact and a commercial relationship with you (and, where appropriate, with the company you work for).

3.- Duration of data processing

Your personal data (contact details) will be processed for commercial and direct marketing purposes indefinitely, as long as you do not exercise your right to object to the processing for such purposes.

4.- Recipients (Disclosure of data or Data processing by way of a Processor)

MANUBENS Y ASOCIADOS, S.L.P., may communicate your personal data to third parties if it is necessary to manage and maintain the commercial relationship with you as long as you have given your prior consent, or when so required by a legal obligation.

Likewise, those companies to which MANUBENS Y ASOCIADOS, S.L.P. outsources the following services, may have access to your data:

• Cloud computing
• Auditing
• Translation
• Mailing
• Technical or computer support

5.- Data Subjects Rights

MANUBENS Y ASOCIADOS, S.L.P. undertakes to respect and facilitate the exercise of your rights, that is, the right of access, the right to rectification, the right to erasure, the right to object, the right to restriction of processing, and the rights related to automated individual decision-making (including profiling), under the terms and within the limits established in articles 15 to 22 of the GDPR.

Please find below a brief explanation of the scope and content of the rights that you can exercise:

• Right of access: Under this right, you have the right to obtain from us confirmation as to whether or not we have personal data concerning you, and, where that is the case, you can ask us for information on it. We are obliged to answer, among other questions, the ones related to the purposes of the processing, the categories of personal data concerned and the recipients to whom your personal data have been disclosed. However, this right is not absolute, and the right of access may be restricted by the interests of other parties under the terms set forth in the GDPR. This right is regulated by Article 15 GDPR.

• Right to rectification: Under this right, we are obliged to rectify inaccurate personal data and to complete incomplete personal data when so requested by you. However, this right is subject to the restrictions set forth in said Article 16 GDPR.

• Right to erasure (‘right to be forgotten’): Under this right, in the event that any of the circumstances provided by article 17 GDPR occurs, we will have to erase your personal data when so requested by you. However, this right is subject to the restrictions set forth in said Article 17 GDPR.

• Right to restriction of processing: Under this right, in the event that any of the circumstances provided by article 18 GDPR occurs, we will have to restrict the use we make of your personal data when so requested by you, under the specific terms set forth in said Article 18 GDPR.

• Right to data portability: In the event that the circumstances provided by article 20 GDPR occur, you will have the right, upon request, to receive the personal data concerning you that you have provided us with, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from our part (you shall have also the right to have your personal data transmitted directly from us to another controller if you request us to do so and where technically feasible.) However, this right is subject to the restrictions set forth in said 20 GDPR.

• Right to object: If the circumstances provided by article 21 GDPR occur, you will have the right, upon request, to object to us using your personal data. In such cases, and as long as you exercise this right, we will be obliged to stop using your personal data. This is the case, for example, when using personal data for marketing or direct marketing purposes, in which case you will have the right to request us to stop using your data for that purpose. This right is regulated by Article 21 GDPR.

• Right not to be subject to a decision based solely on automated processing, including profiling: You will have the right, upon request, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which significantly affects you in a similar way. This right is regulated by Article 22 GDPR and is subject to the restrictions set forth therein.

You can exercise the aforementioned rights at any time including the right to withdraw the consents given and to object to the sending by electronic means of newsletters, articles of legal nature and commercial or advertising communications or promotional offers by sending a regular mail to Avenida Diagonal, 682, 3ª planta, C.P. 08034, Barcelona (Spain), or an e-mail to the following address: lopd@manubens.com.

Your personal data will always be processed with a level of protection in accordance with the requirements of the regulations in force on the protection of personal data suitable to guarantee their security and confidentiality.

Finally, we inform you of your right to file a claim with the Spanish Agency for Data Protection whenever you consider it necessary or appropriate.