Privacy Policy

1. Introduction

We are strongly committed to respecting individuals’ privacy, which is why the protection of personal data is important to us.

We process data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights, and other applicable legislation.

This Privacy Policy was reviewed in August 2026 to comply with the information and transparency obligations relating to the website and the data controller in general. It provides all data subjects, not only website users, with the controller’s general terms concerning personal data protection. Changes may occur before its next review.

2. Who is responsible for processing your data?

• Data controller: ROSS LEGAL SERVICES S.L.
• Tax identification number (NIF/CIF): B73455271
• Address: PASEO DE LA CONSTITUCIÓN ED BALNEARIO, 17. 30880 AGUILAS (MURCIA)
• Email: dani.nieto@rosslegalservices.com

3. What are the sources and types of data we process?

The information we process may originate from any of the following categories:

• Paper, electronic or digital forms.
• Communication and messaging systems: email and messaging applications, telephone, etc.
• Other lawful sources of information.

Depending on the type of data subject (user, customer, supplier, employee, etc.), the nature of the controller’s activities and the processing involved, we may process the following categories of data:

• Identification data, for example: first and last names, images.
• Identification codes or credentials, for example: usernames, employee codes.
• Postal or electronic contact details, for example: telephone numbers, email addresses, social media profiles.
• Personal and professional characteristics, for example: age, date of birth, qualifications, professional experience, CVs.
• Economic, financial and insurance data, for example: bank details, credit card details, etc.
• Financial and non-financial payroll data and other employment-related information, for example: job titles, payslips, etc.
• Transaction data, for example: goods and services supplied and received.
• Special categories of personal data, for example: health information, trade union membership, racial origin.
• Other data and information necessary for or inherent in the performance of our activities, services and purposes.

Mandatory or optional nature of the information provided by the data subject

By ticking the relevant boxes and entering data in fields marked as mandatory (for example, with an asterisk) in the contact form or download forms, data subjects expressly, freely and unambiguously acknowledge that those data are necessary for the controller to respond to their request. Completing the remaining fields is voluntary.

Data subjects guarantee that the personal data provided to the controller are accurate and undertake to notify the controller of any changes. Data requested through the website and marked as mandatory are necessary to provide an optimal service. If all the required data are not provided, we cannot guarantee that the information and services supplied will fully meet the data subject’s needs.

4. For what purposes do we process your personal data?

In general, data are processed to carry out the actions inherent in the normal operation and management of the controller’s activities. More specific processing purposes may apply to the different categories of data subjects:

• Customers and prospective customers: management and maintenance of commercial, pre-contractual and contractual relationships; internal administration; financial management; advertising and marketing; customer service.
• Business partners, creditors and suppliers: management and maintenance of commercial relationships, internal administration and financial management.
• Employees: management, development and maintenance of employment relationships; human resources management; communications; training activities; occupational risk prevention; recording working hours; and other purposes arising from legal obligations and employment relationships.
• Candidates: management of CVs received, job vacancies and recruitment.
• Website and social media users: user support and management of communications between the parties.
• Visitors: visitor assistance and access control at the premises.

Information relating to any other category of data subjects will be processed within the scope of the controller’s activities, in strict compliance with applicable legislation and in accordance with the general criteria set out in this Privacy Policy.

Other general purposes that the controller may implement include:

• Creating a commercial profile to improve your experience by personalising offers and communications. No individual decisions will be made on the basis of that profile, and processing will be based on legitimate interests.
• Video surveillance to protect property and individuals and to carry out the corresponding workplace monitoring, based on legitimate interests.
• Telephone switchboard services, including recording communications for security, assurance and service quality purposes, based on legitimate interests.
• Financial management and monitoring of payment obligations. Where a debtor has an outstanding debt that is established, overdue and enforceable, the controller may disclose this circumstance to credit information databases, debtor registers and debt management or collection services, among others, based on legitimate interests.
• Communications: preparing and sending communications using the available contact details and channels (email, instant messaging, etc.) to internal data subjects (employees) and external data subjects (customers, prospective customers, business partners, suppliers, etc.). These communications may have informational, organisational, commercial or advertising purposes, as appropriate, based on informed consent and the controller’s legitimate interests.
• Other purposes arising from the nature of the controller and the normal performance of its activities, supported by a valid legal basis.

5. How long will we retain your data?

In general, personal data will be retained at least for as long as a relationship with the data subject exists, erasure has not been requested, liabilities may arise, or a legal retention requirement applies.

Data relating to candidates and job applicants will be deleted immediately when they are no longer of interest to the controller.

The controller’s data protection plan includes an inventory of retention periods used to manage the different applicable retention requirements.

Data will always be deleted in a manner that ensures their confidentiality.

6. What is the legal basis for processing your data?

The controller observes and applies the legal bases relevant to each processing purpose. These include:

• The data subject’s informed consent.
• Pre-contractual or contractual commitments.
• The controller’s legitimate interests.
• Applicable legal obligations.
• Other legal bases provided for by law.

7. To whom will your data be disclosed?

Data subjects’ information will not be disclosed to third parties by default, except to: a) ancillary service providers, authorised data processors or other third parties necessary for the proper provision of goods and services; b) competent public authorities and administrations in the exercise of their functions; c) other parties with a legitimate interest and third parties provided for by law.

8. What rights do you have when you provide data to us or we process your data?

As a data subject, you may ask us at any time to exercise any of the following data protection rights:

• Access to your personal data to confirm whether data relating to you are being processed and obtain further information about that processing.
• Rectification or erasure of your personal data where, among other reasons, they are inaccurate or no longer necessary for the purposes for which they were collected.
• Restriction of the processing of your personal data in certain circumstances, in which case they will only be retained for the establishment, exercise or defence of legal claims, to protect another person’s rights or for reasons of public interest.
• Receipt of the personal data concerning you that you previously provided to us, in a structured format where possible (data portability).
• Objection to the processing of your data in certain circumstances and on grounds relating to your particular situation. The company will stop processing your data unless there are compelling legitimate grounds or processing is necessary for the establishment, exercise or defence of legal claims.
• Withdrawal of consent, which may result in the termination or cancellation of any existing business or contractual relationship, where applicable. This does not affect processing carried out before consent was withdrawn.

To exercise these rights, simply contact us using the email or postal address provided at the beginning of this policy.

You may also contact our appointed data protection officer or the Spanish Data Protection Agency to learn more about your rights or request their protection by the supervisory authority.

9. Data security

We implement the necessary technical and organisational measures in our information systems to ensure an appropriate level of data confidentiality, integrity, availability and resilience, in order to protect data subjects’ rights and freedoms.

The controller complies with the provisions and principles set out in the GDPR, ensuring that data are processed lawfully, fairly and transparently in relation to the data subject and are adequate, relevant and limited to what is necessary for the purposes for which they are processed.

However, to the extent permitted by law, we accept no liability for loss or damage arising from alterations that third parties may cause to our information systems. Any security breach will be appropriately and immediately reported to the competent authority and/or law enforcement agencies.

10. Sending communications or information

Our policy on sending information electronically (email, instant messaging, etc.) is limited to communications that we consider relevant to our users and data subjects in connection with the company’s functions and activities, or that you have consented to receive.

If you prefer not to receive these messages, we will provide you with a means of unsubscribing and opting out of further messages, in accordance with Title III, Article 22 of Law 34/2002 on Information Society Services and Electronic Commerce.

11. Social media

The controller may maintain a presence on social media through its profiles. This section and any legal and privacy terms on the website apply to the processing of data relating to users or data subjects who follow or otherwise connect with those profiles.

The controller uses these profiles for communications, business development, marketing and advertising; handling enquiries and providing user support; sharing information about actions, activities and events organised by the controller or in which it participates; and interacting through its official profiles.

The legal bases described in section 6 above are supplemented in this case by the fact that the user or data subject may have a profile on the same social network as the controller and has chosen to follow or connect with the controller’s profile, thereby expressing an interest in the information it publishes. By following the controller’s profiles, the user therefore gives consent to the processing of the data available on their profile.

Users may consult the relevant social network’s privacy policies and terms at any time and configure the privacy settings available on their profiles. Content posted by users may be seen by other users, so users are primarily responsible for their own privacy.

Users who follow or participate in our profiles must refrain from:

• Publishing content or information contrary to the law, morality or good faith. Unlawful, disruptive or inappropriate use or behaviour, behaviour that may generate negative opinions on the profile, or conduct that infringes individuals’ rights is not permitted.
• Acting contrary to the principles of legality, honesty, responsibility, protection of human dignity, protection of minors, public policy, privacy, consumer protection, or intellectual and industrial property rights.

The controller reserves the right to remove any content considered inappropriate without prior notice. It also disclaims responsibility for each platform’s security measures, which users must familiarise themselves with, together with the platform’s legal terms and conditions of use.

The controller expressly disclaims any liability arising from the use of social media by minors or people with special needs. The controller’s social media profiles do not knowingly collect personal information from minors. Therefore, minors must not register for or use the controller’s social media profiles or provide personal information. In Spain, the processing of a minor’s personal data on the basis of their own consent is only permitted from the age of 14. Where required by law or regulation, or where the user has special needs, the involvement of the person exercising parental responsibility, a guardian or a legal representative will be required, supported by a valid document proving their authority to act.

12. Employment and candidate management

Individuals interested in the controller’s job vacancies may provide their personal and professional information through the available channels, preferably using the forms, email addresses or other means provided for this purpose, where applicable.

These data will be processed in accordance with this Privacy Policy to manage applications for potential job vacancies, internships and training opportunities at the controller and any subsidiaries or companies belonging to the same business organisation, where applicable.

Processing will be based on the data subject’s informed consent or another valid legal basis.

If the information provided is not of professional interest to the organisation, or once it is no longer necessary for the purposes for which it was collected, it will be deleted in a manner that ensures its confidentiality and anonymisation.

Any data subject may withdraw their consent and exercise their privacy rights in accordance with the terms set out in this Privacy Policy.