Personal Data Protection and Privacy Policies

Pursuant to the legality, fidelity and transparency principles of the Organic Personal Data Protection Law (hereinafter the “LOPDP” for its initials in Spanish), AVLABOGADOS CÍA. LTDA. (hereinafter “AVL” or the “Controller”) informs through the Personal Data Protection and Privacy Policy herein (hereinafter the “Política”), as follows:

1. CONTROLLER

The personal data Controller is: AVLABOGADOS CÍA. LTDA.

  • Address: Av. República de El Salvador N35-146 and Suecia, Edif. Prisma Norte, piso 11.

  • Telephone number: +593 2 2443866.

2. PERSONAL DATA PROCESSING

AVL will process personal data of individuals (hereinafter the “Data Subjects”) according to the following chart:

 

Data SubjectsProcessing purposes and typesData categoriesLegal basis
CLIENTS
Submit
estimates for services requested by the Data Subject to AVL.

Identity and contact information:

  • Names and surnames;
  • Telephone number;
  • E-mail address.
Enforcement of precontractual measures upon request of the data subject (Art. 7.5. LOPDP).
Process
data entered or recorded in the forms provided at the AVL website.

Identity and contact information:

  • Names and surnames;
  • Telephone number;
  • E-mail address.
Enforcement of precontractual measures upon request of the data subject (Art. 7.5. LOPDP).
Ansewers
to enquiries or requests made through AVL official channels, including its social media (LinkedIn and X).
**
Please review the privacy policy of each one of the above mentioned social media.  AVL is not responsible for any processing such media may conduct of your personal data.**

Identity and contact information:

  • Names and surnames;
  • Telephone number;
  • E-mail address.
  • Enforcement of precontractual measures upon request of the data subject. (Art. 7.5. LOPDP).
  • Legitimate interest (Art. 7.8. LOPDP).
Assess
potential clients to prevent asset laundering and crime financing.

Identity and contact information:

  • Names and surnames;
  • Telephone number;
  • E-mail address.

Tax information:

  • Tax return.

     

Politically Exposed Person (PEP) information:

  • Marital status; and,
  • Identity information of the spouse: names and surnames.
Compliance with legal obligations (Art. 7.2. LOPDP).
Transfer
personal data to competent authorities in case it is necessary or if it has been duly required to AVL by such authorities.

Identity and contact information:

  • Names and surnames;
  • Identity document number;
  • Telephone number; and,
  • E-mail address.
  • Compliance with legal obligations (Art. 7.2. LOPDP).
  • Pursuant to judicial instruction (Art. 7.3. LOPDP).
Manage
the legal advisory contract.

Identity and contact information:

  • Names and surnames;
  • Telephone number;
  • E-mail address.
Enforcement of precontractual measures upon request of the data subject (Art. 7.5. LOPDP).
Send
articles or legal news on subjects related to AVL services.

Identity and contact information:

  • Names and surnames;
  • E-mail address.
Legitimate interest (Art. 7.8. LOPDP).
Process
personal data for electronic billing of services provided by AVL, expense reimbursement and collections.

Identity and contact information:

  • Names and surnames;
  • ID or TIN number;
  • Telephone number;
  • Home / office address; and
  • E-mail address.

Financial information:

  • Bank account number.
  • Compliance with legal obligations (Art. 7.2. LOPDP).
  • Compliance with contractual obligations. (Art. 7.5. LOPDP).
  • Legitimate interest (Art. 7.8. LOPDP).
Process
requirements, claims or administrative or judicial suits filed by or against AVL.

Identity and contact information:

  • Names and surnames;
  • Telephone number;
  • E-mail address; and
  • Home / office address.
  • Compliance with legal obligations (Art. 7.2. LOPDP).
  • Compliance with contractual obligations. (Art. 7.5. LOPDP).
  • Legitimate interest (Art. 7.8. LOPDP).
SUPPLIERS AND STRATEGIC PARTNERS
Assess
potential suppliers and strategic partners to prevent asset laundering and crime financing.

Identity and contact information:

  • Names and surnames;
  • Telephone number; and,
  • E-mail address.

Tax information:

  •  Tax return.

Politically Exposed Person (PEP) information:

  • Marital status; and,
  • Identity information of the spouse: names and surnames.
Compliance with legal obligations (Art. 7.2. LOPDP).
Manage
payment procedures.

Identity and contact information:

  • Names and surnames;
  • ID or TIN number;
  • Telephone number;
  • Home / office address; and
  • E-mail address.

Financial information:

  • Bank account number.
Compliance with contractual obligations. (Art. 7.5. LOPDP).
Ansewers
to enquiries or requests made through AVL official channels, including its social media (LinkedIn and X).
**
Please review the privacy policy of each one of the above mentioned social media.  AVL is not responsible for any processing such media may conduct of your personal data.**

Identity and contact information:

  • Names and surnames;
  • Telephone number;
  • E-mail address.
  • Enforcement of precontractual measures upon request of the data subject. (Art. 7.5. LOPDP).
  • Legitimate interest (Art. 7.8. LOPDP).
Process
requirements, claims or administrative or judicial suits filed by or against AVL.

Identity and contact information:

  • Names and surnames;
  •  Telephone number;
  • E-mail address; and
  • Home / office address. 
  • Compliance with legal obligations (Art. 7.2. LOPDP).
  • Compliance with contractual obligations (Art. 7.5. LOPDP).
  • Legitimate interest (Art. 7.8. LOPDP).
APPLICANTS FOR JOB POSTS OR PROFESSIONAL SERVICES
Manage
any personnel or service provider selection process launched through any channel AVL may determine.

Identity and contact information:

  • Names and surnames;
  •  Telephone number; and,
  • E-mail address.

Academic and professional information:

  • Qualifications;
  •  Professional experience;
  • Résumé; and
  •  Professional references.

Sensitive categories:

  • Health information.
  • Compliance with legal obligations (Art. 7.2. LOPDP).
  • Enforcement of precontractual measures upon request of the data subject (Art. 7.5. LOPDP).
  • Legitimate interest (Art. 7.8. LOPDP).

Processing of personal data of the employees and professional service providers of AVL is independently discussed within the relevant job or professional service contracts.  Anyway, and as applicable, employees and service providers should refer to the Policy herein when it has been so stated in their contract or otherwise in AVL’s policies or conduct codes and any further regulation the firm may issue.

In the event AVL process personal data of Data Subjects that are not referred to herein, or if it conducts processing not mentioned in this Policy, the Controller should properly inform about the processing being conducted and, if necessary, it should obtain the relevant consent.

It is worth to emphasize that data belonging to professionals, traders, legal representatives of legal entities, partners or shareholders of legal entities and public servants that is of public domain could be freely processed, provided such processing is linked to the performance of AVL’s corporate purpose.

3. TYPE OF PROCESSING CONDUCTED BY AVL

Notwithstanding the processing types mentioned above and in order to meet AVL’s objectives, the Controller may collect, gather, obtain, record, organize, structure, keep, adapt, modify, eliminate, index, extract, consult, produce, use, exploit, distribute, assign, disclose or transfer, access, limit, suppress and, in general, process personal data according to the provisions of the LOPDP.

Both the processing types and categories have been included as examples; consequently, they will be determined and informed to the Data Subjects according to each case.

4. STORAGE PERIOD OF PERSONAL DATA

In the event of termination of the legal relationship with the Data Subjects, AVL should store the personal data thereof for at least ten years to allow the defense of the Controller in case of any legal process or administrative claim from or against it regarding the services it provides.

In any case, personal data should be processed as needed to satisfy the purpose for which it was collected or to comply with any legal requirement; therefore, the above mentioned period could be reduced or increased accordingly.

If the data protection supervision authority (hereinafter the “Authority”) determines specific periods, AVL undertakes to process personal data for the maximum term so determined.  Nevertheless, AVL undertakes that if such processing is actually not required or if it has internally been determined that the processing term should be reduced, it should be informed to the Data Subjects in advance of the processing.

The Controller will take every reasonable safety steps to suppress, block, pseudonymize or anonymize personal data if it is necessary.

5. AVL DATABASES

AVL has several digital and physical databases (personal data) that are fed by data entered through the different channels for information collection, by enforcement of precontractual measures o compliance with contractual obligations, direct disclosure of personal data from Data Subjects, among others.

6. ORIGIN OF PERSONAL DATA

AVL collects and processes personal information from its employees, service providers, potential clients, clients, suppliers and strategic partners through any means or through different interactions, namely requests for service estimates, filled-in contact forms, social media interaction, telephone calls and / or e-mails to AVL, public sources,
etc.

7. SUBSEQUENT PURPOSES OR PROCESSING

AVL does not process personal data for other purposes than those mentioned in section 2 hereof; however, in case it would further do so, the Controller undertakes to inform the Data Subjects in advance and, as the case may be, obtain their consent.

8. NATIONAL OR INTERNATIONAL DISCLOSURE OR TRANSFER OF PERSONAL DATA

AVL could eventually transfer personal data of its clients, suppliers, employees, service providers, strategic partners, etc., in case of need or if the competent authorities require it.

AVL does not disclose or transfer personal data abroad.

9. CONSEQUENCES OF THE DISCLOSURE OF PERSONAL DATA OR THE DISCLOSURE THEREOF WITH ERRORS OR INACCURACIES

To ensure the meeting of any of the purposes determined by AVL, Data Subjects should provide accurate and complete information; otherwise, it could affect the due provision of services and responses from AVL.

Likewise, AVL reserves the right to decline the provision of the services or responses to Data Subjects if these would not provide their data or it is provided with errors, inaccuracies or wrongly.

10. RIGHTS REGARDING PERSONAL DATA PROCESSING AND HOW TO EXERCISE THEM

10.1. Data Subjects may exercise the following rights regarding the processing of their personal data by the Controller:

  • Right of information: Data Subjects have the right to be informed by any means about the processing of their data, according to the principles of loyalty and transparency.
  • Right of access: Data Subjects have the right to freely access their personal data and the detailed information processed by AVL, without the need to present any justification to do so.
  • Right to rectification: Data Subjects have the right to have the Controller rectify or update their personal data that is inaccurate or incomplete. To exercise this right, the Data Subject should submit the relevant support following the process provided by section 11 hereof.
  • Right to restriction of processing: Data Subjects have the right to request the Controller to only process the data required to meet the determined purpose.
  • Right to erasure: Data Subjects have the right to have AVL delete their personal data when:
  1. The processing of their data does not comply with the principles provided by the LOPDP;
  2. The processing of their data is not necessary or pertinent to meet the determined purpose;
  3. The personal data has met the purpose for which it was collected or processed;
  4. The storage period for their data has expired;
  5. The processing affects their fundamental rights or individual freedoms;
  6. The Data Subjects have revoked their consent or claim that it has not been given for one or several specific purposes, without the need to provide any justification for such revocation; or
  7. In compliance with a legal obligation.If the Data Subjects exercise this right, AVL undertakes to implement the methods and techniques leading to definitely and safely erase, make illegible or render unrecognizable their personal data.

In compliance with the LOPDP, AVL ratifies that the Data Subjects may, at any time, revoke their consent for the processing of their personal data by the Controller, except in case of the operation of any limitation to the exercise of this right provided under numeral 10.3 hereof.

  • Right to object: Data Subjects have the right to object or refuse the processing of their personal data. The Controller should cease to process personal data except when AVL proves compelling reasons for the processing over the interests, rights and freedoms of the Data Subjects, or for the filing, exercise or defense of claims.
  • Right to data portability: Data Subjects have the right to receive from the Controller their personal data in a compatible, updated, structured, common, interoperable and machine readable format, preserving its characteristics, or otherwise transmit them to other controllers.

Data Subjects may request AVL to make the transfer or disclose their personal data to other controller as soon as technically possible and the Controller could not claim any type of impediment to stall the access, transfer or reuse of data by the Data Subjects or other controller.

Once the data has been fully transferred, AVL should erase it from tis records, except when the Data Subjects have instructed their storage.  The receiving controller should take over the responsibilities provided by the LOPDP.

The transfer or disclosure should take place between controllers when such operation is technically feasible, otherwise the data should be directly transferred to the Data Subjects.

The data portability right could only be exercised upon the occurrence of at least one of the following conditions:

  1. The Data Subjects have agreed for the processing of their personal data for one or several specific purposes;
  2. The processing is conducted through automated means; or
  3. The amount of personal data being processed is considerable.

This right is not applicable when the data has been deducted, derived, created, generated or obtained from the analysis or processing conducted by AVL on the basis of personal data provided by the Data Subject, such as personal data that has been subject to customization, recommendation, categorization or profiling.  Please keep in mind the limitation of this right under section 10.3 hereof.

If possible, data should be transferred in XLM, Excel or any other electronic format and channel commonly accepted by the designated representative of the receiving entity or controller.

  • Right to stop the processing: Data Subjects have the right to have the Controller stop processing their data upon the occurrence of any of the following conditions:
  1. When the Data Subjects challenge the accuracy of the personal data, while the Controller checks such accuracy;
  2. The processing is illegal, and the Data Subjects oppose to the erasure of personal data and instead request the limitation of its use; and
  3. The Controller no longer requires the personal data for the purposes of the processing, but the Data Subjects require it for claim filing, exercise or defense.
  • Right to not being subject of decisions solely or partially based on automated decision-making: Data Subjects have the right not to be subject to a decision based solely or partially on decision-making resulting from automated processes, including profiling, which produce legal effects concerning them or that attempt against their fundamental rights and freedoms. For such purpose, Data Subjects may:
  1. Request the Controller a grounded explanation on the decision made by AVL or the processor;
  2. Submit their comments;
  3. Ask the Controller about the assessment criteria of the automated program;
  4. Ask the Controller about the type of data used and their source; and,
  5. Challenge the decision made by AVL or the processor.

This right should not apply when:

  1. The decision is necessary for the execution of a contract between the Data Subjects and AVL or the processor;
  2. AVL is entitled to do so according to applicable regulations, grounded judicial order, resolution or mandate of the competent technical authority.In this case, AVL should take the necessary steps to safeguard the fundamental rights and freedoms of the Data Subjects;
  3. The manifest consent of the Data Subjects has been obtained; or
  4. The decision has serious impact or poses verifiable risk for the Data Subjects.

10.2. Upon receiving a request to exercise any of the above rights by Data Subjects, according to the guidelines stated in section 11 herein, AVL undertakes to answer them within a fifteen-day term.

10.3. The Controller reserves the right to keep processing personal data of the Data Subjects, hence they could not exercise their rights to rectification, update, erasure, opposition, cancelation and portability in the following cases:

  1. If they are not Data Subjects of the personal data being processed or if their legal representatives have not been duly credited;
  2. When the personal data is required to meet a legal or contractual obligation;
  3. When the personal data is required to comply with a grounded judicial order, resolution or mandate from a competent authority;
  4. When the personal data is required for claim or appeal filing, exercise or defense;
  5. When it could affect rights or legitimate interests of third parties and the Controller has proven so in their answer to the relevant request for exercise of rights;
  6. When it can hinder ongoing judicial or administrative proceedings that have been duly notified;
  7. When the personal data is required to exercise the right to freedom of expression and opinion; and,
  8. In cases of public interest, subject to the compliance with the applicable international human rights standards on the subject, the principles of the LOPDP and the legality, proportionality and need criteria.

11. EXERCISE OF RIGHTS OR CLAIMS

To exercise any of the rights provided herein or to claim about personal data processing, Data Subjects should submit a request to the following e-mail address: protecciondatospersonales@avl.com.ec, or to the main business address of the Controller provided in section 1 hereabove.

The request should contain at least the following:

  1. Names and surnames of the Data Subjects, ID or passport numbers and home / office or e-mail addresses for notification.When submitted by legal representatives, the request should also include the information of the principal;

  2. If possible, a clear and precise description of the personal data subject to the exercise of any of the rights mentioned in section 10 hereof, as well as any other element or document that enables the location of such personal data;

  3. Clear and precise explanation of the request;

  4. Right or rights to be exercised;

  5. The request should include documents that prove the identity, or as the case may be, the legal or conventional representation of the Data Subject.

 

If the information contained in the request requires clarification or additional information, AVL should require such clarification or extension to the Data Subjects only once and within five days after receiving the request.

Data Subjects should have a ten-day term from the day after they receive the request to clarify or complete the information.

If the Data Subjects clarify or complete their request within the said term, the Controller should duly answer it; otherwise ALV reserves the right to file the request and notify the Data Subjects accordingly, explaining the grounds for such action.

If required, Data Subjects may also directly resort to the Authority.

12. AUTOMATED ASSESSMENTS, DECISION-MAKING AND PROFILING

AVL does not process personal data for the purpose of making automated assessments of, decisions on or profiling of the Data Subjects.

13. CHANGES TO THE POLICY

AVL may, from time to time, update or modify the Policy herein.  In such case, AVL undertakes to inform the Data Subjects about any change as soon as practically possible.

Last modification: September 22, 2024.

Contact Us
X-twitter Linkedin-in

We use cookies to offer you the best experience on our website,
you can read more about our policy in this link

Accept