5. WHERE PERSONAL DATA IS PROCESSED

 

Taking into account ELEVA’s structure and the geographical location of its offices, the personal data provided by the User may be processed in Spain and/or Andorra, depending on the requests made, the contractual relationship maintained or participation in recruitment processes.

The data controller —Eleva Legal, S.L. or Eleva Data, S.L., as applicable— has adopted the legal, technical and organizational measures necessary to ensure an adequate level of protection of the personal data provided, in accordance with the standards established in the applicable regulations. In the event that your enquiry is transferred to our subsidiary in Spain, the data controller will become Eleva Legal España, S.L.

Furthermore, in those cases where ELEVA engages service providers located outside the European Union (for example, for the hosting or technical maintenance of the Website), such international transfers will be duly regulated through the execution of Standard Contractual Clauses, in accordance with European Commission Decision 2021/914. All of this reflects ELEVA’s commitment to the protection, integrity and security of Users’ personal data, in accordance with applicable legal requirements.

 

6. WHAT SECURITY MEASURES ARE ADOPTED TO PROTECT PERSONAL DATA?

 

ELEVA adopts the levels of security required by the applicable regulations, appropriate to the nature of the data being processed at any given time. Notwithstanding the above, technical security on the Internet is not impregnable and malicious actions by third parties may occur, although ELEVA uses all means at its disposal to prevent such actions.

In line with ELEVA’s commitment to the protection of personal data and Users’ privacy, the necessary security measures have been adopted to prevent loss, manipulation, disclosure or alteration.

Encryption of communications between the User’s device and ELEVA’s services.

Encryption of information on ELEVA’s own servers.

Other measures aimed at preventing access to User data by third parties, which can be found in our Information Security Policy available at this link.

 

7. USER RIGHTS (“DATA SUBJECTS”)

 

The Data Subject, by written request addressed to the Joint Controllers, through the email address dpd@eleva.legal or the addresses indicated in section 1 above, may at any time and free of charge exercise the following rights:

Right of Access: you have the right to obtain confirmation from ELEVA as to whether or not your personal data is being processed and, if so, to access such data and receive information on the purposes for which it is processed, the categories of data concerned, the recipients to whom your personal data has been disclosed and the envisaged retention period, among other information.

Right to Rectification and Erasure: you have the right to request the erasure of personal data where the legal requirements are met, and the rectification of inaccurate data concerning you when, among other reasons, such data is no longer necessary for the purposes for which it was collected.

Restriction of processing, withdrawal of consent and objection in whole or in part: in certain circumstances (for example, where the accuracy of your data is contested while its accuracy is being verified), you may request the restriction of the processing of your personal data, in which case it will only be processed for the establishment, exercise or defence of legal claims. You also have the right to withdraw your consent and to object to processing at any time, on grounds relating to your particular situation, where processing is based on our legitimate interest or that of a third party. In such cases, ELEVA will cease processing unless it demonstrates compelling legitimate grounds.

Data portability: you have the right to receive the personal data you have provided to ELEVA in a structured, commonly used and machine-readable format, and to transmit it to another data controller without hindrance, in the cases provided for by law.

Other: You may also lodge a complaint regarding the protection of your personal data with the supervisory authority:

• Andorran Data Protection Agency at C/ Doctor Vilanova, 15-17, 5th floor, AD500 Andorra la Vella, when the Data Subject is located in Andorra and considers that ELEVA has infringed the rights granted under applicable data protection regulations.

• Spanish Data Protection Agency at C/ Jorge Juan 6, 28001 Madrid, when the Data Subject is located in Spain;

8. CHANGES TO THE PRIVACY POLICY

 

To ensure that data protection guidelines always comply with current legal requirements, ELEVA reserves the right to make the necessary changes at any time in order to remain compliant with applicable legislation.

Last updated: November 13, 2025.

© ELEVA. Total or partial reproduction is prohibited. All rights reserved.