1. Controller
Cabo Advisory, S.L., CIF B-72900954, with registered office at Calle la Doblada 12, 03540 Alicante, Spain ("Cabo Advisory", "we"), is the controller of the personal data described in this notice. For any privacy matter, contact us at legal@caboadvisory.com or through the contact form.
2. Scope
This notice covers two situations: your use of this website (section 3), and the processing of personal data in the course of our advisory services (section 4). Sections 5 to 11 apply to both.
3. Website visitors
Contact form. If you contact us, we process the details you submit — name, email address, company (optional) and your message — to respond to your inquiry and to take steps prior to a possible engagement. Legal bases: Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in responding to correspondence).
Technical data. Our hosting provider processes technical data such as IP addresses transiently in order to deliver the website and keep it secure. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in operating a secure website). The website sets no advertising or analytics cookies — see the cookie policy.
4. Clients and advisory services
Client representatives and contacts. We process the identification and business contact details of our clients' representatives, employees and other contact persons to perform and administer engagements, communicate, and invoice. Legal bases: Article 6(1)(f) GDPR (our legitimate interest in managing the client relationship) and Article 6(1)(c) GDPR (accounting and tax obligations).
Matter data. In performing advisory services we process the personal data contained in the documents and information our clients provide (the "Client Materials" of our General Terms and Conditions). That data may concern not only the client's own people but also counterparties, their advisors and other third parties involved in a matter, and may reach us from the client, from public registers or from other parties rather than from the persons concerned. We act as controller of this processing, determining the means within the scope of the engagement and subject to our confidentiality obligations and, where our professionals are subject to it, professional secrecy; where we process personal data on a client's documented instructions, we do so as processor under a data processing agreement in accordance with Article 28 GDPR. Legal basis: Article 6(1)(f) GDPR (our legitimate interest, and that of our clients, in the performance of the engagement and in the establishment, exercise and defence of legal claims), and Article 6(1)(b) GDPR where the data subject is the client. Under our General Terms and Conditions, clients are responsible for informing their own data subjects that their data may be provided to us for these purposes.
Anti-money-laundering. We are subject to anti-money-laundering, counter-terrorist-financing and sanctions legislation, including Ley 10/2010. On that basis we process identification and beneficial-ownership data of clients and their owners and representatives. Legal basis: Article 6(1)(c) GDPR (legal obligation). We may be required to report certain matters to the competent authorities and may be legally prohibited from informing the persons concerned.
Conflict checks. We keep limited identification and matter data to check for conflicts of interest before accepting and during assignments. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in complying with professional rules).
Professional updates. We may occasionally send existing clients professional updates about developments relevant to them. Legal basis: Article 6(1)(f) GDPR; you can opt out at any time.
5. Recipients
We disclose personal data, on a need-to-know basis, to the providers of the IT, communication and document-management services we use (for this website: Cloudflare, Inc. for hosting and bot protection, and Resend, Inc. for delivery of contact-form messages), to our professional-indemnity insurers, auditors, legal advisors and subcontractors bound by confidentiality, and to authorities, courts or arbitral institutions where required. Where we instruct other advisors or service providers for a client's account — such as counsel in another jurisdiction, notaries, registries or translators — they receive the data needed for their task and act on their own responsibility. We do not sell personal data and do not use it for advertising.
6. International transfers
Some of our service providers may process data outside the European Economic Area, including in the United States. Such transfers take place under the safeguards of Chapter V GDPR, in particular adequacy decisions (including, while it remains in force, the EU–US Data Privacy Framework) and the European Commission's Standard Contractual Clauses. Information on the safeguards used for a specific transfer is available on request.
7. Retention
Website inquiries are kept for as long as necessary to handle the inquiry and any follow-up. Engagement files — including Client Materials, results and working papers — are kept for five (5) years after completion of the assignment, or for the longer periods required by law, including the ten-year retention period under anti-money-laundering legislation; invoicing and accounting records are kept for the statutory periods. After the applicable period, data is deleted or destroyed.
8. Your rights
You have the right to request access to, rectification or erasure of your personal data, restriction of processing, data portability, and to object to processing based on legitimate interest. To exercise these rights, contact legal@caboadvisory.com. These rights may be limited where they conflict with our confidentiality and professional-secrecy obligations, the rights of others or our statutory obligations — in particular for personal data contained in matter files. You also have the right to lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es) — or with the authority of your habitual residence.
9. Security
We apply appropriate technical and organisational measures to protect personal data. Please note that email and other internet communications are not fully secure; particularly sensitive information can be transmitted by other means on request.
10. No automated decision-making
We do not use personal data for automated decision-making or profiling.
11. Changes
We may update this notice from time to time; the date at the top reflects the latest revision.