Last updated: 10 November 2026

Privacy policy

At Assessoria Carrasco we handle your personal data confidentially and only for what you ask us to do. This policy explains what data we collect, why, how long we keep it and what rights you have. It complies with the EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).

This English version is provided for information. In case of discrepancy, the Spanish version prevails.

1. Who is the data controller

For any question about your data, you can write to us at this same email address.

2. What data we process

When you contact us

Through the website form, WhatsApp, phone, email or in person: name, phone number, email address, the subject of your enquiry and any information you choose to share.

When you are a client

The data needed to provide the service you ask us for, which may include:

• Identification and contact: name, ID document, NIE or passport, address, phone and email.
• Immigration: nationality, administrative status, address and municipal registration, family details, education, job offers or employment contracts and, when the law requires it for the procedure, criminal record certificates.
• Tax, accounting and employment: financial, banking and tax data, and the employee data needed to manage payroll and Social Security.
• Corporate: details of partners and directors to incorporate or manage companies.
• Transport: contact details and pick-up and delivery addresses.

Some immigration procedures may require special categories of data (for example, health data or criminal records). We only process them when they are essential for the procedure you have asked us to handle, and with the safeguards required by law.

If you give us data about other people (relatives, employees or partners), you must have informed them and, where necessary, obtained their consent.

3. What we use it for

• Answering your enquiry and preparing a quote.
• Providing the services you hire: immigration procedures, tax, accounting, employment and legal advice, company formation and transport.
• Representing you before public authorities when you authorise us to.
• Invoicing and keeping the firm's accounts.
• Meeting the firm's legal obligations, including anti-money-laundering rules where applicable.
• Informing you of deadlines and changes affecting your procedures while you are a client.

We do not carry out automated profiling or automated decision-making about you, and we do not use your data for third-party advertising.

4. On what legal basis

• Consent (Art. 6.1.a GDPR): when you send us an enquiry through the form, WhatsApp or email.
• Performance of a contract or pre-contractual steps (Art. 6.1.b GDPR): to prepare quotes and provide the services you hire.
• Compliance with legal obligations (Art. 6.1.c GDPR): tax, corporate and anti-money-laundering obligations.
• Legitimate interest (Art. 6.1.f GDPR): to keep in touch with clients about services similar to those hired. You can object at any time.
• For special categories of data, your explicit consent or the need to establish, exercise or defend legal claims (Art. 9.2.a and 9.2.f GDPR).

If you do not provide the necessary data, we will not be able to answer your enquiry or provide the service.

5. How long we keep it

• Enquiries that do not become an assignment: up to one year from the last contact.
• Clients: for as long as the relationship lasts and then for the legal periods: 4 years for tax obligations, 6 years for corporate and accounting records, and 10 years for anti-money-laundering records. Data is also kept for as long as needed to deal with any legal liability.

Once these periods have passed, we delete it securely.

6. Who we may share it with

We do not sell or share your data. We only disclose it when necessary to provide the service or when required by law:

• The public authorities responsible for each procedure: Immigration Offices, National Police, Tax Agency, General Treasury of Social Security, Companies Registry, city councils, courts and tribunals.
• Notaries and registries, for company formation and other acts that require it.
• Banks, to manage collections, payments and direct debits.

Technology providers acting on our behalf under a data processing agreement also have access: web hosting (Hostinger), email (Google) and messaging (WhatsApp, owned by Meta).

7. Transfers outside the European Union

Some of these providers, such as Google or Meta (WhatsApp), may process data outside the European Economic Area. In these cases, the transfer is made with the safeguards provided by the GDPR: the EU-US Data Privacy Framework, where the company is certified, or the standard contractual clauses approved by the European Commission.

If you prefer not to use WhatsApp or email, you can contact us by phone or in person.

8. Your rights

You can exercise the following rights at any time:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete it when it is no longer needed.
• Objection: object to certain processing.
• Restriction: ask us to restrict its use in certain cases.
• Portability: receive your data in a commonly used format.
• Withdraw the consent you have given us, without affecting processing carried out before.

To exercise them, write to carlescarrascoassessoria@gmail.com or by post to Comte Borrell 62, 4th floor, door 1, 08015 Barcelona, Spain. State which right you wish to exercise and attach a copy of your ID document. We will reply within one month.

If you believe we have not handled your rights properly, you can file a complaint with the Spanish Data Protection Agency: www.aepd.es.

9. Minors

We do not collect data from children under 14 without the consent of their parent or legal guardian. In procedures involving minors, such as family reunification, the data is provided and authorised by their legal representative.

10. Security and confidentiality

We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Everyone at the firm is bound by a duty of confidentiality and, in the case of lawyers, by professional secrecy.

11. Changes to this policy

We may update this policy due to legal changes or changes in our services. The date of the last update is always shown at the top of the page. To learn how we use cookies on this website, see the cookie policy.