Privacy Policy

For all legal purposes the Spanish language version of the privacy policy, shall be the legally binding one. This English language version is a translation and may contain errors.

The following privacy policy will apply immediately to users who register on https://entretramites.com/en. Effective May 25, 2018. For all existing users, these new Terms will come into effect on May 25, 2018, the date the European General Data Protection Regulation (GDPR) 679/2016 and its subsequent Organic Law 3/2018 on the protection of personal data and guarantee of digital rights came into force, and you must give your consent to continue using our service. However, you can now accept these new Terms at any time by logging into your account.

Data Privacy Statement

We, BEAT BUREAUCRACY ET, SL, with Tax Identification Number (CIF): B01944743, located at CALLE MARÍA DE MOLINA, 39 PISO 3, 28006 MADRID, SPAIN, are the operator of this website. https://entretramites.com/en, as well as the service provider of the Entre Trámites app for iOS and Android, including other services offered through the Entre Trámites websites and app. We are responsible for the collection, processing, and use of personal data in accordance with data protection legislation, specifically the General Data Protection Regulation (“GDPR”).

You, the client, are the data controller, and Entre Trámites, the service provider, is the data processor on your behalf. We only use your data in compliance with applicable data protection legislation.

With this Data Privacy Statement, we want to inform you what personal data is collected and stored when you visit our website or use the services offered on the website. You will also receive information about how we use your data and what rights you have regarding its use. This Data Privacy Statement also applies to access to and use of the Entre Trámites application, as well as other available services.

1. Data security

To protect your data, all the information you provide is encrypted using the Transport Layer Security (TLS) protocol. TLS is a secure and proven protocol used, for example, for online banking. You can identify a TLS connection by the “s” after “http” in the URL displayed in your browser (https://..) or by the padlock icon shown in the browser tab.

TWe also take appropriate technical and organizational security measures to protect your data against random or deliberate manipulation, partial or total loss, destruction, and/or unauthorized access. To prevent data loss, we configureWe use a duplicate database, meaning your data is always stored in two separate locations. In addition, we update and back up your data hourly to an off-site backup and, in line with high-risk analyses, continuously conduct security testing on our infrastructure. Your password is stored through a secure, encrypted process. We will never ask for your password, either by email or phone. If you forget your password,we canWe’ll restore it for you. We continuously improve our security measures based on technological developments.

The personal data we collect is stored in a secure environment within the EU and treated confidentially. Access to this information is limited to selected ET Group employees and suppliers.

We comply with all applicable data protection laws. We make every effort to protect your data, but we cannot guarantee its security when you transfer it over the internet. When this happens, there is a risk that others may gain unauthorized access to your data. In other words, when transferring data over the internet, you, as the data controller, assume responsibility for its security.

2. Collection and storage of personal data and nature and purpose of its use

1. a) If you visit our website

You can visit the website https://entretramites.com/en without revealing your identity. Your browser only sends information – which is collected automatically – to our website’s servers. This information is temporarily stored in a log file. This is the information that is automatically collected and stored until its automatic deletion:

• IP address of the requesting computer.
• Date and time of access.
• Name and URL of the data entered.
• Website from which the access originates (referral URL).
• Browser you use and, if necessary, your computer’s operating system, as well as the name of your internet service provider.

This data is collected and processed to enable the use of our website (establishing a connection), to ensure the security and stability of our system, and for the technical administration of the network infrastructure. This data does not provide us with any information that could personally identify you.

We also use cookies, as well as web analytics and marketing tools. You can find more information about this in sections 3 to 5.

1. b) If you register for our online services

On our website, we offer online accounting, labor, and tax advisory services. To use these services, you must first register. When you register, you will need to enter an email address and a password; this will allow you to create an account with us and log in.

To use our services fully, you may need to enter more personal information.

We also use your name and contact details for the following purpose:

• To find out who our contracting party is.
• For the justification, structure, processing and change of the contractual relationship with you regarding the use of our services.
• To verify the plausibility of the information entered.
• To contact you, if necessary.

1. c) If you register for our newsletter or information bulletin

If you have agreed to receive our newsletter, we may use your email address to periodically send you newsletters and information about our services. To send you newsletters, we must first obtain your consent. This consent must be given during registration. You can withdraw your consent at any time, either through your account or by sending us an email.

You can also unsubscribe from our newsletter at any time, for example, by clicking the unsubscribe link at the bottom of the newsletter. Alternatively, you can email us at

[email protected].

If you cancel your newsletter subscription, we will keep your email address on file only to ensure that you no longer receive these emails.

1. d) Developer, client, supplier, advisor and team

With our services, you can enter third-party data, allow third-party access to your account, connect your account with third parties, and offer your own or third-party applications to third parties. Of course, we also respect the privacy of third-party data that we may access through your use of the service we provide. Sometimes, this may require a separate agreement with you. If you believe this is the case, please contact us.

According to our Terms and Conditions, you are not allowed to share your login credentials with third parties and are obligated to treat such credentials with due care. Furthermore, you are responsible for any third-party data you enter into Entre Trámites.

Please note that we have no control over compliance with security and data protection regulations outside of our website, the Entre Trámites app, or the services we provide. In the cases described, you or the third party to whom you have granted access to your data are responsible.

3. Consent for data transfer

We transmit your personal data to third parties only if you request it, if you have given your explicit consent, or if there are legal obligations to do so.

No personal data is transferred to third parties for any other purpose. Your data is not disclosed to any third party without your permission, unless a court orders its release, and then only to the extent necessary.

Entre Trámites reserves the right to share data within its group as required, in order to provide you with services.

Entre Trámites may also occasionally request to share data with a sister company, for example, to allow billing of your account from an entity other than Entre Trámites.

Data security is ensured at all times.

By registering with Entre Trámites, you consent to the processing of your data. You also give your explicit consent to share your data with third parties when necessary to provide you with our service.

We confirm that we only share your data with third parties whose data maintenance standards satisfy us and comply with all data protection legislation.

Specifically, when we share data with territories outside the EU or EEA, or other territories not included on the list approved by the European Commission, we fully ensure compliance with their data security and confidentiality regulations and that they maintain all shared data in a manner comparable to EU standards. We are obliged to provide, upon request, proof of—or reference to—the appropriate safeguards, and we may do so after receiving a request addressed to  [email protected]by email.

You have the right to withdraw your consent to the processing and/or sharing of your data at any time, either by closing your account, which takes immediate effect, or by contacting us to request closure, which we will do as soon as possible. Once your relationship with Entre Trámites has ended, we only retain the minimum data required to comply with all legal requirements, and only for the minimum period required.

If you have any questions about the processing of your personal data, or if you wish to request access to your data, you can contact the Data Protection Officer (DPO) by writing to[email protected]or by writing to the DPO at the address indicated above.

If you are not satisfied, you have the right to file a complaint with the relevant data protection authority.

Entre Trámites will fully cooperate with any such investigation and will endeavor to answer all inquiries as completely as possible. The relevant authority for each country can be found on the European Commission website: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080

4. Cookies

Our website uses cookies. Cookies are small files that are automatically created in your browser and stored on your device (laptop, tablet, smartphone, etc.) when you visit a page. Cookies do not harm your device and do not contain viruses, Trojans, or other malware.

Cookies store information related to your device. However, this does not mean that we receive any detailed knowledge of your identity.

The use of cookies is intended to enhance your experience with our services. Therefore, we use session cookies to recognize if you have previously visited specific pages on our website or if you have already created a customer account. Your browser will automatically delete these cookies when they expire.

For usability purposes, we use temporary cookies, which are stored on your device for a specific period of time. If you revisit our website to use our services, it will recognize that you have previously visited our website and what activities you have performed, so you don’t have to repeat them.

We also use cookies to statistically track the use of our website and to optimize our offerings (see section 4), as well as to show you personalized information (see section 5). When you revisit our website, these cookies allow us to automatically recognize that you have previously visited our website. After a certain period of time, the cookies will be automatically deleted.

Most browsers accept cookies automatically. You can configure your browser to not store cookies or to always display a warning before a new cookie is created.

However, please note that completely disabling cookies may also result in limited functionality of our website.

5. Web analytics

To design and continuously optimize our website, we use various web analytics services. Therefore, we create anonymous user profiles and use cookies (see section 4).

Below you can find more information about our web analytics services and their opt-out options:

1. a) Google Analytics

We use Google Analytics. This is a web analytics service provided by Google Inc. Information about your use of our website (including your IP address), which is collected via a cookie, is transmitted to and stored on a Google server in the United States. IP addresses are anonymized, so it is not possible to identify you (IP masking). This information is used to analyze the use of our website, to compile reports on website activity, and to provide us with other services related to website and internet usage. The data you enter while using our service will not be combined with any other data held by Google.

Google will only transfer information to third parties if required by law or if third parties process the data on its behalf.

We also use Google Optimize. This is a web analytics service from Google Inc., integrated with Google Analytics. Google Optimize allows us to run A/B and multivariate tests. This way, we can find out which version of our website is preferred by users. You can find more information about this service here.

You can prevent the collection of data, which is carried out through the cookie, as well as the processing of data by Google by downloading and installing a browser add-on here.

As an alternative to the browser add-on, especially for browsers on mobile devices, you can prevent Google Analytics data collection by clicking this link. A blocking cookie will be placed, whichwill preventThe collection of data when you visit a website. The blocking cookie is valid only in this browser and for our website, and will be stored on your device. If you delete the cookie in your browser, you will need to add the blocking cookie again.

You can find more information about data protection with Google Analytics in Analytics Help.

In addition, we use the APIVisionfrom Google Cloud. The OCR (Optical Character Recognition) system is used for optical character recognition, that is, it allows for the automatic recognition and analysis of letters, as well as the categorization of documents. You can find more information about this service here. Character recognition based on the APIVisionGoogle Cloud is essential for using our services. If you do not want the API to be used, please opt out.VisionWith Google Cloud, you have the option to create expenses without uploading documents. In that case, you won’t be able to use the services of

BetweenComplete procedures.

You can find more information about Google’s data protection at the following link:https://policies.google.com/privacy?hl=es

6. Audience segmentation (targeting)

We use audience targeting technologies from Google Inc. (e.g., DoubleClick, AdSense, AdWords) on our website. These technologies allow us toto offer you advertisingbased on your interests. For this purpose, we collect and evaluate information about your user behavior on our website through the use of cookies.

The collection and evaluation are carried out anonymously and do not allow us to identify you. In other words, we do not link this information to your personal data.

If you do not wish to receive personalized advertising, you can prevent it by adjusting the relevant cookie settings in your browser.

You can change the settings to show personalized advertising through Google’s ad settings.

You can find more information, as well as Google’s data privacy rules regarding advertising, in their privacy policy.

7. Facebook Monitoring

We do not use social plugins from Facebook or other social networks. For our Facebook advertising, we use a pixel-based tracking mechanism. This is a web analytics service provided by Facebook Ireland Ltd. The information is used to track conversions originating from the Facebook platform.

This service is provided by Facebook Ireland Ltd., and is subject to European Union data privacy law. We do not share any data you enter while using our service with Facebook.

Consult Facebook’s data protection information to learn more about the purpose and scope of data collection, and the processing and use of data by Facebook, as well as your rights and privacy settings options.

8. Information, correction, blocking, deletion

You have the right to information about the personal data we store and the right to correct or amend incorrect data, as well as to block and delete it.

As the data controller, you are responsible for the content you post. You have the right to rectify, block, or delete any of your data at any time. We can remove content you have posted at your request, but we retain the right not to remove content that is already published or that we are required to keep to comply with certain legal requirements.

For information about your personal data, to correct erroneous data, or to block or delete data, as well as for other questions about the use of your personal data, please send an email to [email protected]. 

Additionally, you can view and change the data stored in your account by logging into our website with your credentials. You can delete your account data at any time. This can be done using the corresponding option in your account settings. Please note that if you delete your data, you will not be able to use our service fully or at all.

9. Changes to the Data Privacy Statement

This Data Privacy Statement is currently in effect and was last updated in May 2018. Due to subsequent developments of the website, the Entre Trámites app, or any other Entre Trámites service, or due to changes in legal or regulatory requirements, this Data Privacy Statement may need to be amended in the future. Our Data Privacy Statement can be accessed and printed at any time from our website.

DATA PROCESSING AGREEMENT

This Data Processing Agreement (“DPA”) is the basis of the relationship between you, the client, as the data controller and Entre Trámites, the service provider, as the data processor under data protection legislation, more specifically, the General Data Protection Regulation (“GDPR”).

This is an important agreement that forms the contractual basis forlet’s processThe data on your behalf. Explain how your data may be processed and for what purpose. We process your personal data only as required and according to your instructions, as described in this agreement.

Due to our large customer base, it would be impossible to provide individual agreements to all users. We also hope that by facilitating this agreement (APD), you, as a business owner whose primary occupation is running your business, will find it easier to accept the new Terms, which comply with the GDPR.

This Data Protection Agreement (DPA) assures you that we, as your data processor, comply with the requirements stipulated in the GDPR. Furthermore, you can rest assured that we maintain the necessary agreements with third parties. Your company details are automatically populated in your account when you accept the Terms and Conditions and Privacy Policy, including this DPA. Your data will always represent the most up-to-date information you have provided to us. The DPA is detailed below for your information.

Data Processing Agreement between:

Customer name (“the customer” or “data controller”, hereinafter) [This information will be automatically completed once you have completed the registration] and BEAT BUREAUCRACY ET, SL, with CIF: B01944743, registered office at RONDA SANT PERE, 52. 08010, BARCELONA, SPAIN, each a “party”; together “the parties”, HAVE AGREED to the terms of this Data Processing Agreement (hereinafter “DPA” or “Agreement”) on the protection of personal data with respect to the processing of personal data when the customer acts as a data controller and

Among other things, as a data processor, we will fulfill the service obligations described in the service agreement (detailed below). As part of fulfilling these service obligations,

Between Procedureswill processcertain personal data on behalf of the data controller, in accordance with the terms of this contract. Each party agrees and will ensure that the terms of this contract are also fully applicable to its affiliates, which may be involved in the processing of personal data for the project defined in the service agreement. Specifically, Entre Trámites will ensure that all sub-processors operate within the same terms as this Agreement when processing the client’s personal data.

1. Introduction and definitions:

Personal data is defined as any information relating to a data subject by which that person can be identified in particular, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural or legal person (where applicable).

All other definitions mentioned in this document, including the terms data controller and data processor, are determined by the corresponding data protection laws, including Organic Law 3/2018 on the protection of personal data and guarantee of digital rights and European Regulation GDPR 679/2016 (hereinafter, “GDPR”).

Sensitive personal data is not considered to be processed under the application service offered by the data processor and is therefore excluded from the terms of this Agreement.

By subscribing to use the Entre Trámites program and accepting the Terms and Conditions, including the Privacy Policy and this Data Protection Agreement, the parties agree under all national data protection laws and under the GDPR that this Agreement governs the relationship between the data controller and the data processor, determining the processing of personal data by Entre Trámites.

of the customer’s data. This Agreement takes precedence, unless it has been superseded by another signed Data Protection Agreement that communicates its primacy over this Agreement.

The purpose of Entre Trámites processing personal data for the client is to ensure the full use of the service by the client and to allow this Agreement to be fulfilled.

Entre Trámites will guarantee that sufficient security of personal data is maintained at all times.

Both parties confirm their authority to sign the Agreement by doing so.

2. Responsibilities of the data processor:

The data processor must process all personal data on behalf of the data controller and follow their instructions. By entering into this Agreement, Entre Trámites (and any subprocessor with whom the data processor has a legal agreement to provide the services) has instructions toprocess themcustomer’s personal data as follows:

1. i) in accordance with all national and European laws;
2. ii) comply with its obligations under the terms of the service application;

iii) according to instructions from the data controller;

(iv) as described in this Agreement.

As a provider of the application, the data processor is required to always provide the client with appropriate solutions to support the ongoing development of their business through the use of the service. The data processor tracks how the client uses the application to make the best suggestions, provide relevant services at all times, and commit to sending more accurate communications to achieve ease of use and customer satisfaction. To the extent that the processing of personal data by the application is part of this, it is processed only in accordance with this Privacy Policy and applicable law and is shared only when necessary to provide a better customer experience.

Taking into account available technology and the cost of implementation, as well as the scope, context, and purpose of the processing, the data processor is required to take all reasonable steps, including technical and organizational measures, to ensure a sufficient level of security in relation to the risk and the category of personal data to be protected. The data processor shall assist the data controller with appropriate technical and organizational measures as needed, taking into account the nature of the processing and the category of information available to the data processor, to ensure compliance with the data controller’s obligations under applicable data protection laws.

The data processor will notify the data controller without undue delay if the data processor becomes aware of a security breach.

Furthermore, the data processor must, to the extent possible and legally permissible, inform the data controller if a data request (data access request) is made by the bodies that mustprovide itThe data processor will respond to such requests once the data controller authorizes it to do so. The data processor will also not disclose information about this Agreement unless the data processor is required to do so by law, such as by court order.

If the data controller requires information or assistance regarding data security, documentation, or information on how the data processor processes personal data in general, they may request this information from the processor.

The data processor, its employees, and any affiliates or partners shall guarantee confidentiality with respect to the personal data processed under this Agreement. This provision shall continue to apply after the termination of this Agreement, regardless of the reason for termination.

3. Responsibilities of the data controller:

By signing this Agreement, the data controller confirms that, when using the application, they may freely process their data in accordance with all legal data protection requirements, including the GDPR. The controller gives their explicit consent to the processing of their personal data at all times while using the service.

The data controller may revoke this consent at any time, but doing so terminates the current Agreement and the data processor will no longer be able to offer the service.

The client has a legal basis to process personal data with the data processor (including sub-processors) through the use of Entre Trámites services.

The data controller is responsible at all times for the accuracy, integrity, content, and reliability of the personal data processed by the data processor. Both have complied with all mandatory requirements regarding notification to or obtaining permission from the relevant public authorities concerning the processing of personal data. Furthermore, both have fulfilled their disclosure obligations to the relevant authorities regarding the processing of personal data in accordance with all applicable data protection legislation.

The data controller must have an accurate list of the categories of personal data it processes, particularly if such processing differs from the categories listed by the data processor in Annex A.

4. Agreement for the transfer of data and the use of subcontractors:

To provide the service to the data controller, the data processor uses subcontractors. These subcontractors may be external providers located both within and outside the EU/EEA. The data processor ensures that all subcontractors comply with the obligations and requirements of this Agreement; specifically, that their level of data protection meets the standard required by relevant data protection laws. If a jurisdiction is outside the EU/EEA and is not on the European Commission’s approved list of satisfactory levels of data protection under the GDPR, then a specific agreement is established between Entre Trámites and that subcontractor to ensure that it will maintain all personal data in accordance with the requirements of applicable EU data protection laws.

This Agreement constitutes the specific and explicit prior consent of the data controller for the use by the data processor of data processor subcontractors, who may sometimes be outside the EU/EEA or territories approved by the European Commission.

In this regard, the client expressly authorizes Entre Trámites, through acceptance of this policy, to make international data transfers to Colombia, the European Union, the United Kingdom, as well as any other country to which it is necessary to make such a transfer because the professional in charge of the service is located there, because it is necessary for the proper development of Entre Trámites’ services, as well as to third-party collaborators in any country in order to carry out the proper development of our procedures in order to execute the existing agreements with the interested parties.

The data controller may revoke this consent at any time, but doing so will terminate the Agreement and the data processor will no longer be able to offer the service.

If a sub-director is established or personal data is stored outside of territories approved by the EU/EEA or the European Commission, the data processor has the responsibility to ensure a satisfactory basis for transferring personal data to a third country on behalf of the data controller, including the use of European Commission standard contracts or specific measures that have been previously approved by the European Commission.

The data controller must be informed before the data processor replaces its subcontractors. The data controller may object to a new subprocessor processing their personal data on behalf of the data processor, but only if the subprocessor does not process the data in accordance with applicable data protection legislation. The data processor may demonstrate compliance by providing the data controller with access to the data protection assessment conducted by the data processor.

If the data controller still objects to the subcontractor’s use, they can terminate their subscription to the service, without the usual required notice period, and then ensure that the unwanted subcontractor does not process their personal data.

5. Data Processing and Use of Artificial Intelligence:

To ensure the proper delivery of our services, including support, query management, and communication translation, the organization uses enterprise-level, corporate-grade technology tools (such as Google Workspace and Gemini Enterprise). These tools process information confidentially and securely, guaranteeing that personal data is never used to train public or third-party artificial intelligence models.

Certain administrative support or user management operations may be carried out by authorized personnel or data processors located outside the European Economic Area (EEA). In such cases, all transfers or remote access to personal data are conducted in strict compliance with Chapter V of Regulation (EU) 2016/679 (GDPR), through the formalization of Standard Contractual Clauses (SCCs) approved by the European Commission and the application of appropriate technical and organizational security measures to guarantee the confidentiality and integrity of the data.

6. Duration of the Agreement:

The Agreement remains valid as long as the data processor processes personal data using the service application’s data processor and unless it is replaced by another signed DPA that communicates its primacy over this Agreement.

7. Termination of the Agreement:

Upon termination of any subscription, when the Agreement ends, the data processor will delete all personal data, except for those that arerequirethat it retains according to the applicable legal requirements and in such case will be kept in accordance with the technical and organizational guarantees.

The data controller has full capability to retrieve all of your personal data from the service application. If the data controller requests assistance with data recovery, the associated costs will be determined by mutual agreement between the parties and will be based on the complexity of the requested process and the time required to complete it in the chosen format.

8. Changes to the Agreement:

Changes to the Agreement must be included in a separate annex to the Agreement. If any provision of the Agreement is deemed invalid, this will not affect the remaining provisions. The parties will replace the invalid provision with a statutory provision that reflects the purpose of the invalid provision.

9. Audits:

The data controller has the right to initiate a review of the data processor’s obligations under the agreement once a year. If the data processor is required to do so under applicable law, the audits may be repeated annually. A detailed audit plan outlining the scope, duration, and start date must be provided at least four weeks prior to the proposed start date. The parties jointly decide whether a third party should conduct the audit. However, the data controller may allow the data processor to have the security review conducted by a neutral third party, at the data processor’s discretion, if the processing environment involves data from multiple data controllers.

If the proposed audit scope follows an ISAE, ISO, or similar certification report issued within the previous twelve months by a qualified third-party auditor, and the data processor confirms that there have been no material changes to the measures under review, this will satisfy any request received within that timeframe. Audits must not unreasonably interfere with the data processor’s normal business activities. The data controller is responsible for all costs associated with their audit review request.

10. Responsibilities and jurisdictions:

Liability for actions arising from a breach of the provisions of this Agreement is governed by the liability and indemnification provisions in the subscription terms in section 13. This also applies to any breach by the data processor’s sub-processors.

This Agreement is governed by the courts of the Kingdom of Spain, which shall have exclusive jurisdiction to determine any dispute relating to it.

Annex A. Categories of personal information and categories of routine processing

1. Categories of personal information (the list is not exhaustive):

Name.

Address.

Telephone number(s).

Email address(es).

Address(es).

Any account number and/or bank details.

1. Common processing categories (the list is not exhaustive):

The data controller’s employees.

Data controller contacts (phone/email/addresses/etc.).

The data controller’s clients.

The data controller’s banking information.

Their clients’ employees.

Customer contacts (phone/email/addresses/etc.).

Your customers’ customers.

Banking information of your clients’ customers.