ROMERO ARTETA PONCE ABOGADOS (hereinafter “RAP”), considering the rights and fundamental freedoms of individuals in the proper treatment of their personal data, develops this Privacy Policy and Protection of Personal Data (hereinafter “Privacy Policy”) in order to guarantee and inform individuals about the treatment of data collected on our website and the exercise of their rights as holders under the Organic Law for the Protection of Personal Data of Ecuador (hereinafter “LOPDP”).
This Privacy Policy contains all the relevant information about the use of personal data of our customers, potential customers and/or users that are contained in the databases we manage, so it is important to read this policy carefully and in its entirety.
- PERSON RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA
RAP is responsible for the treatment of your personal data, its address is located at Av. 12 de October N26-97 y A. Lincoln, Quito – Ecuador.
- DEFINITIONS
In keeping with the principle of transparency and fairness, the following definitions enhance the understanding of this policy:
- Personal Data: Data that identifies or makes identifiable a natural person, directly or indirectly.
- Sensitive data: Data related to: ethnicity, gender identity, cultural identity, religion, ideology, political affiliation, judicial history, immigration status, sexual orientation, health, biometric data, genetic data and those whose improper treatment may give rise to discrimination, infringe or may infringe fundamental rights and freedoms.
- Data subject: Natural person whose data is processed by RAP. In your relationship with us may be processed personal data of customers, prospective customers and / or users.
- Responsible for processing: RAP decides on the purpose and processing of personal data, therefore it is responsible for the processing.
- Data Protection Officer: Is appointed by RAP and acts under its instructions.
- Data Processor: Any natural or legal person, public authority, agency or other institution that provides its services to RAP in connection with the processing of personal data.
- Processing Activity: Any operation or set of operations performed on personal data, whether by automated, partially automated or non-automated technical procedures, such as: the collection, compilation, obtaining, recording, organization, structuring, conservation, custody, adaptation, modification, elimination, indexing, extraction, consultation, processing, use, possession, exploitation, distribution, assignment, communication or transfer, or any other form of enabling access, matching, interconnection, limitation, suppression, destruction and, in general, any use of personal data.
- INFORMATION FOR OWNERS – PERSONAL DATA PROCESSED
RAP processes personal data collected through the following means:
- Web page: by the use of RAP forms.
- Automatic storage: by the use of cookies when accessing the RAP website.
- Links and hyperlinks: with redirection to websites of commercial partners.
- E-mails: addressed to our web address.
- Telephone calls: to our contact numbers.
The data that may be processed by RAP are the following:
- Data obtained from the Holder: are the data provided by the Holder before any consultation, contractual relationship or interaction with RAP, such as names, surnames, ID and/or passport number, email, address, telephone, country, city, nationality, credit information, main occupation, profession, etc.
- Data not obtained from the Holder: data obtained from the use of the website, as well as through cookies, such as IP addresses, location data, log file data, contact information, user and password for registration and access to the RAP website (if applicable).
- Data obtained from third parties: data obtained by third parties belonging to the public or private sector, public information or public access sources (public registries, official gazettes, telephone directories, credit information systems, etc.).
- Sensitive data: It is the holder’s authority to grant explicit authorization for the processing of sensitive data, such as image, physical appearance, voice, judicial history, biometric data, health-related data, data of minors and/or persons with disabilities.
The user may choose not to provide his/her personal data, consequently it is possible that he/she may not be able to access the services or information that we offer.
RAP will verify compliance with strict security measures, confidentiality and consent for the processing of personal data, necessary only for the provision of the service and provided that there is prior, express and informed authorization of the owner.
The data collected is stored and/or processed in servers located in a data center, either our own or contracted with third parties, located inside or outside the country, which comply with and guarantee all information security measures.
- PURPOSE OF THE TREATMENT
The purpose of the treatment is to provide the highest quality of our services, adapting to the needs required by customers, potential customers and / or users. Processing personal data allows us to be more efficient and provide a high standard of quality services, which characterizes us as a firm.
The legal basis for carrying out the aforementioned purpose is the consent granted through contracts, privacy notices, terms and conditions, informed consents, or others that meet the minimum legal requirements.
The treatment will be carried out for the following purposes in order to provide the services:
- Send to registered e-mails or contact number information about the service.
- To provide the data collected to control and surveillance, police, judicial and/or administrative authorities, by virtue of a legal requirement and/or to use or disclose this information.
- Contact by telephone, e-mail or other means to conduct surveys and/or confirmation of personal data necessary for the execution of a contractual relationship.
- Contacting the cardholder to send statements, account statements or invoices.
- To keep the personal data of the owners up to date.
- Use personal data to exchange information, communications, requests, acceptances and/or any other kind of expressions of will.
- Collect identifying data to meet customer requirements and queries, when the user has contacted through the web.
- Send information, advertising, legal bulletin, trainings, webinars, which may be of interest to the client.
- Contacting the persons who require and authorize it, in order to answer their requests.
- Respond to requests for information, assistance or requests for services.
- Attend to complaints, claims and requests from customers, potential customers and/or users to adequately process the request and satisfactorily address it.
- Notify changes to this Privacy Policy.
- To comply with the legally established obligations, as well as to verify compliance with contractual obligations.
- CONSENT
Consent constitutes a legitimate basis for the processing that will allow RAP to process personal data for each of the purposes described in this Privacy Policy, after obtaining the corresponding authorization from the Data Subject.
RAP declares that it will use appropriate and sufficient mechanisms to obtain the prior, free, specific, informed and unequivocal authorization and consent of the holder, through different forms, website or others. In addition, as responsible for the processing of personal data, RAP will keep proof of the authorization granted by the owners, or failing that, of the legitimate basis for the processing carried out.
The holder shall be entitled to withdraw at any time, without retroactive effect, the consent previously granted to authorize the processing of personal data for a specific purpose.
- INFORMATION RETENTION PERIODS
The data will be processed only and exclusively for the time necessary and for the purposes indicated in this Privacy Policy.
Once the purpose has been fulfilled, RAP will take the necessary measures to proceed with the deletion and/or anonymization of the personal data, so that the owner can no longer be identified with them.
PRINCIPLES
RAP treats personal data in compliance with all the principles determined in the LOPDP, in particular the following:
- Legality: Personal data is treated in compliance with the principles, rights and obligations established in the Constitution of the Republic of Ecuador, international instruments, the Law, its Regulations and other applicable regulations and jurisprudence.
- Fairness: This Privacy Policy sets out clearly what we collect, store and/or use personal data for, as well as the ways and means by which such data is or will be processed for lawful and fair purposes.
- Transparency: We are 100% transparent about the data we collect and/or process, we explain why we use it and for what purposes. This Privacy Policy is permanently available.
- Purpose: We communicate the purposes of the processing to the holder, being established that personal data may not be processed for purposes other than those for which they were collected, unless there is one of the grounds that enable a new treatment according to the assumptions of legitimate treatment under the law.
- Security: We are concerned about ensuring security, secrecy and confidentiality of data and personal information for which we adopt appropriate and necessary security measures to protect personal data against any risk, threat, vulnerability.
- Relevance and minimization of personal data: Personal data will be relevant and limited to what is strictly necessary for the fulfillment of the purpose of the processing.
- Proportionality of the processing: The processing will be adequate, necessary, timely, relevant and not excessive in relation to the purposes.
- Quality and Accuracy: We ensure that the personal data being processed is accurate, complete, precise, complete, verifiable, clear and updated so as not to alter its veracity, providing reasonable measures so that personal data that is inaccurate with respect to the purposes for which it is processed is deleted or rectified without delay.
- Retention: Personal data is retained for no longer than is necessary to fulfill the purpose of the treatment.
- Application in favor of the owner: In case of doubt about the scope of the provisions of the legal or contractual order on the protection of personal data, it will be applied in the sense most favorable to the owner of the personal data.
- RIGHTS
The personal data protection regulations grant the owner rights over his/her data which, as applicable, can be exercised against RAP, for which he/she must present the necessary documents and validations to identify him/her as the owner of the data.
- Right of access. Request the detail of the data we have about the requesting owner and how we treat it.
- Right to rectify and update. Request to rectify and/or update inaccurate or erroneous data, as well as to complete those that are incomplete.
- Right of deletion. Request the deletion or suppression of data and information in certain circumstances. However, there are certain occasions that legally legitimize the continued retention and processing of data such as, for example, to comply with a legal obligation to retain data.
- Right to object. To oppose the processing of data for a specific purpose, in certain circumstances provided for in the regulations and related to the personal situation.
- Right to portability. Ask us to receive personal data in a structured and commonly used format.
- Right of suspension. To restrict or limit the processing of data in certain circumstances.
- Right not to be subject to automated individual decisions. Ask us, in certain circumstances, not to be subject to a decision based solely on automated data processing, including profiling, that produces legal effects on the data subject or similarly significantly affects the data subject.
- EXERCISE OF RIGHTS
RAP makes available to the Holder a form on our website to exercise your rights. It is important to remember that the holder must attach the requested documentation for your security and to verify your identity.
It is important for the holder to bear in mind that, when exercising a right, he/she should clearly specify the right to which he/she refers; furthermore, and especially when he/she considers that he/she has not obtained full satisfaction in the exercise of his/her rights, he/she may write to the RAP at the following address: [email protected].
- ADDRESSEES
In order to carry out the processing purposes described above, we may use authorized subcontractors acting on behalf of RAP, as processors, who are contractually subject to our instructions, only for the lawful purposes described above and for the period of time strictly necessary for this purpose.
In addition, in the event that there is a legal obligation or requirement to do so, we may disclose the data to the competent public authorities in accordance with such legal obligation or requirement.
We may make international transfers to authorized subcontractors/suppliers acting on behalf of RAP, always in accordance with the provisions of Applicable Laws. We will adopt the necessary organizational, technical and contractual measures to ensure the protection and security of your data.
- SECURITY AND CONFIDENTIALITY IN THE TREATMENT OF YOUR INFORMATION
RAP wishes to guarantee the security, secrecy and confidentiality of the data, communications and personal information of the owners. Therefore, in compliance with the Applicable Laws, it has adopted the most appropriate security measures. When RAP receives customer data, it uses procedures and security features to prevent any unauthorized access.
The personal data collected through the different communications with the owners are treated with absolute confidentiality, committing ourselves to keep them secret and guaranteeing the duty to keep them by adopting all necessary and reasonable measures.
In cases of personal data security breaches that pose a risk to the rights of individuals, RAP will take the necessary measures to remedy the situation and mitigate the possible negative effects that such breach may have caused; in addition, it will notify the owners and the Personal Data Protection Authority, when so required by the Applicable Laws.
- CHANGES TO THE DATA PRIVACY POLICY NOTICE
RAP may change this Policy, in which case it will notify the holder by publishing an updated version on the website. The holder will decide whether or not to accept the modifications to the Policy, if not accepted, the personal information of the data holder will not be used in any other way than that which was informed at the time of collection.
For any questions the holder can contact RAP at the following email address [email protected]. The response to any request will be answered within 15 working days from the date of receipt of the corresponding request, in accordance with the provisions of the Organic Law on Personal Data Protection.
- VALIDITY
This Policy is effective as of June 2025, however, the information will be reviewed every year to verify the veracity of the data and the purpose of continuing with its treatment.