Privacy policy
Last updated: 6 November 2026
1. Purpose
This Privacy Policy applies to the processing of personal data carried out by AUDALIA AUDITORES, S.L. through the website www.audaliaauditores.es (hereinafter, the “Website”). It covers data collected through its forms, the virtual assistant, the meeting scheduler and the communications arising from them.
Processing linked to the provision of professional services to clients is governed by the specific information provided in the relevant proposal, engagement letter or contract.
2. Data controller
For the purposes of Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), and Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights (LOPDGDD), the data controller is:
Name: AUDALIA AUDITORES, S.L. (hereinafter, “Audalia”).
Tax ID (NIF): B-78048097.
Address: Paseo de la Castellana, 91, 14th floor, 28046 Madrid (Spain).
DPO contact email: compliance@audaliaauditores.es.
Audalia uses the Baker Tilly brand by virtue of its status as an associated firm of Baker Tilly in Spain and an independent member of the Baker Tilly International network, but it is an independent legal entity. Neither the Baker Tilly companies in Spain nor Baker Tilly International Limited are responsible for the processing described in this Policy, except as indicated in section 7.
3. Data Protection Officer
Audalia has appointed a Data Protection Officer (DPO), whom you can contact at compliance@audaliaauditores.es. The DPO handles enquiries about the processing of your data and channels the exercise of your rights.
4. Source of the data
4.1. Audalia processes the personal data that you provide directly through:
The contact and proposal request form.
The virtual assistant.
The system for booking meetings with an auditor.
Email or telephone communications arising from your enquiry.
4.2. In addition, technical data is collected while browsing the Website through cookies and similar technologies, under the terms of the Cookie Policy.
4.3. If you provide data of third parties, for example other people at your company, you guarantee that you have informed them and that you are entitled to disclose it.
5. Categories of data processed
Depending on the channel used, Audalia processes the following categories of data:
| Channel | Data processed |
|---|---|
| Contact form | Name, professional email, company, telephone, approximate turnover range of the company, service of interest and description of the enquiry. If you have accepted analytics cookies, the origin of the visit, the service pages viewed and the topic of interest inferred from the campaign are also attached. |
| Virtual assistant | Content of the conversation, random identifier of the chat session and any contact details you decide to provide in it. |
| Meeting booking | Name, professional email or telephone, area of interest, chosen date and time, and data necessary to generate the video conference. |
| Browsing | Cookie preference and, if you accept analytics cookies: origin of the visit, pages browsed, time on the website, number of visits, language, device type, operating system, user agent, approximate country and an encrypted fingerprint (hash) of the IP address. Technical providers also receive the IP address when serving their resources (section 7.3). |
Please do not provide, through any of these channels, special categories of data (health, ideology, etc.), data relating to criminal offences or confidential information that is not necessary to handle your enquiry.
6. Purposes and legal bases for processing
6.1. Your data will be processed for the following purposes:
| Purpose | Legal basis |
|---|---|
| To handle your enquiry or proposal request, direct it to the team of the appropriate service line (taking into account, where applicable, the browsing data indicated in section 5) and contact you to reply. | Application of pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR). When the request is made on behalf of a company, legitimate interest in maintaining professional contact (Art. 6.1.f GDPR and Art. 19 LOPDGDD). |
| To manage the virtual assistant: answer your questions, guide you to the appropriate service and, if you request it, forward your enquiry to the professional team. | Pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR). |
| To manage meeting bookings and generate the corresponding video conference. | Pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR). |
| To send you commercial communications about news, publications and event invitations related to Audalia’s professional activity. | Consent, given by means of a specific box that is not pre-ticked (Art. 6.1.a GDPR and Art. 21 LSSI). |
| To carry out the independence and conflict-of-interest analyses and the due diligence required before accepting an engagement, if your enquiry progresses towards a contract. | Compliance with legal obligations (Art. 6.1.c GDPR): Law 22/2015 on Statutory Audit, and Law 10/2010 on the prevention of money laundering. |
| To ensure the security of the Website and the virtual assistant, including the application of usage limits. | Legitimate interest of Audalia (Art. 6.1.f GDPR). |
| To compile internal statistics on use of the Website (origin of the visit, pages browsed, browsing time, device and approximate country). | Consent, given through the cookie notice (Art. 6.1.a GDPR and Art. 22.2 LSSI). You can withdraw it at any time from “Cookie settings”. |
| To manage cookies and similar technologies. | Consent, except in the case of technical cookies (Art. 22.2 LSSI). |
| To establish, exercise or defend legal claims. | Legitimate interest of Audalia (Art. 6.1.f GDPR). |
6.2. Where processing is based on legitimate interest, Audalia has weighed that your rights and freedoms do not prevail. You may request information on that balancing exercise from the DPO and object to the processing at any time.
6.3. Fields marked as mandatory in the forms are necessary to handle your request. If you do not provide them, Audalia will not be able to process it. No data is mandatory by legal or contractual requirement in order to browse the Website.
6.4. The services of the Website are aimed at businesses and professionals of legal age. Audalia does not knowingly process data of children under 14 (Art. 7 LOPDGDD).
7. Recipients of the data
7.1. Authorised Audalia staff who need to be involved in handling your request will have access to your data, subject to a duty of confidentiality and, where applicable, to the professional secrecy provided for in Law 22/2015.
7.2. Your data may be disclosed to public authorities, courts and tribunals, and to the Spanish Accounting and Audit Institute (ICAC) where there is a legal obligation.
7.3. When serving their resources, the following third parties receive your IP address and technical browser data: OpenStreetMap Foundation, for the images of the office map shown in the contact section. This service does not install cookies or access your device, and it loads on the basis of our legitimate interest in showing the office location (Art. 6.1.f GDPR); you can avoid it by blocking external content in your browser. Videos are hosted on Wistia and open as an external link. In these cases, the processing of your data is governed by each provider’s privacy policy.
8. International transfers
Some of the providers indicated in section 7.3 may process data from outside the European Economic Area, in particular from the United States. In that case, transfers are covered by one of these safeguards:
the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, where the provider is certified; or
the standard contractual clauses approved by the European Commission, together with any necessary supplementary measures (Art. 46 GDPR).
You may request information on the safeguards applied, or a copy of them, from the DPO.
9. Retention periods
9.1. Your data will be kept for the following periods:
| Processing | Retention period |
|---|---|
| Enquiries and proposal requests | The time necessary to handle them and, if they do not lead to a contract, 12 months from the last contact. |
| Meeting bookings | Until the meeting takes place and, afterwards, the retention period for enquiries. |
| Commercial communications | As long as you do not withdraw your consent. |
| Data linked to an engagement | The applicable legal periods, including: audit documentation: five years (Art. 30 Law 22/2015); due diligence documentation: ten years (Art. 25 Law 10/2010). |
| Cookies | The periods indicated in the Cookie Policy. |
9.2. Once these periods have expired, the data will be kept blocked for the limitation period of any possible liabilities (Art. 32 LOPDGDD). After that period, it will be deleted.
10. Artificial intelligence and automated decisions
10.1. The Audal-IA assistant is an artificial intelligence system. In accordance with Article 50 of Regulation (EU) 2024/1689, you are informed that, when using it, you are interacting with a machine and not with a person.
10.2. The assistant and the system that routes enquiries to each service line classify your request automatically, based on its content and, where applicable, the attached browsing data (section 5), for the sole purpose of directing it to the appropriate team. This classification does not constitute a decision based solely on automated processing that produces legal effects or significantly affects you within the meaning of Article 22 GDPR. The assessment of your enquiry and any decision on a possible engagement always rest with an Audalia professional.
10.3. Audalia does not use the content of your conversations or forms to train its own or third-party artificial intelligence models.
11. Rights of data subjects
11.1. You may exercise the following rights at any time:
a) Access to your personal data.
b) Rectification of inaccurate data.
c) Erasure of your data.
d) Restriction of processing.
e) Portability of your data.
f) Objection to processing, including processing for direct marketing purposes.
g) Not to be subject to decisions based solely on automated processing.
h) Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
11.2. To exercise them, you may write to compliance@audaliaauditores.es or send a letter to the address indicated in section 2, quoting “Data protection”. Exercising your rights is free of charge. Audalia will reply within one month, extendable in the cases provided for in Article 12.3 GDPR. You will only be asked for additional information to verify your identity where there are reasonable doubts about it.
11.3. To unsubscribe from commercial communications, simply use the link included in each mailing.
11.4. If you consider that your data has not been processed properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
12. Security measures
Audalia applies technical and organisational measures appropriate to the risk to protect your data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access (Art. 32 GDPR). These measures include encryption of communications with the Website, profile-based access control and periodic review of providers.
The measures are reviewed periodically, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.
13. Amendments
Audalia may update this Policy to adapt it to regulatory changes or changes in the operation of the Website. The version in force will always be the one published on this page, indicating the date of its last update. If the changes significantly affect processing based on your consent, you will be informed by appropriate means.
