Privacy policy

Applicable legislation

Through this Privacy Policy, Andvisory 360 Financial Services ASF (hereinafter, we or ANDVISORY) informs you of the personal data we collect through the services it offers, as reflected on this website, of how we process them, and of the rights conferred on you, in relation to your personal data and our processing, by the personal data protection legislation applicable to us.

1. Qualified Law 29/2021 of 28 October on the Protection of Personal Data of the Principality of Andorra (hereinafter, the LQPD), and the regulations implementing it; and

2. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR”).

This website does not use any type of cookie or tracker that collects personal or usage data.

1. Who does this Privacy Policy apply to?

This Policy applies to visitors to this website (our Website), to users of the services that ANDVISORY offers for the purposes described in section 4 of this policy (the Services), and to all persons whose personal data (for example, their images) may appear on our Website or in the context of the Services.

2. Who is the controller of your personal data?

The sole controller responsible for the use of your personal data, as indicated in section 4, is the owner of this Website:

Andvisory 360 Financial Services ASF (ANDVISORY), with NRT L-718170-X and registered office at Carrer Babot Camp, no. 15, 5-2, AD500, Andorra la Vella (Principality of Andorra).

We have a Data Protection Officer, whom you may contact by email at dpdextern@win2win.ad.

ANDVISORY is not responsible for the activities carried out by other websites, even if they are accessed through links on our Website. We therefore strongly recommend that you read carefully the information provided by those other controllers before giving them your personal data (in particular the privacy and cookie policies of each website you visit), and that you contact the relevant controller if you have any concerns or questions.

3. How do we obtain your personal data?

In general, it is you who provide us with your personal data directly (for example, by email). The only exceptions to this rule are:

– Data provided to us by third parties who request our services on your behalf (as a beneficiary);

– Contact details provided to us by our suppliers of services and products when you represent them;

– Photographs of events that we organise or take part in, and in which you may appear;

– Images relating to a news item in which we consider that the public interest and the right to information prevail over the possible interests of the persons whose image or other personal data are published on our Website; and

– Personal data about you that may appear in the emails we receive.

4. What do we use your data for and on what legal basis?

To initiate and maintain the relationship with our suppliers

If you represent a supplier of products or services, we collect your contact details and your signature in order to:

a) Manage our relations of all kinds with the supplier you represent.

b) Manage the corresponding record in our list of authorised suppliers.

c) Manage the quotes and invoices of the supplier you represent.

The processing linked to purposes a) and b) is based on the employment or service contract you have signed with the supplier you represent and on our legitimate interest in contacting that supplier. The processing linked to purpose c) is based on its being necessary for the performance of the contract or contracts you have signed with us.

To initiate and maintain the relationship with our clients

We collect the data we receive orally or in writing directly from you, or from a third party whom you represent or of whom you are a beneficiary, when you engage us for a service or product, in order to manage that contract.

In addition, we inform you that, as a result of this contractual relationship, we may send you, orally or in writing, commercial information related to the products or services you have contracted with us.

The processing of these data is based on its being necessary for the performance of the contract for services or products to which you are a party, and on our legitimate interest in keeping you informed about the products or services acquired.

To comply with our obligations regarding the prevention of money laundering and terrorist financing (AML/CFT)

In compliance with the applicable legislation on the prevention of money laundering and terrorist financing, and with other due diligence obligations that may apply to us, we may collect and process additional personal data, including, where appropriate, financial and asset information, in order to:

a) Identify you and verify your identity, as well as that of your representative, attorneys-in-fact or beneficial owners, where applicable.

b) Determine the risk profile and, where appropriate, obtain and verify information on the source of funds and of wealth.

c) Carry out checks against databases and lists of sanctions, politically exposed persons (PEPs) or similar, where necessary.

d) Monitor the relationship and transactions, detect possible signs of risk and comply with record-keeping and retention obligations.

e) Report to the competent authorities any information that may be required and respond to administrative or judicial requests.

The legal basis for this processing is compliance with the legal obligations applicable to us. Providing the requested information may be mandatory in order to initiate or maintain the contractual relationship; if you do not provide it, we may be unable to provide the service to you or may have to terminate it.

To comply with accounting, tax and invoicing obligations

We process your personal data where necessary to comply with accounting, tax and invoicing obligations arising from the provision of our services, including, by way of example, in order to:

a) Issue invoices and manage collections and payments.

b) Keep the accounts, books and mandatory records.

c) Comply with tax obligations and respond to requests from the tax authorities or other competent authorities.

d) Manage accounting or tax audits that are legally required.

The legal basis for this processing is compliance with the legal obligations that apply to us in accounting and tax matters.

To comply with financial-sector regulatory obligations and audit requirements, and to respond to requests from authorities

As a financial-sector entity, we may process personal data to comply with regulatory and internal control obligations, and to respond to requests from supervisory authorities, including, by way of example, in order to:

a) Keep records of the client relationship, communications and documentation associated with the service, to the extent legally required.

b) Demonstrate the appropriateness or suitability of recommendations or actions, where applicable.

c) Manage conflicts of interest and any transparency obligations that may apply.

d) Carry out internal controls, compliance reviews and audits, and provide information to external auditors where mandatory.

e) Respond to inspections, requests or demands from administrative, judicial or financial supervisory authorities.

The legal basis for this processing is compliance with a legal or regulatory obligation applicable to ANDVISORY.

To send you news and updates about our sector (newsletters)

We collect your email address when you subscribe to our newsletter in order to send you news and updates about our services or our sector.

The legal basis for this processing is your consent, which you may withdraw at any time by exercising your right as indicated later in this policy, or through the link at the foot of each email. The only consequence of withdrawing your consent is that you will stop receiving the information we sent you by email.

To respond to your requests, enquiries or complaints

We collect the personal data you provide to us in your emails, by telephone, through the form on the contact page or through requests to exercise rights, in order to respond to your requests, enquiries or complaints regarding our services or the rights you hold over your personal data.

If you write to us on WhatsApp via the links on this Website, we process the data you choose to share: your telephone number, your name and the content of your messages, for the sole purpose of answering your enquiry and, where appropriate, maintaining the contact you request.

WhatsApp is a service provided by WhatsApp Ireland Limited, part of the Meta Platforms group: messages you send us through this channel pass through its service and are governed by its own terms and its privacy policy. Please do not share identity documents or sensitive financial information over WhatsApp. As regards retention and your rights, data received via WhatsApp is governed by the rest of this policy.

The legal basis for this processing is the consent you give by sending or providing us with these data, our legal obligation to respond to your rights requests, and our legitimate interest in assisting you. Providing your personal data is therefore voluntary, although if you do not provide them we will be unable to process your request, enquiry or complaint. You may revoke your consent whenever you wish; however, such revocation will likewise make it impossible to continue processing your request, enquiry or complaint.

If you write to us on WhatsApp, the legal basis is likewise your consent, which you express by voluntarily starting the conversation and may revoke on the same terms.

To handle possible future claims

We retain the data that may be necessary to handle your possible claims, or ours, on the basis of our legitimate interest in defending ourselves in order to safeguard our rights.

For other purposes that are not incompatible with the above

We may use your personal data for other purposes that are not incompatible with those indicated above (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes), provided that this is permitted by the data protection legislation in force and, of course, acting in accordance with it and with all other applicable legislation.

5. With whom may we share your personal data?

We do not disclose your personal data to anyone, unless:

– You yourself ask us to do so.

– We are legally obliged to do so.

– You contract our products or services through intermediaries (for example, your adviser or representative) to whom we must deliver products or services they have acquired on your behalf, either with the consent you have given them or because you have explicitly engaged us to do so.

– We are joint controllers of the data collection because, always with your consent, other entities process the data on their own behalf.

– We need to protect your rights, ours, those of our employees or those of third parties (which may require disclosure to the police for security reasons or to health authorities to prevent the spread of disease, for example for contact-tracing purposes). For example:

◦ If our video surveillance cameras record a theft at our premises, or

◦ If a third party requests video surveillance images from us on the basis of its legitimate interest in seeking effective judicial protection in respect of the commission of an offence or compensation for loss and damage evidenced by the images disclosed, with that third party undertaking to use them exclusively to report that offence or to claim for the loss and damage suffered, and limiting the disclosure of images to the minimum strictly necessary to achieve the purpose pursued.

– We need our service providers to process them on our behalf, under the terms and conditions of the corresponding data processing agreement.

For example, the messages you send us through the contact form and requests to subscribe to our analysis notes reach us by email through Resend (Plus Five Five, Inc.), and this Website is hosted by Cloudflare (Cloudflare, Inc.). Both companies are based in the United States and act as data processors on our behalf. The resulting international transfers are covered by the standard contractual clauses approved by the European Commission and by the EU-U.S. Data Privacy Framework, to which both companies have adhered.

Any international transfer that we may need to carry out will comply with the regulations in force that apply to us at any given time.

The provisions of this section are without prejudice to what is stated in section 4 regarding the WhatsApp service, should you choose that channel.

6. How long do we keep your personal data?

ANDVISORY retains your personal data only for as long as the processing that requires them lasts and, thereafter, for as long as it takes for the legal liabilities arising from the processing in question and applicable to us at any given time to become time-barred (including the obligation to be able to demonstrate that we have handled your request for the destruction of personal data).

For example, we will keep video surveillance recordings for a maximum of 30 days when they contain no incidents and, if exceptionally a security incident has occurred during that period or there are signs that an offence has been committed (for example, a theft), we will extract a copy of the part of the recording showing the incident, which will be kept until it is handed over to the police or to the person concerned who requests it from us to support their application for judicial protection.

We will destroy your CV when it is more than five years old, as we consider it to be outdated in relation to the purpose for which it is intended.

When we no longer have a legitimate purpose for processing some of your personal data, we will delete or anonymise them and, if this is not possible (for example, because they are held in backup copies), we will store them securely and block them to isolate them from any further processing until they can be deleted.

7. What rights do you have?

You have the right to obtain confirmation as to whether or not we hold any personal data about you.

Below we explain what other rights you have and how to exercise them.

Your rights

You may ask us to give effect to the following rights:

– Access to your personal data.

– Rectification of any of your personal data, specifying the reason.

– Erasure of some or all of your personal data.

– Restriction of the processing of your data, specifying the reason for the restriction.

– Objection to the processing of your personal data.

– Portability of your data where the legal basis for the collection was consent or a contract.

– The right not to be subject to automated individual decisions.

Where and how you can exercise your rights

You may exercise your rights:

1. By sending a written request to ANDVISORY, addressed to our postal address as indicated in section 2 of this policy, stating a means of contacting you so that we can respond to your request or ask you for further information if necessary. We would be grateful if you would mark the envelope “Exercise of Personal Data Protection Rights”.

2. By sending the form for the right you wish to exercise to the email address dpdextern@win2win.ad, stating “Exercise of Personal Data Protection Rights” in the subject line. You will find these forms further on in this same section of the privacy policy.

In both cases, if we are unable to verify that you are who you say you are, we will ask you to send us proof of your identity, so as to ensure that we respond only to the data subject or their legal representative.

However, and in particular if you consider that you have not obtained full satisfaction in the handling of the exercise of your rights, we inform you that you may lodge a complaint with the national supervisory authority of your country or, for this purpose, with the Andorran Data Protection Agency (APDA).

Forms for exercising your rights

To make it easier for you to exercise your rights, we recommend that you use the appropriate request form from the following (available in Catalan):

– Form for exercising the right of access

– Form for exercising the right to rectification

– Form for exercising the right to object (model A and model B)

– Form for exercising the right to erasure

– Form for exercising the right to restriction of processing

– Form for exercising the right to data portability

– Form for exercising the right not to be subject to automated individual decisions

8. What are your responsibilities?

By providing us with your data, you guarantee that they are accurate and complete. You also confirm that you are responsible for the truthfulness of the personal data you have communicated to us and that you will keep them duly updated so that they reflect your actual situation, and you are liable for any false or inaccurate personal data you may provide to us, as well as for any direct or indirect loss or damage that may arise from such inaccuracy.

You may not provide us with personal data of other persons unless this is justified in relation to the services you request from us. In any event, if you provide us with personal data of third parties, you assume responsibility for informing those third parties before providing us with their personal data. The information you must give to the third parties whose data you supply to us must include all the provisions set out in this privacy policy, and you are responsible for the lawfulness of those personal data and for informing the data subjects of the rights they have in relation to their personal data.

Where you have to provide us with personal data of a minor under 16 years of age or of a person whose rights are limited, by doing so you undertake to obtain the authorisation of the holders of their parental authority or guardianship. Without such authorisation, you are prohibited from providing us with any personal data of these persons.

9. How do we protect your personal data?

We are fully committed to protecting your privacy and your personal data. We have drawn up a record of all the personal data processing activities we carry out, we have analysed the risk that each of these activities may pose to you, and we have implemented appropriate legal, technical and organisational safeguards to prevent, as far as possible, the alteration, misuse, loss or theft of, unauthorised access to or unauthorised processing of your personal data. We keep our policies duly updated to ensure that we provide you with all the information we have about the processing of your personal data, and to ensure that our staff receive appropriate guidelines on how they must process your personal data. We have signed data protection clauses and data processing agreements with all our service providers, taking into account the need that each of them has to process personal data.

We restrict access to personal data to those employees who genuinely need to know them in order to carry out any of the processing operations referred to in this policy, and we have trained them and made them aware of the importance of confidentiality and of maintaining the integrity and availability of information, as well as of the disciplinary measures that any breach in this area would entail.

10. Changes to this Privacy Policy

We will update this policy whenever necessary to reflect any changes in legislation or in our processing. If the changes are substantial, we will notify you before they take effect by sending you a notification or by publishing a prominent notice on this website, and you will have the option to exercise your rights as explained in a previous section. In any event, we recommend that you review this privacy policy periodically to find out how we protect your personal data.

If you have any questions about this policy, please do not hesitate to let us know by sending an email to dpdextern@win2win.ad.