LEGAL TERMS AND PRIVACY POLICY
1. Purpose and Scope
This Privacy Policy governs the processing of personal data carried out through the website ja2e.com (hereinafter, the “Website”), as well as any processing arising from communications, requests for information, professional enquiries and potential pre-contractual relationships established through it.
JA2E Consulting is committed to protecting privacy and to processing personal data lawfully, fairly, transparently, appropriately and securely, in accordance with the legislation applicable having regard to the location of the data subject and the specific processing activity concerned.
This Policy should be read together with the Cookie Policy and, where applicable, the Legal Notice and the contractual terms governing JA2E’s services.
2. Data Controller
The controller responsible for the processing of personal data collected through the Website is:
JA2E Consulting
Contact: José Atué
Email: jatue@ja2e.com
Operational locations indicated on the Website: Dubai · Barcelona
Website: ja2e.com
Requests relating to data protection, privacy or the exercise of rights may be addressed to jatue@ja2e.com.
JA2E has not designated a Data Protection Officer under this Policy as a separate point of contact. Where applicable law requires the appointment of a Data Protection Officer, the relevant contact details will be incorporated into this Policy.
3. Principles Applicable to Processing
JA2E will process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.
In particular, JA2E will seek to:
collect only data that are adequate and relevant for each purpose;
not use data for purposes incompatible with those for which they were collected;
retain data only for as long as necessary;
take reasonable measures to keep data accurate and up to date;
restrict access to those who need the information to perform their duties;
protect data through technical and organisational measures proportionate to the relevant risks; and
periodically review the processing activities and providers used.
4. What Personal Data Do We Process?
4.1. Data Provided Through the Contact Form
The form available on the Website allows users to provide the following categories of data:
Identification data:
name.
Contact data:
email address;
telephone number.
Data relating to the enquiry:
a brief description of the interest, need, project, issue or professional enquiry raised by the user.
Users should avoid including information in the free-text field that is not necessary for the purposes of dealing with their request.
In particular, users are requested not to provide passwords, credentials, unnecessary confidential documentation, full payment card numbers, data relating to third parties without sufficient justification, or special categories of personal data — for example, information concerning health, racial or ethnic origin, religious beliefs, political opinions, trade union membership, genetic or biometric data, or data concerning sex life or sexual orientation — unless this is strictly necessary and there is a sufficient legal basis for its processing.
4.2. Data Arising From Communications
Where the user subsequently communicates with JA2E by email, telephone or other means, the following data may be processed:
content of communications;
identity and contact details of the correspondent;
date and time of communications;
company or organisation represented;
job title or professional role;
needs expressed;
proposals requested;
documentation voluntarily submitted;
background information necessary to manage the enquiry or professional relationship.
4.3. Technical and Website Usage Data
When the Website is used, certain technical data necessary for its provision, security, operation and measurement may be generated, including:
IP address;
browser type;
device type;
operating system;
technical information relating to requests made to the server;
date and time of access;
pages or resources visited;
aggregated information relating to Website performance and use;
technical signals intended to prevent abuse, spam, fraud or malicious activity.
The use of cookies and storage or access technologies is specifically addressed in the Cookie Policy.
5. Source of the Data
As a general rule, personal data are obtained directly from the data subject, principally where the data subject:
completes the Website form;
sends an email;
makes a telephone call;
requests information;
requests an assessment or proposal;
enters into discussions regarding the possible provision of services; or
subsequently maintains a professional relationship with JA2E.
Certain technical data may be generated automatically as a result of using the Website.
Where a person contacts JA2E on behalf of a company, organisation or third party, the professional data necessary to identify their role and properly manage the communication may also be processed.
6. Purposes of Processing
6.1. Responding to Requests for Information and Enquiries
JA2E will process the data provided in order to:
receive and analyse the enquiry;
understand the needs raised;
respond to the data subject;
maintain the necessary communications;
arrange, where appropriate, a meeting or call;
carry out a preliminary assessment of the feasibility of the requested services; and
provide information relating to the specific request made.
6.2. Managing Pre-Contractual Activities
Where the purpose of the enquiry is to obtain information about, request or contract JA2E’s services, the data may be processed in order to:
analyse the requirements of the prospective client;
prepare proposals;
prepare quotations;
define scope, methodology or timetable;
exchange information prior to contracting;
negotiate terms; and
take any other measures necessary at the request of the data subject prior to the possible conclusion of a contract.
6.3. Managing Professional and B2B Relationships
Where the data subject acts as a representative, employee or contact person of a company or organisation, their professional data may be used to manage the relationship between JA2E and that organisation.
Processing will be limited to the data necessary to maintain professional or business relationships and to contact the organisation for which the data subject provides services.
6.4. Website Security
JA2E may process certain technical data in order to:
protect the integrity and availability of the Website;
prevent unlawful access;
identify abusive automated behaviour;
prevent spam;
detect incidents;
investigate security issues;
prevent fraud or misuse; and
retain technical evidence where necessary to protect legitimate rights and interests.
6.5. Website Measurement and Improvement
Statistical and technical data may be processed in order to understand the general operation of the Website, analyse its use, detect errors and improve content, performance and user experience.
The integrated analytics currently provided by Framer are described in greater detail in the Cookie Policy.
6.6. Compliance With Legal Obligations
Data may be used where necessary to:
comply with legal obligations;
respond to requests from administrative or judicial authorities;
comply with tax, accounting or regulatory obligations;
cooperate with legally competent authorities; and
comply with any other legally enforceable obligations.
6.7. Establishment, Exercise or Defence of Legal Claims
JA2E may retain and use certain data where reasonably necessary to prevent, establish, exercise or defend rights, actions or claims, whether judicial or extrajudicial.
7. Legal Bases for Processing
The applicable legal basis will depend on the specific purpose and circumstances of the processing.
7.1. Service Requests and Pre-Contractual Measures
Where a person contacts JA2E requesting an assessment, quotation, proposal or information aimed at a possible contractual relationship, the processing may be based on the need to take pre-contractual measures at the request of the data subject, pursuant to Article 6(1)(b) GDPR where applicable.
7.2. Professional Relationships and B2B Communications
Where the data subject acts on behalf of a legal entity, processing may be based on the legitimate interests of JA2E and the relevant organisation in maintaining and managing professional relationships.
Under Spanish law, the processing of certain professional contact data may specifically be presumed to be based on legitimate interests where the processing is limited to data necessary for professional contact purposes and is intended to maintain relations with the legal entity for which the data subject works.
7.3. Security and Protection of Systems
Processing necessary to preserve security, prevent fraud, combat spam, protect systems and defend JA2E’s rights may be based on the legitimate interest in ensuring the security and lawful use of its services, without prejudice to any concurrent legal obligation.
7.4. Legal Obligations
Where there is a specific statutory obligation, processing will be based on compliance with a legal obligation applicable to the controller.
7.5. Consent
Where a particular purpose requires consent — for example, certain commercial communications or optional processing activities that cannot be based on another legal basis — consent will be requested in a specific, informed and unambiguous manner.
Consent will not be inferred from silence, inactivity or pre-ticked boxes.
The data subject may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
8. Commercial Communications
The mere submission of an enquiry through the form does not, in itself, constitute authorisation to use the user’s personal data for general marketing purposes or to add the user to commercial distribution lists.
Where JA2E wishes to use data to send commercial communications that require consent under applicable law, such consent will be requested separately.
Any commercial communications that may be sent will provide a simple means of exercising the right to object or unsubscribe.
9. Mandatory Nature of the Data
Form fields identified as mandatory must be completed in order for JA2E to properly process the request.
Failure to provide necessary information may prevent JA2E from responding to the enquiry, either in whole or in part.
Any data that are not mandatory will be provided voluntarily by the user.
The telephone number will only be used where it has been provided and where it is reasonably appropriate for managing the enquiry or communication with the data subject.
10. Retention Periods
JA2E will apply retention criteria based on purpose, necessity and applicable legislation.
Enquiries That Do Not Result in a Contractual Relationship
Data relating to enquiries, information requests or potential projects that ultimately do not result in a contractual relationship will generally be retained for a maximum of twelve months from the last substantive interaction with the data subject.
After that period, they will be deleted or anonymised unless there is a legitimate reason to retain them for longer.
Pre-Contractual and Contractual Relationships
Where an enquiry results in a proposal, negotiation or contractual relationship, the necessary data will be retained throughout the negotiation and, in the event of contracting, for the duration of the professional relationship.
Once the relationship has ended, data may be retained in a restricted manner for the periods necessary to comply with legal, tax, accounting or contractual obligations and for the applicable limitation periods relating to potential liabilities.
Requests to Exercise Data Protection Rights
Documentation relating to the exercise of data protection rights may be retained for as long as necessary to demonstrate JA2E’s proper compliance with its legal obligations and to deal with any potential claims.
Technical and Security Data
Technical logs will be retained for as long as reasonably necessary to ensure the operation and security of the Website, investigate incidents and comply with applicable obligations, subject to data minimisation and periodic deletion criteria.
11. Recipients of the Data
JA2E will not disclose personal data to third parties unless this is necessary for the purposes described, required by law or supported by another valid legal basis.
The following categories of recipients may have access to certain data:
Technology Providers and Processors
JA2E may use providers that supply services relating to:
hosting and technological infrastructure;
Website development and operation;
form management;
email and communications;
storage;
security;
IT support; and
auxiliary services necessary for the conduct of its activities.
These providers will only access the data necessary to provide their services and will, where applicable, be subject to the relevant contractual data protection obligations.
Framer B.V.
The Website has been developed and is hosted using the Framer platform.
In relation to personal data provided by users to JA2E through a website created on its platform, Framer contractually establishes that the Framer customer acts as the data controller and Framer as the data processor, processing the data on behalf of and in accordance with the customer’s instructions.
Professional Advisers
Data may be disclosed to lawyers, tax advisers, auditors, consultants or other professionals where necessary to comply with obligations or defend rights.
Public Authorities
Data may be disclosed to public administrations, courts, law enforcement bodies or other authorities where required by law or pursuant to a valid request.
12. International Transfers of Personal Data
Given the international nature of JA2E’s services, providers and activities, certain personal data may be processed or accessed from jurisdictions other than the jurisdiction in which the data subject is located.
The Website identifies JA2E operationally with Dubai and Barcelona.
Where access to, disclosure or use of personal data constitutes an international transfer subject to Chapter V GDPR, JA2E will implement one of the transfer mechanisms recognised under applicable law.
Such mechanisms may include:
adequacy decisions adopted by the European Commission;
Standard Contractual Clauses approved by the European Commission;
additional contractual safeguards;
legally recognised mechanisms for transfers to the United States;
Binding Corporate Rules where applicable; or
other exemptions or safeguards recognised under applicable law.
The European Commission recognises that transfers outside the EEA require specific safeguards where the destination country has not been declared adequate.
Framer provides in its current Data Processing Addendum that transfers outside the EEA made in its capacity as processor are carried out using valid mechanisms under Chapter V GDPR, including adequacy decisions and, where no adequacy decision exists, the European Commission’s Standard Contractual Clauses, with additional mechanisms for the United Kingdom and Switzerland.
Data subjects may request further information regarding the applicable safeguards by writing to jatue@ja2e.com.
13. Data Security
JA2E will implement reasonable technical and organisational measures proportionate to the nature of the data, the purposes of the processing and the foreseeable risks.
Such measures will be aimed, where appropriate, at preserving:
confidentiality;
integrity;
availability;
system resilience;
access control;
protection against loss or destruction;
prevention of unauthorised access; and
incident response capability.
Providers acting as processors must provide sufficient guarantees regarding security and data protection.
However, no system connected to the Internet can guarantee absolute security against every possible threat.
14. Rights of Data Subjects — European Economic Area
Where the GDPR applies, the data subject may exercise, subject to the conditions established by law, the following rights:
Access: to know whether JA2E processes their data and to obtain information and a copy of such data.
Rectification: to request the correction of inaccurate or incomplete data.
Erasure: to request deletion of their data where one of the circumstances established by law applies.
Restriction of processing: to request that processing be restricted in certain circumstances.
Objection: to object to processing based on legitimate interests having regard to their particular situation.
Data portability: to receive certain data in a structured, commonly used and machine-readable format and, where technically feasible, to request their transmission to another controller.
Withdrawal of consent: to withdraw at any time the consent provided for processing activities based on consent.
Not to be subject to certain solely automated decisions: where the conditions established by applicable law are met.
The Spanish Data Protection Agency expressly recognises the rights of access, rectification, objection, erasure, restriction, portability and protection against certain individual automated decisions.
Requests may be submitted to:
jatue@ja2e.com
JA2E may request additional information only where reasonably necessary to verify the identity of the applicant.
15. Right to Object
Where processing is based on legitimate interests, the data subject will have the right to object on grounds relating to their particular situation.
JA2E will cease processing the data unless it can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
Where data are used for direct marketing purposes, the data subject may object to such processing at any time.
16. Complaints to Supervisory Authorities
Without prejudice to any other administrative or judicial remedy, data subjects subject to the GDPR have the right to lodge a complaint with the competent data protection supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement.
Where the competent authority is in Spain, a complaint may be lodged with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD).
The right to lodge a complaint with a supervisory authority forms part of the information that must be provided to data subjects under the European data protection framework.
17. Users in the United Kingdom
Where the UK GDPR and United Kingdom data protection legislation apply, data subjects will have the rights granted under that regime, including, where applicable, rights of access, rectification, erasure, restriction, objection and portability.
United Kingdom law requires individuals to be informed, among other matters, of the purposes of processing, retention periods, recipients and their rights.
Data subjects may lodge a complaint with the Information Commissioner’s Office (ICO) where it has jurisdiction.
Transfers of data subject to United Kingdom law will be protected through the transfer mechanisms recognised under that legal framework.
18. Users in Switzerland
Where the Swiss Federal Act on Data Protection (FADP) applies, JA2E will provide the information required under such legislation and recognise the rights available to the data subject.
Swiss law requires transparency regarding the identity and contact details of the controller, the purposes of processing and, where applicable, recipients and international transfers.
Data subjects may exercise the rights recognised under Swiss law and may, where appropriate, contact the Federal Data Protection and Information Commissioner (FDPIC).
19. Users in the United Arab Emirates
Where the federal personal data protection legislation of the United Arab Emirates applies, processing will be carried out in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, without prejudice to any special regime that may apply by reason of the location or nature of the activity.
UAE federal law recognises, among others, rights relating to obtaining information about processing, correcting or deleting data and certain powers to restrict or stop processing.
Where such regime applies, JA2E will handle data subject requests in accordance with the conditions and exceptions provided for by law.
20. Residents of California and Other United States Jurisdictions
Where JA2E is subject to United States state privacy legislation applicable to the data subject, the data subject may exercise the rights provided under that legislation.
In the case of the California Consumer Privacy Act (CCPA), where applicable, such rights may include the right to know the categories and specific pieces of personal information processed, request access, correction or deletion, and exercise any applicable opt-out rights. California law also requires covered businesses to provide information about how they collect, use and retain personal information.
JA2E does not sell personal data obtained through the contact form and does not currently use such data to share it with third parties for cross-context behavioural advertising purposes.
Where an applicable state law recognises additional rights, JA2E will honour such rights in accordance with the relevant requirements and scope of application.
21. Users in Canada
Where Canadian private-sector privacy legislation applies, including PIPEDA or the relevant provincial legislation, JA2E will respect the applicable principles and rights.
Among other matters, PIPEDA establishes principles relating to accountability, identification of purposes, consent where applicable, limiting collection, limiting use and retention, safeguards, openness and individual access.
22. Other Jurisdictions
This Policy is intended to provide a transparency framework suitable for an internationally oriented activity.
However, privacy laws are not identical in every country.
Where applicable law grants the data subject additional rights or imposes more specific obligations than those set out in this Policy, JA2E will apply such provisions to the extent legally required.
References to specific jurisdictions do not necessarily mean that JA2E is in every case subject to all of the laws mentioned. Their application will depend on factors such as the controller’s establishment, the data subject’s residence, the activities carried out, the targeting of services and the legal thresholds established under each regulatory framework.
23. Automated Decision-Making and Profiling
Data submitted through the contact form are not used to make decisions that produce legal effects or similarly significantly affect the data subject based solely on automated processing.
JA2E also does not currently use information provided through the form to carry out profiling aimed at automatically determining whether a prospective client is accepted or rejected.
If systems of this nature subject to specific transparency or safeguard obligations are implemented in the future, this Policy will be updated before such systems are used.
24. Minors
JA2E’s services are professional and business-oriented in nature and are not specifically directed at minors.
JA2E does not intend to deliberately collect data from minors through the form.
If JA2E becomes aware that it has received data from a minor without sufficient legal basis, it will take reasonable steps to delete the data or otherwise regularise the processing where appropriate.
25. Third-Party Data Provided by the User
Where a user provides personal data relating to another person, the user represents that they have a legitimate basis for doing so and that the information disclosed is relevant to the intended purpose.
Users should refrain from providing third-party data where this is not necessary.
Where required by law, the relevant third party must be provided with appropriate information regarding the processing of their data.
26. Accuracy of Information
Users are responsible for ensuring that the data they provide are correct, accurate and sufficiently up to date.
Where information relevant to the management of an enquiry or professional relationship changes, the user may notify JA2E of the relevant update.
27. Third-Party Links and Services
The Website may contain links to websites or services belonging to third parties.
This Policy applies exclusively to processing carried out under JA2E’s responsibility.
Where the user leaves ja2e.com and accesses an external website, the user should consult the relevant third party’s privacy policy, as that third party will determine its own purposes and means of processing.
28. Relationship With the Cookie Policy
The use of cookies and other storage or access technologies on the user’s device is specifically governed by the JA2E Cookie Policy.
Certain technologies may not use cookies but may nevertheless involve the processing of personal data. For this reason, the Cookie Policy and this Privacy Policy have complementary purposes and should be read together.
29. Amendments to the Privacy Policy
JA2E may amend this Policy where necessary to reflect:
changes to its processing activities;
the introduction of new services;
changes to providers;
the use of new technologies;
changes to its operational structures;
legislative or regulatory changes;
guidance or criteria issued by data protection authorities; or
material changes to processing purposes or legal bases.
Where an amendment is substantial and applicable law so requires, data subjects will be informed through reasonable means before the new processing activity takes effect.
The version in force at any given time will be the version published on the Website.
30. Contact
For enquiries relating to this Policy, requests for information regarding the processing of personal data or the exercise of rights, you may contact:
JA2E Consulting
Contact: José Atué
Email: jatue@ja2e.com
Website: ja2e.com
Dubai · Barcelona
JA2E will respond to privacy requests within the time limits and in accordance with the requirements established under the applicable legislation.