1. Data controller

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), we inform you that the controller of your personal data is:

• Company name: Blue Mountain Asesores, S.L.U.
• Tax ID (NIF/CIF): B42985432
• Registered office: Calle Maestro Alonso, 4, entreplanta, 30005 Murcia, Spain
• Correspondence address: Avda. Marqués de los Vélez 13, entresuelo, 30008 Murcia, Spain
• Telephone: +34 910 917 811 (Madrid) · +34 868 300 587 (Murcia) · +34 928 402 802 (Las Palmas)
• Data protection email: bbotia@bm.consulting
• Website: bm.consulting

2. Privacy contact

For any question about how we process your personal data, or to exercise your rights, contact our privacy contact:

• Email: bbotia@bm.consulting
• Postal address: Blue Mountain Asesores, S.L.U., Privacy contact, Avda. Marqués de los Vélez 13, entresuelo, 30008 Murcia, Spain

We document every personal data breach. Where it is likely to result in a risk to people, we notify the Spanish Data Protection Agency (AEPD) without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk is high, we also inform the people affected. Privacy contact: bbotia@bm.consulting.

3. Data we collect

Depending on the nature of your relationship with BMC, we may process the following categories of personal data:

• Identification data: first name and surname(s), national identity document (DNI/NIE/NIF), passport number or other identity document, date of birth, signature.
• Contact data: email address, telephone number, postal address.
• Economic and financial data: tax information (tax identification number, tax returns), accounting data, banking and payment information. These data are processed exclusively when BMC provides tax, accounting, employment or financial legal advisory services.
• Professional data: company name, company tax ID (NIF/CIF), position or role, economic activity (NACE code), representation data.
• Anti-money laundering (AML) data: due diligence documentation required under Law 10/2010 of 28 April on the prevention of money laundering and financing of terrorism.
• Browsing data: IP address, browser type and device, operating system, pages visited, session duration, cookie data (in accordance with our Cookie Policy).

If you ask us to contact you from a calculator, we keep the figures you entered and the result together with your request, so that the specialist does not have to ask you for them again. They are kept for as long as your request.

As a general rule, we do not process special categories of data (health data, racial or ethnic origin, religious beliefs, etc.). However, in the course of providing payroll management and employment advisory services as data processors (Article 28 GDPR), we may access employees' health data (sick leave, medical certificates), trade union membership, or disability status on behalf of our clients. Such processing is carried out exclusively on the controller's (client's) behalf and is based on compliance with legal obligations in the field of employment and social security law (Article 9(2)(b) GDPR and Article 9 LOPDGDD).

4. Purposes of processing

Your personal data will be processed for the following purposes, subject to the legal bases and retention periods indicated:

Grants and subsidies for client companies. If your company is a BMC client, we may use its activity, size, location and legal form, and the professional details of its contact person, to identify public grants and subsidies that may be of interest to you and to offer them to you. The legal basis is our legitimate interest in informing our clients of opportunities related to the services they have contracted. You can object at any time by writing to the privacy contact or from any of those communications.

5. Legal basis for processing

The processing of your personal data is based on the following legal grounds under Article 6 of the GDPR:

• Consent (Art. 6.1.a GDPR): Freely given, specific, informed and unambiguous consent for purposes such as sending commercial communications, subscribing to the newsletter, website analytics and recording where your request came from. You may withdraw your consent at any time without retroactive effect.
• Contract performance (Art. 6.1.b GDPR): Processing is necessary for the performance of services contracted with BMC or for the application of pre-contractual measures at your request.
• Legal obligation (Art. 6.1.c GDPR): Processing is necessary to comply with obligations imposed by tax law (LGT), commercial law (Commercial Code), employment law (ET, LGSS), anti-money laundering law (Law 10/2010) and other applicable regulations.
• Legitimate interest (Art. 6.1.f GDPR): For sending commercial communications to existing clients regarding similar services (pursuant to Art. 21.2 LSSI), provided that such interests are not overridden by the interests or fundamental rights of the data subject.

6. Recipients and processors

We do not sell or share your data. We only disclose it when the law requires it (for example, to the Tax Agency, Social Security, courts or registries) or to the providers that perform a service on our behalf (processors, art. 28 GDPR), under contract and only for that service:

• Hetzner Online GmbH: servers hosting the platform, its database, documents and call recordings. Germany and Finland.
• Cloudflare: backups, encrypted before they leave our servers (Cloudflare only receives encrypted data) and stored in the European Union; domain name resolution; and anti-bot protection for the website forms (Turnstile), which processes the IP address and browser data. See section 7.
• Amazon Web Services EMEA SARL: sending the emails of the website and the platform, from Ireland. See section 7.
• Google Ireland Limited: the team's email, calendar and documents (Google Workspace), sign-in with Google and, only if you accept it in the cookie notice, website analytics (Google Analytics). See section 7.
• OpenAI Ireland Ltd: speech transcription and replies of the telephone assistant. See section 7.
• Cartesia AI, Inc.: synthetic voice of the telephone assistant. See section 7.
• Duocom Internet, S.L. (Telefácil): telephony and SMS. Spain.
• Stripe Payments Europe, Ltd.: card and other payments. Ireland. See section 7.
• Holded Technologies, S.L.: invoicing and accounting. Spain.
• Zoho Corporation B.V.: request handling (Zoho Desk) and client management (Zoho CRM), in the European Union.
• GitHub, Inc.: repositories where the team keeps the working documents of each matter. See section 7.
• Anthropic: artificial intelligence models the team uses to draft documents, analyse matters and build our tools. We are formalising the processing agreement with this provider, with the standard contractual clauses. See section 7.
• External professionals (lawyers, court representatives, notaries, auditors and experts), when the engagement requires it and under a duty of confidentiality.

The banks we work with (Qonto) receive payment data as independent controllers, not as processors.

7. International data transfers

Some providers are US companies or have their parent company there, and your data may be processed in that country. These transfers are covered by the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), included in each provider's processing agreement:

• OpenAI and Cartesia (telephone assistant) and GitHub (working repositories): United States.
• Anthropic (the team's artificial intelligence models): United States. We are formalising the processing agreement and the standard contractual clauses with this provider; until then, this transfer is not covered by them.
• Cloudflare (anti-bot protection), Amazon Web Services (email sending), Google (Workspace and analytics) and Stripe (payments): we contract with their European subsidiary, but data may also be processed in the United States.

The backups kept by Cloudflare are stored in the European Union and encrypted: there is no transfer. You may request a copy of the safeguards by writing to bbotia@bm.consulting.

8. Data retention periods

Personal data will be retained for the time necessary for the purposes for which it was collected and, in any case, for the minimum periods required by law. Once those periods have elapsed, data will be erased or irreversibly anonymised.

During the retention period, data will be properly blocked with restricted access and used only for compliance with legal obligations or to address potential claims.

Backups. So that the service can be restored after a failure or incident, the platform makes an encrypted backup of its data every day. Each backup is kept for no more than six years and is then destroyed. Backups are not accessed or used for any other purpose. If your data is erased, it may remain inside backups made before the erasure until those backups expire; if a backup ever has to be restored, the erasure is applied again before it is used.

9. Data subject rights

In accordance with Articles 15 to 22 of the GDPR and Articles 12 to 18 of the LOPDGDD, you have the right to:

• Access (Art. 15 GDPR): Know whether we process your personal data and obtain a copy thereof, as well as information about the purposes, categories of data, recipients and retention periods.
• Rectification (Art. 16 GDPR): Request the correction of inaccurate data or the completion of incomplete data.
• Erasure ("right to be forgotten", Art. 17 GDPR): Request the deletion of your data when, among other circumstances, it is no longer necessary for the purposes for which it was collected or you have withdrawn your consent.
• Restriction of processing (Art. 18 GDPR): Request the suspension of processing in certain circumstances (e.g., while the accuracy of contested data is being verified).
• Data portability (Art. 20 GDPR): Receive your data in a structured, commonly used and machine-readable format, and request its direct transmission to another controller, where processing is based on consent or on the performance of a contract.
• Objection (Art. 21 GDPR): Object to the processing of your data at any time on grounds relating to your particular situation, where processing is based on the legitimate interests of the controller.
• Not to be subject to automated decisions (Art. 22 GDPR): Not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.
• Withdrawal of consent: Withdraw at any time any consent previously given, without affecting the lawfulness of processing carried out prior to such withdrawal.

How to exercise your rights: You may exercise any of these rights by sending an email to bbotia@bm.consulting or by written request to BMC's registered address, enclosing in either case a copy of your national identity document, NIE, passport or other valid identity document proving your identity.

Response period: We will respond within a maximum of one month from receipt of your request. This period may be extended by a further two months where necessary, having regard to the complexity and number of requests, in which case we will inform you within the first month of the extension and the reasons for it (Art. 12.3 GDPR).

10. Security measures

In accordance with Article 32 of the GDPR, BMC has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of communications: All communications between users and the website are encrypted using TLS/SSL protocols (HTTPS).
• Role-based access control: Access to personal data is restricted to staff who need it for the performance of their duties, through authentication systems and permission management.
• Encryption of data at rest: Data stored on our platform is encrypted to prevent unauthorised access.
• Regular backups: Regular backups of data are performed to ensure availability and integrity in the event of incidents (see section 8).
• Staff training: BMC staff receive regular training on data protection and information security.
• Periodic security assessments: Security reviews and audits are conducted regularly to identify and remediate vulnerabilities.
• Incident response plan: We maintain documented procedures for the detection, management, notification and resolution of security incidents affecting personal data.

11. Security breach notification

In the event of a personal data breach, BMC will act as follows, in accordance with Articles 33 and 34 of the GDPR:

• Notification to the AEPD (Art. 33 GDPR): Within 72 hours of becoming aware of a breach, we will notify the Spanish Data Protection Agency (AEPD), unless it is unlikely that the breach will result in a risk to the rights and freedoms of natural persons.
• Communication to data subjects (Art. 34 GDPR): Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, we will communicate this to you without undue delay, with clear information about the nature of the breach, its likely consequences and the measures taken or proposed to address it.

If you become aware of or suspect any security incident involving your data, please notify us immediately at bbotia@bm.consulting.

12. Processing of minors' data

In accordance with Article 7 of the LOPDGDD, the processing of personal data of minors under 14 years of age requires the consent of their parents or legal guardians.

BMC's services are directed exclusively to adults and to companies and professionals. We do not knowingly collect personal data from children under 14 years of age. If we become aware that we have collected data from a minor without the required parental consent, we will delete it immediately. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at bbotia@bm.consulting.

13. Use of Artificial Intelligence and automated decisions

In compliance with Regulation (EU) 2024/1689 (AI Act) and Article 22 GDPR, BMC discloses that it uses AI systems as operational support in some internal processes:

• AI phone receptionist: calls to our switchboards may be initially answered by an AI assistant, which identifies itself as such at the start of the conversation (Art. 50.1 AI Act). You may request transfer to a human operator at any time.
• Lead classification: when you contact us via form or email, an AI system may classify your enquiry by area (tax, legal, labour…) and assign response priority. The decision on your matter is always taken by a qualified human professional.
• Drafting assistance: the team may use AI for initial drafts. All communications sent are reviewed and validated by a human professional before delivery.

BMC does not make automated individual decisions (Art. 22.1 GDPR) producing legal effects on data subjects nor engage in profiling significantly affecting them. All professional assessment, advice, fee proposal, tax filing, legal submission or contractual document is produced with qualified human intervention under the supervision of a registered professional.

Full inventory, purposes, data processed and your right to human intervention at /en/dpo/ai-usage/. To exercise rights or request detailed information about any AI system: /en/dpo/exercise-rights/ or bbotia@bm.consulting.

14. Right to lodge a complaint with the AEPD

Without prejudice to any other administrative or judicial remedy, if you consider that the processing of your personal data infringes the GDPR or the LOPDGDD, you have the right to lodge a complaint with the competent supervisory authority. In Spain, that authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD):

• Address: C/ Jorge Juan 6, 28001 Madrid, Spain
• Telephone: +34 91 266 35 17
• Website: www.aepd.es
• Electronic office: sedeagpd.gob.es

Before lodging a complaint with the AEPD, we invite you to write to our privacy contact at bbotia@bm.consulting, where we will endeavour to resolve your query or complaint as promptly as possible.

15. Amendments to this privacy policy

BMC reserves the right to amend this privacy policy to reflect legislative, case law or professional practice changes. Amendments will be notified to users by publication on this website with indication of the update date. We recommend that you review this page periodically.

Last updated: 13 November 2026.