Elsa Taxes in accordance with the provisions contained in the Data Protection Act and considered as the data controller and/or data processor, adopts this privacy and personal data protection policy regarding the collection, storage, and management of data received from clients, suppliers, collaborators, and generally from any natural person who is the data subject (hereinafter “Data Subject” or “Data Subjects”).

Elsa Taxes respects the privacy of each Data Subject’s data, and generally, of any natural person providing or furnishing their personal information. In this regard, Elsa Taxes receives and stores the information securely and appropriately. However, Data Subjects may consult the accuracy of this information and take measures to update it and/or request its deletion. The information is collected, processed, and used in accordance with applicable legal standards. Thus, **Elsa Taxes** collects and stores personal information related to Data Subjects for consultation, processing, and use, solely if Data Subjects voluntarily provide the information and give their authorization. All voluntarily provided information by Data Subjects is part of “databases” governed by the Law and other regulations that modify, add to, or complement it. The data is collected for the development and execution of the company’s social purpose, ordinary business operations, and compliance with legal provisions, contractual obligations, or business commitments. Before storing or handling personal data, Elsa Taxes complies with the following requirements:

a. The Data Subject must provide explicit authorization for such processing, except in cases where authorization is not required by law.

b. In the event that the Data Subject is physically or legally incapacitated, the legal representatives must grant their authorization.

c. Inform the Data Subject of the reason for using their data and specify the limits of such processing. Databases will remain valid for as long as the purpose or purposes of processing in each database are maintained, or for the period indicated by a legal, contractual, or specific activity cause.

RIGHTS OF THE DATA SUBJECTS

a. To know, update, and rectify their personal data with the Data Controllers or Data Processors. This right may be exercised, among other things, regarding partial, inaccurate, incomplete, fragmented data, data that leads to errors, or data whose processing is expressly prohibited or not authorized under the Law (or, failing that, with regulations that govern, add to, execute, complement, modify, delete, or repeal it).

b. To request proof of the authorization granted to the Data Controller unless it is explicitly exempted as a requirement for processing.

c. To be informed by the Data Controller or Data Processor, upon request, about the use made of their personal data.

d. To revoke authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees.

e. To access their personal data that has been processed free of charge. The Data Subject can consult their personal data free of charge at least once a month and each time there are substantial changes in the data processing guidelines that motivate new inquiries.

f. Data Subjects may access, modify, update, and/or request the deletion or correction of the provided information at any time. To do so, they should make a request via email to elsa@elsataxes.com. Additionally, requests for consultation and complaints filed by Data Subjects will be addressed through the communications department.