Privacy policy

Data controller

The data controller is:

• Identity: Val Muñoz-Sabaté Consultors, SL
• Tax ID (NIF): B66910894
• Address: Av. Diagonal, 449, 4ª, 08036 Barcelona
• Contact: info@intoaction.cat

What data we process and where it comes from

We process identification, contact, professional and business data that you provide through the contact form, the Accounting Management proposal request form on the Fees page, emails sent to info@intoaction.cat and job applications sent to rrhh@intoaction.cat. This includes information needed to handle each request and data you voluntarily provide in messages or applications.

Purposes and legal bases

We process data for the following purposes and on the corresponding legal bases:

• Responding to enquiries and preparing proposals: taking pre-contractual steps at the data subject's request (Art. 6(1)(b) GDPR) and consent (Art. 6(1)(a) GDPR).
• Providing services to clients: performance of the contract (Art. 6(1)(b) GDPR) and compliance with accounting and tax legal obligations (Art. 6(1)(c) GDPR).
• Managing job applications: the applicant's consent (Art. 6(1)(a) GDPR).
• Sending commercial communications about our services: only with express consent (Art. 6(1)(a) GDPR) or, for clients, on the basis of legitimate interests (Art. 6(1)(f) GDPR), in accordance with Art. 21.2 LSSI, for our own services similar to those contracted. A simple, free way to object is provided in every message.

Retention periods

We retain data for the following periods:

• Enquiries and requests that do not result in a contract: up to 1 year from the last contact.
• Clients: throughout the contractual relationship and afterwards for the applicable statutory periods: 6 years under the Spanish Commercial Code and 4 years under tax legislation.
• Job applications: 1 year from receipt.
• Commercial communications: until the person withdraws consent or objects.

Recipients and data processors

We do not disclose data to third parties except where required by law. We use providers acting as data processors: Lovable, for the website platform, hosting and delivery of form notification emails, together with its infrastructure subprocessors; and Microsoft, for corporate email through Microsoft 365.

International transfers

Some of these providers or their subprocessors may process data outside the European Economic Area, for example in the United States. In such cases, transfers are carried out with appropriate safeguards, such as the EU-US Data Privacy Framework, where applicable, or the European Commission's standard contractual clauses.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time, by writing to info@intoaction.cat. Withdrawal of consent does not affect the lawfulness of earlier processing. You also have the right to lodge a complaint with the Spanish Data Protection Agency.

• Spanish Data Protection Agency · www.aepd.es

Data security and accuracy

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration. You must provide accurate, up-to-date data and inform us of any relevant changes.

Last updated

October 2026.