Privacy Policy

This is Ambar’s general Privacy Policy. It explains how Ambar processes personal data in connection with its public website and digital channels, Ambar Hauss and its professional community, client and supplier relationships, professional opportunities, events, communications, recruitment and related services. Certain sections apply only to specific categories of individuals and are clearly identified as such.

1. Who is responsible for processing your personal data?

The controller responsible for the processing described in this Privacy Policy is:

Controller	AMBAR PARTNERS TECH SERVICES, S.L.
Tax ID	B88306147
Registered office	Guzmán el Bueno 133, Edificio Britannia, 28003 Madrid, Spain
Telephone	+34 697 628 122
Privacy contact	lopd@ambarpartners.com

References to “Ambar”, “we”, “us” or “our” mean AMBAR PARTNERS TECH SERVICES, S.L. References to “you” mean the individual whose personal data we process.

2. Scope of this Privacy Policy

This is Ambar’s general Privacy Policy. It applies to personal data processed by Ambar in connection with:

• the websites and digital properties operated by Ambar;
• Ambar Hauss, including its web and mobile interfaces;
• the Ambar professional community and its Member, Partner and Eminent Membership Tiers;
• relationships with prospective and existing clients, Users, lawyers, collaborators, suppliers and business contacts;
• professional opportunities and legal-service projects facilitated or coordinated by Ambar;
• events, publications, newsletters, surveys and other communications;
• recruitment and professional-selection processes; and
• support, security, compliance and administration activities.

This Privacy Policy applies to website visitors, prospective and existing clients, Ambar Hauss membership applicants and Users, lawyers and other professional collaborators, suppliers, candidates, event participants and speakers, newsletter subscribers, professional contacts and other individuals whose personal data Ambar processes. Certain sections apply only to particular categories of individuals; where this is the case, the relevant section identifies the persons to whom it applies.

Website visitors and other individuals are not required to “accept” this Privacy Policy merely by browsing the website. This Privacy Policy provides the information required under applicable data-protection law. Where consent is required for a specific activity—such as non-essential cookies, certain marketing communications or particular uses of photographs or recordings—Ambar will request that consent separately at the relevant collection point.

Users and membership applicants who complete the Ambar Hauss admission or membership process may be required to accept the Ambar Hauss Terms and Conditions and the contractual provisions expressly identified in this Privacy Policy as applying to them, including the international data-transfer terms where relevant.

Where a specific form, service, tool, event or project includes a shorter first-layer notice or a separate privacy notice, that notice supplements this Privacy Policy and will prevail only in relation to the specific processing it describes.

3. Key terminology used for Ambar Hauss

For consistency with the Ambar Hauss Terms and Conditions of Use:

• “User” means an independent lawyer or other legal professional admitted to the Ambar professional community and authorised to access Ambar Hauss.
• “Membership Tier” means one of the Member, Partner or Eminent membership levels.
• “Platform” or “Ambar Hauss” means the web and mobile platform operated by Ambar.
• “User Content” means information, profile data, posts, comments, messages, documents or other materials made available by a User through the Platform.
• “Third-Party Service” means a product, software tool, application, benefit or service supplied by a third party and made available or accessible through Ambar Hauss.

The designation “Partner” identifies a commercial Membership Tier only. It does not mean that the individual is a shareholder, corporate partner, employee or agent of Ambar.

4. What personal data do we process?

Depending on your relationship with Ambar and the services you use, we may process the following categories of personal data:

• Identification and contact data: name, surname, professional email address, telephone number, postal address, identity documents and signature.
• Professional data: bar admission, practising status, jurisdictions, areas of practice, qualifications, languages, career history, seniority, experience, availability, professional interests and references.
• Membership and account data: Membership Tier, account identifier, authentication information, preferences, subscriptions, benefits, activity and account status.
• Profile and community data: biography, photograph, professional profile, practice-group participation, event attendance, posts, comments, messages and other User Content.
• Client and matter data: organisation, role, instructions, matter or project information, conflicts information, engagement status and communications. Users must not provide privileged or client-confidential information unless authorised and necessary for the relevant purpose.
• Commercial and financial data: proposals, contracts, billing information, bank details, payment status, transaction records and tax data.
• Compliance data: identity-verification information, sanctions and screening results, conflict checks, anti-money-laundering information and records required by law or client policies.
• Technical and usage data: IP address, device and browser information, logs, authentication events, cookie identifiers, Platform activity, security events and interaction data.
• Communications and support data: emails, enquiries, complaints, feedback, support requests and related records.
• Event and media data: registration details, attendance, photographs, video, audio, interviews and speaker materials.
• Recruitment data: CV, application information, employment history, qualifications, interview notes, references and data made available through professional recruitment platforms.
• Marketing and preference data: subscriptions, consent records, interests, campaign interaction and opt-out preferences.
• Any other data that you voluntarily provide or that is reasonably necessary for a clearly identified purpose.

We do not intentionally request special-category data unless it is necessary, proportionate and supported by an appropriate legal basis. Please do not include unnecessary sensitive personal data in free-text fields, community posts, support requests or documents uploaded to the Platform.

5. Why do we process personal data, and on what legal basis?

The following table summarises our principal processing activities. The precise basis may depend on the circumstances and your relationship with Ambar.

6. Ambar Hauss profiles, community activity and professional opportunities

Users control much of the professional information displayed in their profile. Depending on the Platform configuration and Membership Tier, profile information may be visible to other Users, authorised Ambar personnel, selected clients or prospective clients, and providers supporting the Platform.

When Ambar considers a User for a professional opportunity, authorised Ambar personnel may search and assess professional profile information, experience, jurisdiction, language capability, seniority, availability, prior project experience and other relevant professional criteria. These activities are carried out through professional search tools, structured data and human assessment. Ambar does not use artificial intelligence to select, rank, score or exclude Users for professional opportunities.

Membership in Ambar Hauss does not guarantee professional opportunities. Decisions concerning admission to the community, Membership Tier, presentation to a client or participation in a professional opportunity are made by appropriately authorised individuals on the basis of professional criteria, client requirements and human assessment.

7. Artificial intelligence and technology tools

Ambar Hauss may provide access to artificial-intelligence-enabled tools operated by Ambar or third parties for legal research, drafting, knowledge management, productivity or other professional purposes. Ambar may also use technology to support the organisation, search and presentation of professional information within Ambar Hauss.

• the processing will be limited to the relevant purpose and governed by this Privacy Policy, a specific notice or the provider’s own terms, as applicable;
• Users must not submit privileged, confidential, special-category or client-restricted information unless they are authorised to do so and the tool has been approved for that use;
• Ambar will not use User Content to train a general-purpose model for unrelated purposes unless this is expressly disclosed and supported by an appropriate legal basis;
• outputs may be inaccurate and remain subject to professional human review; and
• where a third-party AI provider processes data for its own purposes, that provider may act as a separate controller and its privacy information will apply.

Ambar does not use artificial intelligence systems to select, rank, score or exclude Users for admission to the Ambar community, allocation to a Membership Tier or access to professional opportunities.

Ambar does not use artificial intelligence to make decisions producing legal or similarly significant effects concerning Users. Ambar does not knowingly use AI systems for prohibited practices under applicable law, including social scoring, manipulative or deceptive techniques prohibited by law, or the inference of sensitive personal characteristics for decision-making concerning Users.

Where Ambar materially changes these practices or introduces an AI system that has a significant effect on Users, Ambar will assess the applicable legal requirements and provide appropriate information before or at the time the relevant processing begins.

8. Who receives your personal data?

We may disclose personal data, where necessary and proportionate, to:

• Ambar personnel and authorised contractors who need access for their functions;
• clients and prospective clients evaluating or working with a User on a professional opportunity or project;
• Users and other participants in Ambar Hauss where information is shared through profiles, groups, events, messages or User Content;
• lawyers, professional advisers and other collaborators involved in delivering a service or project;
• technology, hosting, communications, payment, authentication, analytics, customer-support, events, recruitment, compliance and security providers acting under appropriate contractual terms;
• financial institutions, payment providers, insurers, auditors and professional advisers;
• courts, regulators, law-enforcement bodies, tax authorities and other public administrations where required by law or necessary to protect rights;
• a purchaser, investor, financing party or successor in connection with a corporate transaction, subject to appropriate confidentiality and data-protection safeguards; and
• any other recipient where you request or authorise the disclosure.

Service providers acting as processors may use personal data only on Ambar’s documented instructions, for the agreed purposes and subject to confidentiality, security and data-protection obligations. Some third-party services available through Ambar Hauss may act as independent controllers; their own privacy policies will then apply.

9. International data transfers

Ambar operates an international professional community. Users, clients, professional collaborators and service providers may be located inside or outside the European Economic Area (the “EEA”). Personal data may therefore be accessed, disclosed or otherwise transferred internationally where this is necessary for the operation of Ambar Hauss, the evaluation or performance of professional opportunities, the delivery of services or the use of technology providers.

The fact that a User is established or ordinarily resident outside the EEA does not, by itself, mean that every processing activity concerning that User constitutes an international transfer by Ambar. A transfer may occur, however, where personal data protected by the GDPR is made available to, or remotely accessed by, a recipient in a third country.

Where Ambar transfers personal data outside the EEA, it will rely, as applicable, on:

1. a decision of the European Commission recognising that the recipient country provides an adequate level of protection;
2. the European Commission’s Standard Contractual Clauses or another appropriate safeguard recognised under Article 46 GDPR, together with supplementary measures where required;
3. Binding Corporate Rules or another legally recognised transfer mechanism, where applicable; or
4. exceptionally, a derogation under Article 49 GDPR where the transfer is specific, objectively necessary and satisfies the applicable statutory requirements.

Ambar does not rely on Article 49 GDPR as the ordinary basis for regular, systematic or recurring international transfers.

You may request further information about the relevant transfer mechanism and, where available, a copy of the applicable safeguards by contacting lopd@ambarpartners.com. Certain information may be redacted where necessary to protect confidentiality, legal privilege or security.

10. Additional contractual data-protection terms for Ambar Hauss Users

10.1 Scope, contractual status and acceptance

This Section 10 contains contractual obligations applicable to Users of Ambar Hauss in addition to the transparency information contained elsewhere in this Privacy Policy. By accepting this Privacy Policy and the Ambar Hauss Terms and Conditions of Use through the registration, admission, renewal or re-acceptance process, each User agrees to be bound by this Section 10. Ambar will retain appropriate evidence of the version accepted and the date and method of acceptance.

10.2 General obligations of Users

Each User who receives or accesses personal data through Ambar Hauss, an Ambar-coordinated professional opportunity or an Ambar project must, to the extent applicable:

1. process such personal data only for the authorised community or professional purpose and in accordance with applicable law, professional duties, the relevant engagement terms and any documented instructions that lawfully apply;
2. observe professional secrecy and confidentiality and maintain appropriate technical and organisational security measures;
3. limit access to persons who are authorised and need the information for the relevant purpose;
4. not sell, reuse, disclose, onward transfer or otherwise make the personal data available to another person except where expressly authorised and lawfully permitted;
5. promptly notify Ambar of any actual or suspected personal-data breach, unauthorised access, legally binding disclosure request or inability to comply with the applicable data-protection obligations;
6. reasonably cooperate with Ambar in responding to data-subject requests, security incidents, regulatory enquiries, transfer assessments and compliance reviews; and
7. securely delete or return the personal data when it is no longer required for the authorised purpose, subject to applicable legal, regulatory and professional retention duties.

10.3 Automatic application of the Standard Contractual Clauses

Where a User located outside the EEA receives regular or recurring access to personal data protected by the GDPR, the recipient country is not covered by an applicable adequacy decision and no other valid transfer mechanism applies, the European Commission’s Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the “SCCs”) are incorporated into and form part of the contractual relationship between Ambar and that User automatically, without the need for a separate signature or individually negotiated agreement.

The SCCs apply only to the extent required for the relevant transfer. For their application:

1. Ambar will be the data exporter and the relevant User will be the data importer, unless the relevant project documentation specifies another lawful allocation;
2. Module One (controller to controller) will apply where Ambar and the User each act as independent controllers, which will ordinarily be the case where the User provides independent legal services and determines the professional means and purposes of the relevant processing;
3. where the User processes personal data solely on documented instructions as a processor, the module appropriate to the parties’ actual roles will apply and may be supplemented by the relevant engagement or project terms;
4. the identities and contact details of the parties will be those recorded in Ambar’s corporate information and in the User’s account, admission records and professional profile;
5. the categories of data subjects, personal data, purposes, frequency and duration of the transfer will be those described in this Privacy Policy and, where applicable, the relevant professional-opportunity or engagement documentation;
6. the competent supervisory authority and governing Member State will be determined in accordance with the SCCs and the GDPR, ordinarily by reference to Ambar’s establishment in Spain; and
7. the technical and organisational measures will include, as applicable, the security measures described in this Privacy Policy, the Ambar Hauss Terms and Conditions, Platform security requirements and any additional project-specific instructions communicated to the User.

The User agrees that the information held in their Ambar Hauss account, admission file and applicable engagement documentation may be used to complete the descriptions and annex information required by the SCCs. The User must keep that information accurate and promptly provide any additional information reasonably requested by Ambar for transfer-compliance purposes.

If the SCCs require an assessment, supplementary measure or project-specific clarification that cannot reasonably be addressed through this Privacy Policy and the information already held by Ambar, Ambar may require an additional acknowledgement or project term before granting access to the relevant personal data. This will be limited to what is necessary for the particular transfer and will not require the general membership documentation to be reissued.

10.4 Priority and onward transfers

If there is any conflict between the SCCs and another provision of this Privacy Policy, the Ambar Hauss Terms and Conditions or an engagement document, the SCCs will prevail to the extent of that conflict in relation to the relevant international transfer.

A User must not make an onward transfer of personal data received from the EEA unless the onward transfer is permitted under the SCCs, covered by an adequacy decision or other valid transfer mechanism, or otherwise expressly authorised by Ambar and permitted by applicable law.

10.5 Roles of the parties

The allocation of controller, joint-controller or processor responsibilities depends on the relevant activity. A User providing independent legal services will commonly act as an independent controller for the professional advice and services delivered by that User. Other limited processing may be carried out on documented instructions. Nothing in this Privacy Policy changes the parties’ actual legal roles, which will be determined by the facts and, where necessary, clarified in the relevant project documentation.

11. Cookies and similar technologies

Our website and Platform may use cookies, pixels, local storage, SDKs and similar technologies for security, functionality, analytics and marketing. Necessary technologies may operate without consent where permitted by law. Non-essential technologies are disabled until valid consent is obtained.

The consent interface allows users to accept, reject or customise non-essential technologies. Accept and reject choices are presented with equivalent prominence. Preferences can be changed at any time through the Cookie Settings link.

For the current list of technologies, providers, purposes and retention periods, please consult the Cookie Policy and the Cookie Settings interface available on the relevant website or Platform.

12. Current website and infrastructure providers

As at the date of this Privacy Policy, Ambar may use the providers listed below for website, infrastructure, analytics, marketing or communication purposes. The exact deployment and legal basis depend on the relevant service and the user’s cookie choices. The Cookie Settings interface is the most current source for cookies and trackers.

13. Marketing communications and professional contact data

Ambar may send relevant information about its services, professional community, events and publications to existing clients, Users and professional contacts where permitted by applicable law. Every electronic marketing communication will provide a simple way to unsubscribe or object.

Where consent is required, communications will be sent only after consent has been obtained. Consent may be withdrawn at any time without affecting processing carried out before withdrawal.

Ambar may process limited professional contact information obtained from public sources, professional platforms, referrals or the organisation for which the individual works, where this is necessary to establish or maintain a relationship with that organisation or with the individual in their professional capacity. This processing is based on Ambar’s legitimate interests and Article 19 of the Spanish Organic Law 3/2018, where applicable. Individuals may object at any time.

Ambar does not sell personal data to advertisers.

14. Events, photographs and recordings

Ambar may photograph or record events, interviews, panels and award ceremonies. The applicable event information will explain the intended use and legal basis. Close-up or featured promotional use will normally be based on consent, an agreement with the participant or another appropriate basis. General or incidental images of an event may be used where this is proportionate, reasonably expected and lawful.

Where practical, attendees who do not wish to appear in promotional content may contact the event team or lopd@ambarpartners.com. Withdrawal of consent does not affect processing that occurred before withdrawal and may not require removal of material where another legal basis applies or where removal is technically or legally disproportionate.

15. How long do we retain personal data?

We retain personal data only for as long as reasonably necessary for the relevant purpose, including the duration of a contractual or community relationship, and thereafter for the ordinary periods described below. A longer or shorter period may apply where required by law, necessary for an active project, complaint, investigation or claim, or justified by the nature of the data and the relevant processing purpose.

When data are no longer required, they will be securely deleted or anonymised. Data may remain temporarily in restricted backups until overwritten in accordance with normal backup cycles.

16. Security

Ambar applies technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected according to the nature of the data, the processing context and the risks involved and may include access controls, authentication, encryption, logging, backups, incident procedures, supplier due diligence and staff confidentiality obligations.

No system can guarantee absolute security. Users are responsible for safeguarding their credentials, using the Platform lawfully and promptly reporting suspected unauthorised access or security incidents.

17. Your data-protection rights

Subject to the conditions and limitations established by applicable law, you may exercise the following rights:

• Access: obtain confirmation of whether we process your personal data and receive a copy of relevant data and information.
• Rectification: correct inaccurate or incomplete personal data.
• Erasure: request deletion where the data are no longer necessary, consent has been withdrawn, an objection prevails or processing is unlawful.
• Restriction: request that processing be limited in specified circumstances.
• Objection: object to processing based on legitimate interests and object at any time to direct marketing.
• Portability: receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have them transmitted to another controller.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of prior processing.
• Automated decisions: request safeguards in relation to solely automated decisions that produce legal or similarly significant effects, where applicable.
• Complaint: lodge a complaint with the Spanish Data Protection Agency or another competent supervisory authority.

18. How to exercise your rights

You may exercise your rights or raise a privacy question by writing to:

• Email: lopd@ambarpartners.com
• Postal address: AMBAR PARTNERS TECH SERVICES, S.L., Guzmán el Bueno 133, Edificio Britannia, 28003 Madrid, Spain

Please identify the right you wish to exercise and provide enough information for us to locate the relevant data. We may request proportionate proof of identity where necessary to protect your information. Exercising your rights is free of charge, although a reasonable fee may be charged or a request refused where it is manifestly unfounded or excessive, as permitted by law.

We will respond without undue delay and normally within one month. That period may be extended by up to two additional months where necessary due to complexity or the number of requests; we will inform you of any extension within the initial month.

You may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es

19. Data relating to other people

If you provide personal data relating to another person, you must ensure that you are authorised to do so and that the person receives the information required under applicable data-protection law. You must not upload third-party personal data, client information or confidential matter information to Ambar Hauss or a Third-Party Service unless the disclosure is authorised, necessary and compliant with professional obligations.

20. Children

Ambar’s professional services, community and Platform are intended for individuals aged 18 or over. We do not knowingly offer Memberships or professional services to children. If we learn that we have collected a child’s personal data without an appropriate basis, we will take reasonable steps to delete it.

21. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in law, regulation, guidance, technology, our services or our processing activities. The updated version will be published with a revised “Last updated” date. Where changes are material, we will provide additional notice through the website, Ambar Hauss, email or another appropriate channel before the changes take effect where required.

Where an update materially changes the contractual obligations applicable to Users, Ambar may require Users to re-accept the revised Privacy Policy through Ambar Hauss before continuing to access some or all of the Platform. Ambar may retain electronic evidence of acceptance, including the applicable version, account identifier, date, time and acceptance method.

22. Contact

Questions about this Privacy Policy or Ambar’s processing of personal data may be addressed to:

AMBAR PARTNERS TECH SERVICES, S.L.
Guzmán el Bueno 133, Edificio Britannia
28003 Madrid, Spain
Email: lopd@ambarpartners.com
Telephone: +34 697 628 122