Privacy Policy

ExpatLegal S.A.S. ("ExpatLegal", "we", "us", or "our") is a Sociedad por Acciones Simplificada incorporated under the laws of the Republic of Ecuador, with its registered office in the canton and province of Loja. ExpatLegal acts as the Responsable del Tratamiento (data controller) for all personal data processed through this website in accordance with the Ley Orgánica de Protección de Datos Personales (LOPDP).

This Privacy Policy applies to personal data collected through the elsas.ec website and any contact forms, email addresses, or other digital channels operated by ExpatLegal in connection with this site. It does not govern data processed in the course of a formal professional engagement, which is subject to our engagement letter and applicable professional confidentiality obligations.

By using this Site you acknowledge that you have read and understood this policy. If you do not agree with any aspect of it, please refrain from submitting personal data through the Site.

The following terms are used throughout this policy with the meanings given below, consistent with the LOPDP.

ExpatLegal collects only the personal data reasonably necessary to operate this Site and respond to your enquiries. The categories of data we may collect include:

• Contact information — name, email address, and telephone number submitted through contact or consultation forms.
• Communication content — the substance of messages or enquiries you send us through the Site.
• Technical & usage data — IP address, browser type and version, operating system, pages visited, and time and date of access, collected automatically when you visit the Site.
• Cookie data — information collected via cookies as described in Section 10 below.

We process your personal data for the following purposes:

• Responding to your enquiries and consultation requests submitted through the Site.
• Providing general information about our legal services and areas of practice.
• Sending you legal updates, articles, or other communications where you have consented to receive them.
• Operating, maintaining, and improving the Site, including diagnosing technical problems and monitoring usage patterns.
• Complying with applicable Ecuadorian legal and regulatory obligations.
• Establishing, exercising, or defending legal claims where necessary.

We do not use your personal data for automated decision-making or profiling that produces legal effects or otherwise significantly affects you.

In accordance with Article 7 of the LOPDP, ExpatLegal relies on the following legal bases to process your personal data:

• Consent — where you have freely, specifically, and unambiguously indicated your agreement, for example by subscribing to our newsletter or submitting a contact form.
• Pre-contractual and contractual measures — where processing is necessary to take steps at your request prior to entering into an engagement, or to perform an agreement with you.
• Legal obligation — where processing is required to comply with Ecuadorian law or a regulatory requirement binding on ExpatLegal.
• Legitimate interest — where processing is necessary for the purposes of ExpatLegal's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes operating and improving the Site and protecting it from unauthorised access.

You may withdraw any consent you have given at any time. Withdrawal does not affect the lawfulness of processing that took place before the withdrawal.

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. In practice:

• Enquiry and contact form data is retained for a period sufficient to respond to your request and to maintain a reasonable record of communications, typically not exceeding three (3) years from the date of last contact.
• Technical and usage data collected automatically is retained for the minimum period necessary for site security and analytics purposes.
• If an enquiry leads to a formal professional engagement, the relevant data will be governed by the retention schedule applicable to client files under Ecuadorian professional regulations.

When data is no longer needed, we delete it or anonymise it so that it can no longer be linked to you.

ExpatLegal does not sell, rent, or exchange your personal data with third parties for their own commercial purposes.

We may share personal data with the following categories of recipients:

• Technology service providers — website hosting, email delivery, and other IT providers who process data on our behalf and are bound by appropriate data processing agreements.
• Professional advisers — lawyers, accountants, and auditors, subject to professional confidentiality obligations.
• Competent authorities — Ecuadorian courts, regulatory bodies, and law enforcement agencies, where required by applicable law or a valid judicial or administrative order.

Where personal data is transferred to a service provider located outside Ecuador, ExpatLegal takes steps to ensure an adequate level of protection is in place, consistent with the LOPDP's requirements for international transfers.

ExpatLegal implements technical and organisational measures appropriate to the nature and volume of personal data we process, including access controls, secure transmission protocols, and regular security reviews. These measures are designed to protect your data against unauthorised access, alteration, disclosure, and accidental loss.

While we take reasonable precautions, no method of transmission over the internet is completely secure. Any data you transmit to us is sent at your own risk. We are not responsible for interception by unauthorised third parties outside our reasonable control.

This Site may use cookies and similar tracking technologies to enhance your browsing experience, analyse usage patterns, and support the technical operation of the Site. A cookie is a small text file stored on your device when you visit a website.

We use the following categories of cookies:

• Strictly necessary cookies — essential to the operation of the Site and cannot be disabled.
• Analytics cookies — help us understand how visitors interact with the Site so we can improve it. These are only set with your consent.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Disabling strictly necessary cookies may affect the functionality of the Site. Where required under Ecuadorian law or applicable guidance, we will seek your consent before setting non-essential cookies.

We do not knowingly collect personal data from youth under 15. If we become aware that personal data has been submitted by a person under 15 without appropriate parental consent, we will delete it promptly. If you believe a person under 15 has submitted personal data to us, please contact us using the details in Section 15.

As a data subject under the Ley Orgánica de Protección de Datos Personales, you have the following rights with respect to your personal data. These rights may be subject to conditions and limitations set out in the LOPDP.

To exercise any of the rights described above, please submit a written request to us at the contact details in Section 15. Your request should include the following:

• Your full name, identification number (cédula or passport), and an email address or postal address for our response.
• A clear description of the personal data to which your request relates and the specific right or rights you wish to exercise.
• A copy of a document confirming your identity, and, if acting as a representative, evidence of your authorisation.

We will respond within fifteen (15) calendar days of receiving a complete request, in accordance with the LOPDP. We may request clarification where necessary to process your request, in which case the response period runs from the date we receive the clarification.

ExpatLegal may update this Privacy Policy from time to time to reflect changes in applicable law, our data processing practices, or our services. The date of the most recent revision appears at the top of this page. We encourage you to review this policy periodically.

Where changes are material, we will endeavour to notify you by a prominent notice on the Site prior to the change taking effect. Your continued use of the Site after any update constitutes acceptance of the revised policy.

For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data, please contact us at: