Empowered By Us (EBU)

Empowered By Us (EBU) is committed to protecting personal data and respecting the privacy of individuals who engage with its website, professional services and activities.

This Privacy Policy explains how personal data is collected, used, stored and protected in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Spanish data protection legislation.

The data controller is:

Sophie H. Turner, trading as Empowered By Us (EBU)

• Registered address: Calle Begoña 50-4B, 33201 Gijón, Asturias, Spain
• Contact email: legal@empoweredbyus.com
• Website: https://empoweredbyus.com

Depending on the nature of the interaction, EBU may process:

• Names, professional affiliations and contact details.
• Information provided through professional enquiries and correspondence.
• Information necessary to manage contracts, collaborations and professional engagements.
• Information voluntarily submitted when reporting concerns about EBU’s professional conduct.
• Limited technical information necessary for website functionality and security.

EBU seeks to collect only personal data necessary for legitimate and clearly defined purposes.

EBU processes personal data only where there is a legitimate and lawful purpose for doing so, in accordance with Article 6 of the General Data Protection Regulation (GDPR).

The purposes and corresponding legal bases are outlined below.

Purpose of processing	Legal basis under GDPR
Responding to professional enquiries and correspondence	Legitimate interests — Article 6(1)(f)
Establishing and performing contracts with individual clients or contractors	Contractual necessity — Article 6(1)(b)
Managing institutional and professional relationships	Legitimate interests — Article 6(1)(f)
Maintaining accounting and legally required records	Legal obligation — Article 6(1)(c)
Protecting website functionality and security	Legitimate interests — Article 6(1)(f)
Receiving and assessing voluntary integrity reports	Legitimate interests — Article 6(1)(f), subject to applicable safeguards

Where EBU relies on legitimate interests, it considers the necessity of the processing and its potential impact on individuals’ rights and freedoms.

Where consent is legally required, EBU will obtain it before processing the relevant personal data. Consent may be withdrawn at any time.

EBU applies appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or loss.

Access to personal information is limited to those who require it for legitimate professional purposes.

EBU uses third-party service providers to support website hosting, professional communications, administration and document storage.

Personal data may be shared with these providers where necessary and subject to applicable data protection requirements.

Information may also be disclosed where required by law or where necessary to establish, exercise or defend legal claims.

EBU does not sell personal data.

Some of EBU’s service providers operate internationally. Personal data may therefore be transferred to or accessed from countries outside the European Economic Area (EEA).

Where such transfers occur, EBU uses applicable safeguards under the GDPR, including European Commission adequacy decisions or Standard Contractual Clauses, as appropriate.

Information about relevant safeguards may be requested through legal@empoweredbyus.com.

EBU retains personal data only for as long as necessary for the purposes for which it was collected, or to comply with applicable legal obligations

General enquiries	Up to 12 months after the last substantive communication, unless further retention is justified
Client and project correspondence	Duration of the engagement and any subsequent period required for legal obligations or potential claims
Accounting and financial records	In accordance with applicable Spanish legal requirements, generally including six years where commercial recordkeeping rules apply
Website technical and security logs	For the period necessary for website operation and security
Integrity reports	Normally deleted within 90 days after assessment if no further action is required; otherwise retained only where justified

After the relevant retention period, personal data is securely deleted or anonymised unless continued retention is legally required or permitted.

Under applicable data protection legislation, individuals may have the right to:

• Access their personal data.
• Request correction of inaccurate information.
• Request erasure where applicable.
• Restrict or object to certain processing.
• Request data portability where applicable.
• Withdraw consent where processing is based on consent.

Requests may be submitted to legal@empoweredbyus.com.

Individuals may also lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es.

EBU provides a dedicated channel for reporting concerns relating to bribery, corruption, conflicts of interest or other unethical conduct associated with its professional activities.

Reports may be submitted confidentially to integrity@empoweredbyus.com.

Information received is used to assess and, where appropriate, address reported concerns. Access is restricted to those responsible for handling them, and disclosures are limited to those necessary for legitimate investigative or legal purposes.

Individuals are encouraged to avoid including sensitive personal information unless necessary. Where reports contain special-category personal data, processing is subject to an additional applicable GDPR condition.

Reports are retained in accordance with Section 8 of this Policy.

Based on the website’s current configuration and the checks undertaken, EBU has not identified advertising, behavioural profiling or visitor analytics cookies.

The website may use technical technologies necessary for its operation and security.

Where cookies or similar technologies requiring consent are introduced, EBU will provide appropriate information and obtain consent where required by law.

EBU may update this Privacy Policy to reflect changes in its activities, data processing practices or applicable legislation.

The latest version will be made available on this website.