Privacy policy and data processing

Last updated: June 21, 2026

LORCABASE - FZCO respects your privacy and is committed to protecting your personal data. In this Policy we explain what data we process, for what purpose, on what legal basis, with whom we share it and what rights you have to control its use.

1. Data controller

2. Applicable regulatory framework

This Policy is governed, depending on the data subject's country of residence and the nature of the processing, by:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL): the primary regulation applicable to LorcaBase as a company incorporated in the United Arab Emirates.
• Regulation (EU) 2016/679 (GDPR): applicable under Article 3(2) when LorcaBase offers services to residents in the European Union.
• Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (LOPDGDD): with respect to users residing in Spain.
• Other equivalent local regulations, such as the Federal Law on the Protection of Personal Data Held by Private Parties (Mexico), Law 1581 of 2012 (Colombia) and Law 25.326 (Argentina).

3. Data we process

We process only the data you voluntarily provide when interacting with the Website or when engaging our services:

• Contact data: first name, last name, email address, phone number, country of residence.
• Message data: content you write in the contact form or via WhatsApp/email.
• Technical and analytics data: IP address, browser type, operating system, pages visited, date and time of access. Security data is collected by our CDN provider; analytics metrics are only collected through Google Analytics 4 when the user gives consent.
• Public review data: name or alias, text and date of reviews voluntarily published on LorcaBase's public Google profile and republished locally on this site.
• Contractual data (only if you engage our services): corporate documentation, passport, proof of address and any other information required to provide the contracted professional services.

We do not process special categories of data (health, ethnic origin, beliefs, etc.) unless strictly necessary for the provision of the service and with your explicit consent.

4. Purposes of processing

• Handling your enquiries and requests submitted via the contact form, WhatsApp or email.
• Providing the professional services you engage (company formation, taxation, visas, accounting, etc.).
• Managing the contractual relationship, invoicing and compliance with legal obligations.
• Sending informational or commercial communications related to our services, only where explicit consent exists or where there is a legitimate interest in relation to existing clients.
• Protecting the Website against fraud, automated attacks and spam (via Cloudflare Turnstile).
• Measuring aggregate Website usage and improving its content and navigation, only where the user accepts analytics cookies.
• Displaying selected experiences published by clients on LorcaBase's public Google profile without loading external widgets.
• Complying with legal obligations applicable to us (tax, commercial, anti-money laundering, etc.).

5. Legal basis for processing

• Consent (Art. 6(1)(a) GDPR): for submission of the contact form, commercial communications and non-essential cookies.
• Performance of a contract (Art. 6(1)(b) GDPR): to provide the services you have engaged.
• Legal obligation (Art. 6(1)(c) GDPR): to comply with accounting, tax or regulatory obligations.
• Legitimate interests (Art. 6(1)(f) GDPR): to maintain website security, prevent fraud, respond to incoming business enquiries and republish reviews their authors posted on LorcaBase's public profile. You may request removal of a review by writing to accounting@lorcabase.com.

6. Recipients and processors

To deliver our services and operate the Website, we engage technology providers who act as data processors. They only access the data strictly necessary and under agreements that ensure the security measures required by the GDPR and the UAE PDPL:

• Cloudflare, Inc. (United States): site hosting (Cloudflare Workers), CDN, anti-bot protection (Cloudflare Turnstile) and transmission of the contact form (the data you submit is relayed by email, through Cloudflare infrastructure, exclusively to LorcaBase mailboxes; it is not stored in third-party databases). Policy: cloudflare.com/privacypolicy
• Google LLC / Google Ireland Ltd: Google Analytics 4, the embedded Google Maps map and links to the business profile. Google Analytics and the map are loaded only after consent for optional cookies and content has been obtained. Policy: policies.google.com/privacy
• WhatsApp LLC (Meta): only when the user voluntarily initiates a conversation through the WhatsApp link. Policy: whatsapp.com/legal/privacy-policy

LorcaBase does not sell, transfer or rent your personal data to third parties for commercial purposes. We only disclose data to public authorities, courts or regulatory bodies when legally required to do so.

7. International data transfers

Since LorcaBase is established in the United Arab Emirates and some of our providers (Cloudflare and Google) may process data in the United States or other countries, international transfers of data outside the European Economic Area may occur. These transfers are carried out with the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission, for processors located in the United States.
• EU-U.S. Data Privacy Framework, where the provider is a participant.
• Adequacy decision of the European Commission, where one exists for the destination country.

8. Retention periods

• Contact data (form, email): retained for as long as necessary to respond to the enquiry and for up to 24 months thereafter, unless you request deletion beforehand.
• Client contractual data: for the duration of the contractual relationship and subsequently for the periods required by commercial, tax and anti-money laundering regulations (up to 10 years in the UAE).
• Technical data and cookies: as indicated in our Cookie Policy.

9. Your rights

As the data subject, and pursuant to the GDPR (Arts. 15 to 22) and equivalent regulations in your country, you may exercise the following rights:

• Access: to know what data of yours we process.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request that we delete your data when it is no longer necessary.
• Restriction of processing: to request that we suspend the use of your data in certain circumstances.
• Portability: to receive your data in a structured, commonly used format, or to request that we transmit it to another controller.
• Objection: to object to processing based on legitimate interests or to processing for marketing purposes.
• Not to be subject to automated decisions with significant legal effects.
• Withdrawal of consent, at any time, without retroactive effect.

10. How to exercise your rights

To exercise any of these rights, send a request to accounting@lorcabase.com stating your full name, the right you wish to exercise and a copy of a document proving your identity. We will respond to your request within a maximum of 30 calendar days.

11. Right to lodge a complaint

If you consider that LorcaBase has processed your data incorrectly, you may lodge a complaint with:

• Spain: Spanish Data Protection Agency (AEPD) · aepd.es
• European Union: The supervisory authority of the Member State where you are habitually resident or have your place of work.
• United Arab Emirates: UAE Data Office, pursuant to UAE Federal Decree-Law No. 45 of 2021.
• Mexico: National Institute for Transparency, Access to Information and Personal Data Protection (INAI).
• Colombia: Superintendency of Industry and Commerce (SIC).
• Argentina: Agency for Access to Public Information.

In any case, we invite you to contact us first so that we may try to resolve your concern directly.

12. Security measures

LorcaBase applies reasonable technical and organisational measures to protect data against unauthorised access, loss, alteration or improper disclosure: TLS/SSL encryption in transit, hosting on ISO 27001-certified infrastructure, anti-bot protection, internal access controls and confidentiality agreements with providers.

13. Minors

The services offered by LorcaBase are directed at persons aged 18 and over. We do not intentionally collect data from minors. If you become aware that data of a minor has been submitted without the consent of their legal guardian, please contact us and we will proceed to delete it.

14. Amendments to this Policy

LorcaBase may update this Privacy Policy to reflect regulatory, operational or technological changes. The current version will always be published on this site with its last updated date. When changes are material, notification will be provided through available channels.

15. Contact

For any queries relating to this Privacy Policy, please contact us at:

• Email: accounting@lorcabase.com
• Address: DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates
• Phone: +971 55 633 8871