← Back to Home

Legal texts

Last updated: 26 October 2026

This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.

Privacy policy

Data controller

(“Acros”). Tax ID and address: at the end of this page. Email for any privacy matter: [email protected] · +34 668 170 020.

What data we process and when

  • When you request a quote: your phone number (required), your email (if you give it to us), the services you choose, your answers to the questionnaire, anything you write to us, your language and, if you arrive from an ad, the campaign you came from.
  • When you ask us to call you: your name, your phone number, the same origin data and, if you want to tell us, the reason for your call, so that whoever calls you has some context.
  • When you register a partner company: the company name, its tax ID, the type of company, the contact person’s name, phone and email, the preferred channel and any comment you leave us.
  • If you write to us by WhatsApp, email or phone: your contact details and the content of the conversation.
  • If you send us a suggestion: the text, its type and, if you give it to us, your email so we can reply. From your area it is linked to your account, unless you send it anonymously.
  • The reports we prepare for you: we keep them privately, without public links, so that you can download them from your area whenever you need, together with your approval or any changes you ask us for.
  • If you use the chat in your client area: the messages you exchange with your advisor and their date. You can hide your messages from your area at any time; we keep a copy as a record of the service, for the periods indicated below. If your advisor writes to you and you do not read it within a few minutes, we send you a notification email that does not include the content of the messages.
  • Emails about your case: in addition to the above, we may remind you by email of a document we have asked you for or a service awaiting your confirmation (at most one reminder a day for each), and warn you when the deadline of a service is approaching if we are still missing something from you. These emails name the document or service, never include their content, and you can turn them off under “Notifications” in your area.
  • As a client: your email and phone number, your password if you choose to have one (we store it irreversibly transformed: nobody can read it, not even us), your billing details, your identity document and the due diligence questionnaire, the tax and financial documentation you provide, your payment details (the chosen method and, if you pay in crypto-assets, the transaction identifier), our communications with you, the advisor who looks after you (and, if you request it, your request to change advisor and its reason) and, when your order is completed, the review you wish to leave us and how you would like your name to appear.

Purposes and legal basis

  • Handling your request, calling you and preparing your quote: pre-contractual steps at your request (Art. 6.1.b GDPR).
  • Providing the contracted service, invoicing it and giving you access to your area: performance of the contract (6.1.b) and compliance with legal obligations (6.1.c), such as tax and accounting obligations.
  • Identifying you and applying the due diligence required by anti-money-laundering law: legal obligation (6.1.c). See the next section.
  • Managing the relationship with partner companies and their contact persons: pre-contractual steps and performance of the partnership agreement (6.1.b) and our legitimate interest in maintaining that professional relationship (6.1.f).
  • Writing to you through the channels you choose: your consent (6.1.a), which you can withdraw at any time.
  • Keeping the communications and records of the service and protecting the website against abuse: our legitimate interest (6.1.f) in being able to evidence the service provided and in security.
  • Knowing which campaign you came from (parameters of the ad link): legitimate interest in measuring our advertising. We do not use tracking cookies for this.
  • Asking you for a review when your order is completed and using it to improve our service and our team’s care: legitimate interest (6.1.f). Leaving a review is voluntary and, for now, reviews are for internal use only: if we ever publish them, your name will only appear in the form you chose when reviewing.

Due diligence (anti-money laundering)

If you engage any of our services, we are legally required (Spanish Law 10/2010) to collect information about the origin of your funds and your profile as a client, and to keep it for 10 years from the end of the professional relationship, a period different from and longer than for the rest of the data in this policy. The legal basis is compliance with a legal obligation (Art. 6.1.c GDPR), not your consent, so it cannot be withdrawn while the contractual relationship lasts.

We will not ask for your sign-up every time: if you engage a new service and your approved sign-up is less than 12 months old, we apply it to that engagement. If it is older than 12 months, we will ask you to renew it: you will review your previous answers, change what has changed and may use the same identity document if it is still valid.

If, as part of this procedure, we identify that you hold or have held a prominent public function (or are closely associated with someone who does), we apply the additional measures required by the same law. This information is handled with restricted access within our team.

How long we keep data

  • Requests that do not lead to a contract and company registrations that do not lead to a partnership: 12 months from the last contact.
  • Client data: for as long as the relationship lasts and, afterwards, for the periods required by law (tax and commercial regulations generally require documents to be kept for 4 to 6 years).
  • Due diligence: 10 years, as explained above.

Who we share it with

We do not sell your data. The following providers process it on our behalf, solely to provide their service to us:

  • Railway Corporation (USA): the website’s server and database.
  • Cloudflare, Inc. (USA): hosting of the website’s pages and storage of the documents you upload to us, which travel and are stored encrypted.
  • Google Ireland Ltd. (Google Workspace): our professional email.
  • Sendinblue SAS, Brevo (France): sending the service emails, such as your access link.
  • Twilio Inc. (USA): sending your access link by WhatsApp, only if you give us your phone number for that purpose.
  • Anthropic, PBC (USA): an artificial intelligence tool your advisor uses for support, for example to prepare draft replies. It only receives the text it needs, without your name or identification details; it does not read the documents you upload, and a person at Acros reviews everything before it is sent to you. If you would rather it were not used in your case, tell us and we will switch it off.

Where the provider is outside the European Economic Area, the transfer is covered by the safeguards of the GDPR (the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses).

If you pay by card, the payment is handled by a payment gateway that processes your payment data as an independent controller: your card never passes through our systems. If you write to us by WhatsApp, WhatsApp’s (Meta’s) privacy policy also applies.

Crypto-asset exchange rate. To show you the equivalent amount in crypto-assets, your browser queries CoinGecko’s public API directly. This query includes no personal data about you (only the name of the cryptocurrency), so CoinGecko does not act as a processor of your data.

Apart from these cases, we will only disclose data when required by law.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to [email protected] and stating which right you are exercising. We reply within the legal period of one month. If you believe we have not handled it properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Security

The whole website runs encrypted (HTTPS). Your identity document and the tax documentation you upload are encrypted in your own browser before being sent, and only we can decrypt them. We limit access to data to those who need it for their work and apply measures proportionate to the risk. You can turn on two-step verification in your area, so that besides your email or password a code from your phone is needed. Every night we make an encrypted backup that only we can open, and we keep those from the last 30 days.

From “Security” in your area you can sign out only on the device you are using or on every device where you have signed in; in the latter case we also stop remembering the trusted devices of two-step verification.

Minimum age

Our services are intended for people aged 18 or over.

Changes

If we change this policy, we will update the date and, if the change is significant, we will let you know.

Cookie policy

What they are

Small files that a website stores in your browser. The law treats other ways of storing information on your device, such as the browser’s local storage, in the same way.

What we use

This website does not use advertising, analytics or tracking cookies, nor does it set third-party cookies. We only store in your browser what is strictly necessary for the website to work as you ask it to: your client area session and preferences you choose yourself, such as the view for individuals or companies or dark mode, and a copy of the website’s own texts and images so that it loads instantly. All of this is exempt from consent.

If you arrive from an ad, we read the parameters of the link itself to know the campaign, but that does not store anything in your browser.

How to manage it

You can delete this information from your browser settings; if you do, you will need to sign in to the client area again.

Changes

If we ever add analytics or advertising cookies, we will update this policy and ask for your consent first, with a clear notice.

Terms of service

Who we are

(“Acros”) · Tax ID and address: at the end of this page · [email protected] · +34 668 170 020.

What you engage

Professional tax advisory services specialised in crypto-assets, including: profit and loss reports, source of funds reports, Spanish income tax returns, Forms 714, 720 and 721, handling tax authority requests, ongoing tax support and optimisation. The specific scope of each order is the one detailed in your quote.

How to engage us

  1. You request a quote through the website, by phone or by WhatsApp.
  2. Your advisor reviews your case and replies within 24 hours.
  3. We send you the quote with a link to your client area. It details the services, price and taxes, and is valid for 15 days.
  4. You accept it from your area, expressly asking us to start straight away, and choose how to pay.
  5. You identify yourself and complete the due diligence questionnaire required by law.
  6. You provide the documentation from your client area.
  7. We deliver your report in your client area, where you can download it whenever you need.
  8. You review it and give us your approval or ask for any changes you need; if necessary, we deliver a corrected version. With your approval, the order is complete.

Prices and payment

Tailored prices, in euros and with the taxes stated in the quote. You can pay by Bizum, bank transfer, card or crypto-assets. If you pay by card, the payment is handled by a payment gateway and your card details never pass through our systems.

Payment in crypto-assets. We accept payment in Bitcoin, Ethereum and Solana, including USDC and USDT on the latter two networks. The amount shown in crypto-assets is indicative, calculated at the exchange rate at the time of the query: the amount sent does not need to match to the cent, as we verify each payment before confirming it. The invoice is issued in euros, stating the exchange value applied and the transaction (hash) as proof.

When work begins. By confirming the payment method you declare that you have made the payment, which lets you upload your documentation straight away. However, the actual start of the order, and its invoicing, are subject to our confirming that the payment has actually been received. If we find that the payment has not arrived, we will let you know so that it can be settled before we continue.

Your part

Our work is based exclusively on the information and documentation you provide, which must be truthful and complete. Delays or omissions in providing it may change the timelines, and Acros will not be responsible for the consequences of incorrect or incomplete information.

Closing each service. When your advisor marks a service as finished, we will ask you in your area and by email. You can confirm it or tell us that something is still pending, in which case it stays open. If we hear nothing from you within 15 days, we will consider the service finished; your advisor can reopen it if needed. Approving the final report counts as confirming that the service is finished.

Our part and its limits

We provide the service with due professional diligence and in accordance with the regulations in force on the delivery date. The final decision on your situation lies with the tax authorities: we cannot guarantee the outcome of their checks, although we can defend our work if you engage that service.

Right of withdrawal

If you contract as a consumer, you have 14 calendar days from the date of contract to withdraw without giving any reason, by writing to [email protected]. When accepting the quote you expressly ask us, by ticking a box, to start straight away: therefore, if the service is completed before that period ends, you will lose the right of withdrawal; if you withdraw once the service has started but before it is completed, you will pay for the proportional part already performed.

Partner companies

If you are an accounting firm, advisory firm, real estate agency or other company working with us, the relationship is governed by the partnership agreement we sign, not by these terms.

Communications

We will communicate with you through your client area, email, phone or WhatsApp. By email we may remind you of what is pending on your side and warn you when a deadline approaches; you can turn these reminders off under “Notifications” in your area, except for the essential service notices. Service communications are kept as described in the Privacy policy.

Amendments and partial invalidity

We may update these terms for future orders; each order is governed by the terms in force when it was placed. If any clause were found to be void, the rest will remain valid.

Language, law and jurisdiction

These terms are also published in Spanish; in case of discrepancy, the Spanish version prevails. Spanish law applies; if you act as a consumer, disputes will be settled by the courts of your place of residence.

Owner details

· Tax ID (NIF) · Professional address: .