Who is responsible for the processing of your data?

IBERDROLA CLIENTES, S.A.U., with Corporate tax number (C.I.F.) A-95758389 and with registered address at Plaza Euskadi 5, 48009 in Bilbao (Spain), is the data controller for the data provided by data subjects and hereby guarantees the security and confidential processing thereof in accordance with the provisions of the General Data Protection Regulation (“GDPR”), and any other applicable regulation.

The data subject may contact the Data Protection Officer to resolve any queries relating to the processing of their personal data, at dpo@iberdrola.es.

Why do we process your personal data?

a)     When processing customer and user data on IBERDROLA digital platforms

Within IBERDROLA's digital platforms, the user's personal data will be collected and processed, depending on the relationship with the user, for the following purposes:

• In the case of user registrations, to provide access to and use of the digital platform and contracting and contact information available to the user, in compliance with the obligations incumbent on Iberdrola Clientes S.A.U. as a provider of information society services. At the time customers are registered and in accordance with their acceptance of the terms of use for the platform, their email address data may be used to send their bills and notifications related to the service electronically.

• The information is also used to manage enquiries or applications made.

• Likewise, users' ⁠browsing data and cookies may be processed, according to the consents obtained, to improve user accessibility, customise and analyse their browsing, and display publicity and advertisements based on their interests, including advertising spaces on third-party platforms (e.g. social networks, internet browsers, etc.). in accordance with our cookies policy and the privacy policies of the platforms that give access to said cookies. In this same regard, IBERDROLA may include additional functionalities within apps to collect usage and navigation data from its users for purposes of improving and customising them, as well as require the activation of other mobile resources (GPS, access to files or others) in order to display and share information of interest to users, its delivery by them and other services of the mobile terminal. In all these cases, the app will include specific information on such additional functionalities within its specific conditions of use and download, as well as in the requests for specific consents and permissions for the activation of such functionalities by the user.

• Other specific purposes specified in the data collection forms on the digital platform without which IBERDROLA would not be able to process the form in question.

• When signing up for services or products through the digital platforms, including WhatsApp, we inform you that the purpose will be to manage the relationship with IBERDROLA, to provide the services requested, to provide customer service and, in general, to fulfil its contractual obligations. This includes the possibility of sending by electronic means a validation message, as well as sending you informative messages strictly in connection with the contractual relationship (for example, information about bills, selecting electricity plans, tariffs, incidents, information about customer services channels, etc.) and for processing all types of claims, complaints or requests regarding the contractual relationship and, if appropriate, taking such action as may be necessary to recover and collect payment of debts you may owe to IBERDROLA, including updating the data provided by the debtor. In the event that a user initiates the process of contracting a product or service, but this is not completed correctly, Iberdrola will process the data provided during the contracting process on the basis of Iberdrola's legitimate interest, in order to contact the data subject and thus facilitate the completion of the contract.

• ⁠IBERDROLA may also consult credit agency records to check the financial solvency of the Customer and take decisions based on these checks that may affect the Customer, including making the coming into force of the Contract or its continued validity subject to the establishment of a guarantee of payment. However, IBERDROLA will always give the Customer the opportunity to state any arguments they deem fit to defend their rights and interests. In the event of non-payment, IBERDROLA may inform such credit agencies accordingly, complying with the legislation in force.

• Providing the user has given their consent, IBERDROLA may update and add to the user's personal data by acquiring databases from publicly accessible sources allowing improved management of relations and contact with the user.

• IBERDROLA will also process the personal data for the purpose of offering, by the means provided or through others' platforms contracted by Iberdrola and accessible to the user, information about the supply of energy, products and services by IBERDROLA or of third parties promoted by IBERDROLA, if the user has consented to this, relating ⁠to energy, telecommunications, finance, home and entertainment. To this end, IBERDROLA may use automated support systems and other means allowing profiling of target audiences of campaigns, activities or actions to be defined, using information from IBERDROLA as well as information from third-party sources, provided that the user has consented thereto. Provided the users have given their consent, these actions in the case of customers may be carried out even after the contractual relationship with the customer has ended.
  ⁠Similarly, IBERDROLA may process the customer's personal data to carry out auditing processes for the purpose of supervising compliance with the regulations to which it is subject; the regulations, internal operating protocols or the corporate governance model.
  ⁠Likewise, IBERDROLA will process the personal data of its customers for the purpose of contacting them, for a maximum period of one year from the termination of the last contract, for the purpose of recovering such persons as customers (‘winback’). The basis for legitimising this processing is IBERDROLA's legitimate interest in improving its services, knowing the reasons that would have induced the customer to cancel their relationship with the company and in accordance with article 3 of circular 1/2023, of 26 June, on the application of article 66.1.b) of Law 11/2022, of 28 June, General Telecommunications Law.

• Additionally, IBERDROLA may use the user’s unlinked data, always safeguarding their anonymity, even after the relationship has come to an end, so that the users of the support systems may use this in their decision-making and business management support systems, and to optimise customer management systems.

• IBERDROLA may process personal data in order to manage all stages of promotions and/or prize draws, as well as the delivery of prizes and the sending of information (by electronic or other means) relating to them, in accordance with the legal terms and conditions of each promotion and/or prize draw.

b)     When processing potential customer data in promotions, communication campaigns and events

IBERDROLA may process data collected from potential customers for different purposes according to the context of each activity. Thus:

• In the case of promotions, prize draws, and events organised, the purpose ⁠is that defined in the rules of the promotion, prize draw, or, specific event, as is the case of the publication and dissemination, with the data subject's consent, of their name, surname, image, voice or other data it may be necessary to publish for the correct management and better dissemination of the event or promotion through such media as IBERDROLA may see fit (intranet, newsletters, press, website, social networks, etc.) including those located in foreign countries with the due legally required guarantees, and to send marketing and profiling messages with the user's consent.

• In the case of advertising campaigns, ⁠data gathered from public access sources based on IBERDROLA's legitimate interests or gathered directly from the data subject or from third parties with their consent may be used by IBERDROLA to send marketing messages in accordance with their commercial profile, if so consented, relative to the supply of energy, products, services, and sports, culture and charitable actions in which Iberdrola participates. These communications can be sent via the means of contact obtained, whether conventional or electronic, as well as over third-party platforms contracted by Iberdrola and accessible to users, such as social media, internet search engines, etc.

How long will we keep your data for?

a)     When processing customer and user data on IBERDROLA digital platforms

The personal data provided by the user when subscribing to products and services will be processed by IBERDROLA throughout the duration of the contractual relationship with the customer, which will start at the moment when the Contract or Contracts are completed and will terminate, regardless of the supply period, when all reciprocal contractual obligations have been discharged and at least 3 years subsequent to their termination in compliance with the law.

Purpose 15: personal data will be processed, as a minimum, until the end of the financial year in which the audit takes place and, where appropriate, afterwards, insofar as is required to meet Iberdrola's legal obligations.

With the user’s consent, the data may be processed for the purpose of sending marketing messages, for a two-year period subsequent to the termination of the contracts or after the withdrawal of a user who does not have current contracts with IBERDROLA.

In addition, personal data processed for sending commercial communications based on IBERDROLA's legitimate interest will be kept for as long as the contractual relationship with the customer remains in force or the customer does not object to such processing.

If the customer enters any promotion and/or prize draw, their personal data will be processed by IBERDROLA for the time necessary to manage their participation in the draw and, if applicable, redemption of the prize. After the end of this period of time, personal data will be duly blocked.

In the case of other users registered in different platforms (web, apps, et cetera.), the data will be stored within our digital platforms until the user otherwise requests.

After this, IBERDROLA will keep the personal data, duly blocked, to be made available to the competent Public Administrations, Judges and Courts or the Public Prosecutor's Office during the period of limitation of the actions that may arise from the relationship maintained with the user and/or the legally established retention periods, for a period of 5 years.

Finally, once the above blocking periods have elapsed, IBERDROLA will proceed to physically delete the data.

b)     When processing potential customer data in promotions, communication campaigns and events

If the data originate in third-party sources, the storage period will be that established by the information supplier, which generally coincides with the terms established by the public access source used (generally one year) or for the duration of the advertising campaign.

If the data are provided by the data subject, they will be kept for sending marketing messages for two (2) years after the data in question are collected. Following this period, data will be blocked for 3 years in accordance with art. 72.1. LOPDGDD

All these periods are subject to the obligation to block this information while complying with obligations regarding the processing according to applicable law.

Finally, once the above blocking periods have elapsed, IBERDROLA will proceed to delete the data.

What is the legal basis for the processing of your data?

The legitimacy for the processing of your data are the consents obtained from the user or potential customer, that derived from the use of digital platforms, the contracting of products or services, in accordance with article 28 of Law 34/2002, of 11 July, on information society services and electronic commerce (LSSICE), the regulations applicable to the supply of electricity, gas, and similar products and services and any other that may be applicable at any given time.

Users' consents are obtained both at the time of user registration and in the different contracts or requests made on digital platforms, whilst those of potential customers are obtained in data collection forms. These consents may be modified at any time by the user/potential customer by exercising the pertinent rights. For customers with contracts in force, or if data on potential customers are obtained from public access sources, the processing may also be based on the legitimate interests of IBERDROLA regarding the energy supply offer and its own related products and services, loyalty programmes, including sports, cultural and charitable activities in which IBERDROLA participates, the drawing up of profiles in order to offer products or services similar to those contracted. In the specific case of customers, these data may also be communicated to third-party companies for the performance of administrative procedures for the purposes of customer acceptance, fraud prevention, debt claims and collection. The legitimisation for carrying out audits may be compliance with a legal obligation, when this is provided for in a regulation, or IBERDROLA's legitimate interest in ensuring compliance with IBERDROLA's internal management and governance instruments.

Legitimate interest also includes the processing of user data on digital platforms for security management and controlling access to support information systems.

If, for any specific process or request, it should be necessary for the customer to provide the personal data of persons other than the contract holder, the customer must first and expressly inform them of the content of this policy and obtain their prior consent with respect to the processing of their data.

To register as a user on IBERDROLA digital platforms and to use their services, users must be of legal age, thus precluding registration by minors. Accordingly, by registering, you thereby declare and guarantee that you are of legal age. IBERDROLA will, in all circumstances, not be held responsible for the data processing carried out on minors without the consent of their parents or guardians.

In order to be able to access certain services, you need to sign up as a registered user of the digital platform. The data for filling in the Registration Form are provided freely and voluntarily, and for this reason they must be true and reflect reality. The user undertakes to make diligent use of, and not to reveal to third parties, his or her user name and password, and to inform IBERDROLA as soon as possible of the loss or theft of same, or any risk of a third party gaining access to same.

The data that the user provides us with to arrange services or products are necessary for the maintenance of the contractual relationship. Failing or refusing to provide them would make it impossible for us to manage the relationship.

In this regard, in the event of contracting a new product and/or service by a legal entity, IBERDROLA may contact the legal representative of the latter based on the entity's legitimate interest in managing the contractual relationship.

Furthermore, in the event that the customer or potential customer participates in any draw and/or promotion organised by IBERDROLA, their participation is legitimised on the basis of the consent given at the time of participation. The personal data you provide for the management of your participation and redemption of the prize will be processed on the basis of the maintenance of the contractual relationship that binds you to IBERDROLA in accordance with the terms and conditions of participation in the draw and/or promotion.

The user is responsible for the truthfulness of the data provided and should request their amendment whenever necessary to ensure they are properly processed, the proper provision of the contracted services and efficient communication.

Who will your data be passed on to?

a)     When processing customer and user data on IBERDROLA digital platforms

In the case of contracts, the data necessary to manage access to the network will be communicated to the Distribution Company, with IBERDROLA acting as the consumer's agent in accordance with art. 3 of Royal Decree 1435/2002, of 27 December, which regulates the basic conditions of contracts for the purchase of energy and access to low-voltage networks.

These data will be incorporated into a database under their responsibility (Supply Point Information System--SIPS), to which those who may have access as determined by law at any given time may have access.

IBERDROLA in turn works with third-party service providers such as sales channels, administrative support, call centres, banks, debt collection agencies, marketing and advertising firms, auditors and others which in certain cases may access your data, with the necessary safeguards, for purposes of processing.

In the event of non-payment by the customer, IBERDROLA may report this to those responsible for asset and credit solvency files, complying with the applicable legislation. It may also release the data to the competent authorities and bodies in compliance with such legal and tax obligations as may pertain. The information relating to possible supply contracts will also be disclosed to the Spanish tax authorities for the purposes of General Taxation Act No. 58/2003 and Tax Fraud Prevention Act No. 36/2006. Also, by virtue of Royal Decree 897/2017 which, inter alia, regulates the figure of vulnerable consumers, the personal data of these customers may be communicated to the bodies in charge of the protection of vulnerable consumers for them to implement the measures contained in the Decree, and to any other government department for such purpose as may legally be determined.

For contracting through digital platforms, no automated decisions are made.

Furthermore, to meet certain purposes, the Customer’s personal data may be accessed by or communicated to other companies located in countries outside the European Union, which entails an interational data transfer to third countries.

IBERDROLA carries out these transfers, in any case, to (i) countries for which the European Commission has declared the existence of an adequate level of data protection or (ii) in the absence of such a decision, (ii) through the implementation of adequate guarantees that, following an analysis of the regulations of the destination country, ensure the protection of personal data in accordance with the requirements of the applicable regulations, such as signing with the entity receiving the data, the standard contractual clauses approved by the European Commission.

In this regard, you are informed that IBERDROLA currently has call centre services contracted with third-party providers that sometimes render their services from countries outside the European Union, particularly Colombia and Chile. Such transfers are carried out in accordance with standard contractual clauses approved by the European Commission.

In addition, an international transfer of data to the United States takes place for the validation of the SMS contract. This transfer is carried out in accordance with the adequacy decision issued by the European Commission (EC) under the EU-US Privacy Framework.

Customers may request additional information and/or a copy of the appropriate safeguards implemented by IBERDROLA by contacting the Data Protection Officer at dpo@iberdrola.es

b)     When processing potential customer data in promotions, communication campaigns and events

In the case of campaigns for products and services, the data may be accessed by third-party service providers used by IBERDROLA for the purpose of managing campaigns and sending marketing messages, and disclosed to third-party, collaborating product and service recommenders of IBERDROLA to monitor the campaign undertaken jointly by both parties.

In the case of participating in events and activities, the data can be accessed by third-party service providers or third-party collaborating or organising companies to manage and promote the event in question.

These third-party service providers include advertising and media agencies, event agencies, photographers, insurance companies, etc.

What are your rights when you provide us with your data?

Data subjects can exercise their rights of access and rectification or request that their data be deleted when they are no longer required for the purposes for which they were collected, among other reasons.

Data subjects may request restrictions on the processing of their data in the circumstances established in Article 18 of the General Data Protection Regulation, in which case they will be kept only for the exercise or defence of possible claims.

Data subjects may withdraw their consent given at any time, objecting to the processing of their data for a particular purpose without this affecting the legitimacy of the processing based on the consent prior to its withdrawal, or object to it, in which case their personal data will be kept only for the exercise or defence of possible claims.

If the user rejects marketing messages, these messages will include simple, free means to oppose the reception of further communications in the media specified. Likewise, the data subject may oppose the sending of marketing messages by exercising the right to opposition using the contact points that IBERDROLA lists below.

The data subject may contact IBERDROLA to challenge any decision that they believe may affect their rights and freedoms or legitimate interests and which is based on an automated decision, including profiling. This right allows them to challenge such decisions and obtain a direct response from IBERDROLA's data controllers.

Data subjects may ask IBERDROLA for portability of their personal data, obtaining an electronic copy of them either by emailing to the address provided or from the corresponding section of the IBERDROLA website.

All these rights may be exercised by writing to IBERDROLA CLIENTES, S.A.U. – Att. Data Protection Officer, Apartado de correos No. 1732, 28080 Madrid, Spain, or through any other IBERDROLA channel: Customer Service Phone Number 900 225 235; protecciondatos.comercial@iberdrola.es; 'My Customer Area' at www.iberdrola.es, and any of the Service Points, indicating the identification particulars, postal or e-mail address, reasons for the request and supporting documentation.

If the user does not obtain a satisfactory response, IBERDROLA hereby informs the user of their right to submit a complaint to the Spanish Data Protection Agency at Calle Jorge Juan 6, 28001 Madrid, Spain or on its website:
http://www.aepd.es

Security measures

Access to the digital platforms through which the USER of the website or App contracts products or services from IBERDROLA takes place in a secure environment. To confirm that you are at a website belonging to our Company, check that the words IBERDROLA appear in the upper status line. You can also check that you are in a secure environment by looking at the "url" shown in properties (by clicking the right mouse button). The "url" in question begins with “https", where the "s" shows that the contents are offered by a secure server.

Links

IBERDROLA's digital platforms in some cases provide links to other digital platforms or content owned by third parties. The sole purpose of such links is to provide the USER with the opportunity to glean further information from these links. IBERDROLA will not be held liable for any result that access to such links may have for USERS.

USERS and, in general, any natural person or legal entity intending to establish any technical link between its digital platform and any of the digital platforms of IBERDROLA, must first ask IBERDROLA for authorisation to do so in writing. The establishment of the link does not, under any circumstances, imply the existence of a relationship between IBERDROLA and the owner of the platform with which the link is established, nor the acceptance or approval by IBERDROLA of the content or services thereof.

Binding Corporate Rules (BCR)

Data transfers are carried out in accordance with applicable data protection laws and our Binding Corporate Rules ("BCR").

The Iberdrola Group's BCRs reflect European legislation on data protection (General Data Protection Regulation). The fact of having the BCRs implies that all the companies in our Group that sign them have to comply with the same internal rules.

You can download a copy of Iberdrola's BCR.