Who is responsible for the processing of your data?

IBERDROLA CLIENTES, S.A.U., with tax identification number A-95758389, whose registered offices are at Plaza Euskadi 5, 48009 Bilbao, is the Data Controller responsible for processing the confidential data in accordance with the provisions of the General Data Protection Regulation (GDPR) and any other legislation in force.

The data subject may contact the Data Protection Officer to resolve any queries relating to the processing of their personal data, at dpo@iberdrola.es.

Why do we process your personal data?

              a) When customer and user data is processed within IBERDROLA digital platforms

Within IBERDROLA's digital platforms, the user's personal data will be collected and processed, depending on the relationship with the user, for the following purposes:

In the case of user registrations, to provide access to and use of the digital platform and hiring information and contact information available to the user, in compliance with the obligations incumbent on Iberdrola Clientes S.A.U. as a provider of information society services.

In the case of enquiries or applications the information will be used to manage them.

Likewise, your data from browsing and cookies may be used to enhance your user access, customise and analyse your browsing habits, to show you advertisements based on your interests, including advertising spaces from third platforms (e.g. social networks, internet search engines, etc) in accordance with our Cookies policy and the privacy policies of those platforms to which these cookies give access.

Other specific purposes specified in the data collection forms on the digital platform without which IBERDROLA would not be able to process the form in question.

When ordering services or products through the digital platform, the purpose will be to manage the relationship with IBERDROLA, to provide the services requested, to provide customer service and, in general, to fulfil its Contractual obligations. IBERDROLA may also consult credit agency records to check the financial solvency of the Customer and take decisions based on these checks that may affect the Customer, including making the coming into force of the Contract or its continued validity subject to the establishment of a guarantee of payment. However, IBERDROLA will always give Customers the opportunity to make all claims they see fit in order to defend their rights and interests. In the event of non-payment, IBERDROLA may inform such credit agencies accordingly, complying with the legislation in force.

Providing the user has given their consent, IBERDROLA may update and add to the user's personal data by acquiring databases from publicly accessible sources allowing improved management of relations and contact with the user.

IBERDROLA will also process the personal data for the purpose of offering, by the means provided which includes electronic means, in segmented and personalised form, information about the supply of energy, products and services by IBERDROLA or of third parties promoted by IBERDROLA, if the user has consented to this, relating to energy, telecommunications, finance, home and entertainment. To this end, IBERDROLA may use automated support systems and other means allowing profiling of target audiences of campaigns, activities or actions to be defined, using information from IBERDROLA as well as information from third-party sources, provided that the user has consented thereto. Provided the user has given their consent, these actions in the case of customers may be carried out even after the contractual relationship with the customer has ended.

Additionally, IBERDROLA may use the user's unlinked data, always safeguarding their anonymity, even after the relationship has come to an end, so that the users of the support system may use this in their decision making and business management support systems, and to optimise customer management systems.

              b) In case of processing of personal data of potential customers in connection with offers, communication campaigns, and events

IBERDROLA may process data gathered from potential customers for different purposes according to the context of each activity. Thus:

In case of offers and prize draws, and organisation of events the purpose is that defined in the rules of the offer or prize draw, or the specific event, and their publication or dissemination and, with the data subject's consent, the data subject's name, surname, image, voice or other data necessary for the correct management and dissemination of the event or offer in the media as seen fit by IBERDROLA (intranet, newsletters, press, website, social networks), including those located in foreign countries protected by the legally required guarantees, and the sending of marketing messages and profiling messages, subject to the data subject's consent.

In case of advertising campaigns, the data gathered from public access sources based on the legitimate interests of IBERDROLA or gathered directly from the interested party or from third parties with their consent, may be used by IBERDROLA to send marketing messages in accordance with the commercial profile, relative to the supply of energy, products, services, and sports, culture and charitable actions in which Iberdrola participates. These messages may be sent through the means of contact obtained, conventional or electronic, or through third party platforms subscribed by Iberdrola and accessible by the user as social networks, internet search engines, etc.

How long will we keep your data for?

              a) When customer and user data is processed within IBERDROLA digital platforms

The personal data provided by the user for subscribing for products and services will be processed by IBERDROLA throughout the duration of the contractual relationship with the customer which will start at the moment when the Contract or Contracts are completed and will terminate, regardless of the supply period, when all reciprocal contractual obligations have been discharged and at least 3 years subsequent to their termination in compliance with the law.

With the user's consent, the data may be processed for the purpose of sending marketing messages, for a two-year period subsequent to the termination of the contracts or after withdrawal of a user who does not have current contracts with IBERDROLA.

In the case of other users registered in different platforms (web, apps, etc.), The data will be stored within our digital platforms until the user requests otherwise.

All these periods notwithstanding the obligations to retain data required by law in each case to respond to legal requests for information.

              b) In case of processing of personal data of potential customers in connection with offers, communication campaigns, and events

If the data originates in third-party sources, the storage period will be that established by the information supplier, this generally coinciding with the terms established by the public access source used (generally one year) or for the duration of the advertising campaign.

If the data originate directly from the data subject, these data shall be stored for the purposes of sending marketing messages for two years after they are gathered.

All these periods are subject to the obligation to block this information while complying with obligations regarding the processing and the applicable law.

What is the legal basis for the processing of your data?

The legal basis for processing the data derives from the consent obtained from the user, that arising from the use of digital platforms, the contracting of products or services, the legislation applicable to the supply of electricity, gas and similar products and services and any other that might be applicable to users at any given time.

The users' consents are obtained both at the time of user registration and in the different contracts or requests made on digital platforms whilst those of potential customers are obtained in data collection forms. These consents may be modified at any time by the user/potential customer by exercising the pertinent rights. For customers with contracts in force, or in case of obtaining data of potential customers from public access sources, the processing may also be based on the legitimate interests of IBERDROLA regarding the energy supply offer and its own related products and services, loyalty programmes, including sporting, cultural and charitable activities in which IBERDROLA participates, the drawing up of profiles in order to offer products or services similar to those contracted. This data may also be communicated to third-party companies for the performance of administrative procedures for the purposes of customer acceptance, fraud prevention, debt claims and collection.

Legitimate interest includes the processing of user data on digital platforms for security management and controlling access to support information systems.

If, for any specific process or request, it should be necessary for the user to provide the personal data of persons other than the contract holder, the user must first and expressly inform them of the content of this policy and obtain their prior consent with respect to the processing of their data.

In order to register as a user on IBERDROLA's digital platforms, the user must be of legal age, as it is restricted for minors, so that you declare and guarantee with your registration that you are of legal age. IBERDROLA will, in all circumstances, not be held responsible for the data processing carried out on minors without the consent of their parents or guardians.

In order to be able to access certain services, you need to sign up as a registered user of the digital platform. The data for filling in the Registration Form are provided freely and voluntarily, and for this reason they must be true and reflect reality. The user undertakes to make diligent use of, and not to reveal to third parties, his or her user name and password, and to inform IBERDROLA as soon as possible of the loss or theft of same, or any risk of a third party gaining access to same.

The data that the user provides us with to arrange services or products is necessary for the maintenance of the contractual relationship. Failing or refusing to provide it would make it impossible for us to manage the relationship.

The user is responsible for the truthfulness of the data provided and should request its amendment whenever necessary to ensure it is properly processed, the proper provision of the contracted services and efficient communication.

Who will your data be passed on to?

              a) When customer and user data is processed within IBERDROLA digital platforms

For products or services contracted, the data needed to manage access to the grid will be sent to the Distribution Company and will remain incorporated in a file under its responsibility (Supply Point Information System) accessible by such persons as may be determined by the legislation at any given time.

IBERDROLA in turn works with third-party service providers such as sales channels, administrative support, call centres, banks, debt collection agencies, marketing and advertising firms, auditors and others which in certain cases may access your data, with the necessary safeguards, for purposes of processing.

In the event of non-payment by the customer, IBERDROLA may report this to the relevant credit agencies, complying with the applicable legislation. It may also release the data to the competent authorities and bodies in compliance with such legal and tax obligations as may pertain. The information relating to possible supply contracts will also be disclosed to the Spanish tax authorities for the purposes of General Taxation Act No. 58/2003 and Tax Fraud Prevention Act No. 36/2006. Also, by virtue of Royal Decree 897/2017 which, inter alia, regulates the figure of vulnerable consumers, the personal data of these customers may be communicated to the bodies in charge of the protection of vulnerable consumers for them to implement the measures contained in the Decree, and to any other government department for such purpose as may legally be determined.

The customer's personal data may be accessed by or communicated to other companies located in countries outside the European Economic Area, which constitutes an international transfer of data to those third countries.

IBERDROLA carries out these transfers, in any case, to (i) countries for which the European Commission has declared the existence of an adequate level of data protection or (ii) in the absence of such a decision, (ii) through the implementation of adequate guarantees that, following an analysis of the regulations of the destination country, ensure the protection of personal data in accordance with the requirements of the applicable regulations, such as signing with the entity receiving the data, the standard contractual clauses approved by the European Commission.

In this regard, you are informed that IBERDROLA currently has call centre services contracted with third-party providers that sometimes render their services from countries outside the European Union.

Customers may request additional information and/or a copy of the appropriate safeguards implemented by IBERDROLA by contacting the Data Protection Officer at dpo@iberdrola.es

              b) In case of personal data of potential customers in connection with offers, communication campaigns, and events

In the case of campaigns for products and services, the data may be accessed by third party service providers used by IBERDROLA for the purpose of managing campaigns and sending marketing messages, and disclosed to third-party-collaborating product and service recommenders of IBERDROLA to monitor the campaign undertaken jointly by both parties.

In the case of participating in events and activities, the data may be accessed by third-party service providers or third collaborating companies or organisations in order to manage and promote the activity.

These third-party service providers include advertising and media agencies, event agencies, photographers, insurance companies, etc.

What are your rights when you provide us with your data?

Users can exercise their rights of access and rectification or request that their data be deleted when it is no longer required for the purposes for which it was collected, among other reasons.

Users may request restrictions on the processing of their data in the circumstances established in Article 18 of the General Data Protection Regulation, in which case they will be kept only for the exercise or defence of possible claims.

Users may withdraw their consent given at any time, objecting to the processing of their data for a particular purpose without this affecting the legitimacy of the processing based on the consent prior to its withdrawal, or object to it, in which case their personal data will be kept only for the exercise or defence of possible claims. If the user rejects marketing messages, these messages will include simple, free means to receive further communications in the media specified. Likewise, the data subject may oppose the sending of marketing messages by exercising the right to opposition using the contact points that IBERDROLA lists below.

The user may contact IBERDROLA to challenge any decision that the user believes may affect their rights and freedoms or legitimate interests and which is based on an automated decision, including profiling. This right allows the Customer to challenge such decisions and obtain a direct response from the IBERDROLA controllers.

Users may ask IBERDROLA for portability of their personal data, obtaining an electronic copy of them either by emailing to the address provided or from the corresponding section of the IBERDROLA website.

All these rights may be exercised by writing to IBERDROLA CLIENTES, S.A.U. - Att. Responsable Protección de Datos, Apartado de correos nº 1732, 28080 Madrid, Spain, or through any of the IBERDROLA channels: Customer Service telephone number +34 900 225 235, email: protecciondatos.comercial@iberdrola.es; 'My Customer Area' in www.iberdrola.es, and any of the Service Points, indicating the identification particulars, postal or e-mail address, reasons for the request and supporting documentation including proof of identity.

In the event that the user does not obtain a satisfactory response, IBERDROLA hereby informs the customer of their right to submit a complaint to the Spanish Data Protection Agency, Calle Jorge Juan 6, 28001 Madrid, Spain or through its website:
http://www.aepd.es

Security measures

Access to the digital platforms through which the USER of the website or App contracts products or services from IBERDROLA takes place in a secure environment. To confirm that you are at a website belonging to our Company, check that the words IBERDROLA appear in the upper status line. You can also check that you are in a secure environment by looking at the "url" address shown in properties (by clicking the right mouse button). The "url" address in question begins with "https", where the "s" shows that the contents are offered by a secure server.

Links

IBERDROLA's digital platforms in some cases provide links to other digital platforms or content owned by third parties. The sole purpose of such links is to provide the USER with the opportunity to glean further information from these links. IBERDROLA will not be held liable for any result that access to such links may have for USERS.

USERS and, in general, any natural person or legal entity intending to establish any technical link between its digital platform and any of the digital platforms of IBERDROLA, must first ask IBERDROLA for authorisation to do so in writing. The establishment of the link does not, under any circumstances, imply the existence of a relationship between IBERDROLA and the owner of the platform with which the link is established, nor the acceptance or approval by IBERDROLA of the content or services thereof.

Binding Corporate Rules (BCR)

Data transfers are carried out in accordance with applicable data protection laws and our Binding Corporate Rules ("BCR").

The Iberdrola Group's BCRs reflect European legislation on data protection (General Data Protection Regulation). The fact of having the BCRs implies that all the companies in our Group that sign them have to comply with the same internal rules.

You can download a copy of Iberdrola's BCR.