Iberdrola Clientes SAU Privacy Policy

HOW WILL YOUR PERSONAL DATA BE PROCESSED?

Who is responsible for the processing of your data?

IBERDROLA CLIENTES, S.A.U., with tax identification number A-95758389, whose registered offices is at Plaza Euskadi 5, 48009 Bilbao, is the party responsible for processing the data provided by the Customer. It hereby guarantees its security and confidential processing in accordance with the provisions of the General Data Protection Regulations, and any other laws which may be applicable.

The user can contact the Data Protection Officer to resolve any queries relating to the processing of their personal data, at dpo@iberdrola.es.

Why do we process your personal data?

Within IBERDROLA's digital platforms, the user's personal data will be collected and processed, depending on the relationship with the user, for the following purposes:

In the case of user registrations, to provide access to the digital platform and to the contracting data and contact information available to the user, as well as for access to and use of the digital platform and compliance with the legal obligations of Iberdrola Clientes S.A.U. as a provider of information society services.

The information will also be used to manage enquiries or applications made.

Users' browsing data and cookies may also be processed to enhance their user experience and access, customising and analysing their browsing, as well as to display advertising and ads based on their interests in accordance with our Cookies policy and must be accepted as a step prior to browsing on our digital platform.

Other specific purposes indicated in the data collection forms on the digital platform and without which Iberdrola will not be able to process the form in question.

For arranging services or products through the digital platform, the Customer's personal data will be processed for the purpose of managing relations with IBERDROLA, providing the services requested, handling customer service and in general fulfilling the obligations under the Contract. IBERDROLA may also consult credit agency records to check the financial solvency of the Customer and take decisions based on these checks that may affect the Customer, including making the coming into force of the Contract or its continued validity subject to the establishment of a guarantee of payment. However, IBERDROLA will always give the Customer the opportunity to state any arguments they think fit to defend their rights and interests. In the event of non-payment, IBERDROLA may inform such credit agencies accordingly, complying with the legislation in force.

Providing the user has given their consent, IBERDROLA may update and add to the user's personal data by acquiring databases from publicly accessible sources allowing improved management of relations and contact with the user.

IBERDROLA will also process the personal data for the purpose of offering, by the means provided and including electronic means, in segmented and personalised form, information about the supply of energy, products and services of IBERDROLA or of third parties promoted by IBERDROLA, if the Customer has consented to this, relating to energy, telecommunications, finance, home and entertainment. To this end, IBERDROLA may use automated support systems and other means allowing profiles of target audiences of campaigns, activities or actions to be defined, using information from IBERDROLA as well as information from third-party sources if the user has consented thereto. Provided the user has given their consent, these actions in the case of customers may be carried out even after the contractual relationship with the customer has ended.

Additionally, IBERDROLA may use the user's unlinked data, always safeguarding their anonymity, even after the relationship has come to an end, in its decision making and business management support systems.

How long will we keep your data for?

The personal data provided by the user for the contracting of products and services will be processed by IBERDROLA for the period during which the contractual relationship remains in force. This will start when the Contract is signed and end, irrespective of the supply period, once all the contractual obligations, such as dealing with the customer's requests for information, complaints and reviewing of invoices, have been fulfilled, without prejudice to the obligations of data blockage and/or data retention as may derive from applicable legislation in each case.

If the user has given their consent, their data may be processed after the end of the Contract or after the deregistration of the user who does not have valid contracts, for a period of 2 years, without prejudice to the data retention obligations required by the applicable legislation in each case to meet the responsibilities arising from the processing.

For all other users, the data retention period will be 2 years from the collection of the data without prejudice to the obligations of data blocking and/or data retention resulting from the applicable regulations in each case.

Under what authority may Iberdrola process your data?

The authority to process your data derives from the consent obtained from the user, that arising from the use of digital platforms, the contracting of products or services, the legislation applicable to the supply of electricity, gas and similar products and services and any other that might be applicable to users at any given time.

The users' consents are obtained both at the time of user registration and in the different contracts or requests made on the digital platform and may be amended at any time by the user through the exercise of their rights. For customers with contracts in force, the processing may also be based on the legitimate interests of IBERDROLA regarding the supply of energy and its own related products and services, loyalty programmes, including sporting, cultural and charitable activities in which IBERDROLA participates, the drawing up of profiles in order to offer products or services similar to those contracted. This data may also be communicated to third-party companies for the performance of administrative procedures for the purposes of customer acceptance, fraud prevention, debt claims and collection.

Legitimate interest includes the processing of user data for security management and controlling access to support information systems.

If, for any specific process or request, it should be necessary for the user to provide the personal data of persons other than the contract holder, the user must first and expressly inform them of the content of this policy and obtain their prior consent with respect to the processing of their data.

In order to register as a user on IBERDROLA's digital platforms, the user must be of legal age, as it is restricted for minors, so that you declare and guarantee with your registration that you are of legal age. IBERDROLA will, in all circumstances, not be held responsible for the data processing carried out on minors without the consent of their parents or guardians.

Who will your data be passed on to?

For products or services contracted, the data needed to manage access to the grid will be sent to the Distribution Company and will remain incorporated in a file under its responsibility (Supply Point Information System) accessible by such persons as may be determined by the legislation at any given time.

IBERDROLA in turn works with third-party service providers such as sales channels, administrative support, call centres, banks, debt collection agencies, marketing and advertising firms, auditors and others which in certain cases may access your data, with the necessary safeguards, for purposes of processing.

In the event of non-payment by the customer, IBERDROLA may report this to the relevant credit agencies, complying with the applicable legislation. It may also release the data to the competent authorities and bodies in compliance with such legal and tax obligations as may pertain. The information relating to possible supply contracts will also be disclosed to the Spanish tax authorities for the purposes of General Taxation Act No. 58/2003 and Tax Fraud Prevention Act No. 36/2006. Also, by virtue of Royal Decree 897/2017 which, inter alia, regulates the figure of vulnerable consumers, the personal data of these customers may be communicated to the bodies in charge of the protection of vulnerable consumers for them to implement the measures contained in the Decree, and to any other government department for such purpose as may legally be determined.

The user's personal data may be accessed by or communicated to other companies located in countries outside the European Union. In this regard you are informed that IBERDROLA currently has call centre services contracted with third-party providers that sometimes provide their services from countries outside the European Union. Such access is considered an international transfer of data and is covered by authorisations TI-00114-2010 and TI-00166-2009 of the Spanish Data Protection Agency in light of the guarantees provided by said service providers.

Users may contact IBERDROLA through its social media platforms, such as Facebook or Twitter, located in the United States. The data transfers are covered by the EU-US Privacy Shield agreement (information available at https://www.privacyshield.gov/welcome) or the explicit consent of the data subject where applicable.

What are your rights when you provide us with your data?

In order to be able to access certain services, you need to sign up as a registered user of the digital platform. The data for filling in the Registration Form are provided freely and voluntarily, and for this reason they must be true and reflect reality. The user undertakes to make diligent use of, and not to reveal to third parties, his or her user name and password, and to inform IBERDROLA as soon as possible of the loss or theft of same, or any risk of a third party gaining access to same.

The data that the user provides us with to arrange services or products is necessary for the maintenance of the contractual relationship. Failing or refusing to provide it would make it impossible for us to manage the relationship.

The user is responsible for the truthfulness of the data provided and should request its amendment whenever necessary to ensure they are properly processed, the proper provision of the contracted services and efficient communication.

The user can exercise their rights of access and rectification or request that their data be deleted when it is no longer required for the purposes for which it was collected, among other reasons.

The user may request restrictions on the processing of their data in the circumstances established in Article 18 of the General Data Protection Regulations, in which case they will be kept only for the exercise or defence of possible claims.

The user may withdraw the consent given at any time, objecting to the processing of their data for a particular purpose, without this affecting the legitimacy of the processing based on the consent prior to its withdrawal, or object to it, in which case their personal data will be kept only for the exercise or defence of possible claims.

The user may contact IBERDROLA to challenge any decision that the user believes may affect their rights and freedoms or legitimate interests and which is based on an automated decision, including profiling. This right allows the user to challenge such decisions and obtain a direct response from the IBERDROLA controllers.

The user may ask IBERDROLA for portability of their personal data, obtaining an electronic copy of them either by emailing the address provided or from the corresponding section of the IBERDROLA website.

All these rights may be exercised by writing to IBERDROLA CLIENTES, S.A.U. - Att. Responsable Protección de Datos, Apartado de correos nº 1732, 28080 Madrid, Spain, or through any of the IBERDROLA channels: Customer Service telephone number +34 900 225 235, email: protecciondatos.comercial@iberdrola.es; 'My Customer Area' in www.iberdrola.es, and any of the Service Points, indicating the identification particulars, postal or e-mail address, reasons for the request and supporting documentation including proof of identity.

In the event that the user does not obtain a satisfactory response, IBERDROLA hereby informs the customer of their right to submit a complaint to the Spanish Data Protection Agency, Calle Jorge Juan 6, 28001 Madrid, Spain or through its website:

http://www.agpd.es/portalwebAGPD/CanalDelCiudadano

Security measures

Access to the digital platforms through which the USER of the website or App contracts products or services from IBERDROLA takes place in a secure environment. To confirm that you are at a website belonging to our Company, check that the words IBERDROLA appear in the upper status line. You can ensure that you are in a secure environment by looking at the URL address shown in properties (by clicking the right mouse button). The URL address in question begins with "https", where the "s" shows that the contents are offered by a secure server.

Links

IBERDROLA's digital platforms in some cases provide links to other digital platforms or content owned by third parties. The sole purpose of such links is to provide the USER with the opportunity to glean further information from these links. IBERDROLA will not be held liable for any result that access to such links may have for USERS.

USERS and, in general, any natural person or legal entity intending to establish any technical link between its digital platform and any of the digital platforms of IBERDROLA, must first ask IBERDROLA for authorisation to do so in writing. The establishment of the link does not, under any circumstance, imply the existence of a relationship between IBERDROLA and the owner of the platform with which the link is established, nor the acceptance or approval by IBERDROLA of the content or services thereof.