PRIVACY POLICY

Acciona Energía, in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and other regulations in force on matters relating to Data Protection, makes available the Privacy Policy, which will apply to the processing of personal data, to all those who (hereinafter, "Users"), through their interaction with us, provide personal information via this website (hereinafter, the Website), or its corresponding mobile application (hereinafter, the APP).

Personal data may only be obtained for processing when such data are adequate, relevant and not excessive in relation to the scope and specific, explicit and legitimate purposes for which they have been obtained. Users expressly consent to Acciona Energía processing the personal data provided by them for the purposes expressed in this Privacy Policy.

The data controller adopts the technical and organisational measures necessary to guarantee the security of personal data and to prevent the alteration, loss or unauthorised processing of or access to such data, taking into account the state of the art, the nature of the data and the risks to which the data are exposed. You may also confirm the presence of the SSL certificate by checking the Website's properties in your browser. A connection will be secure when "https://" appears in the browser's address bar instead of "http://" and a padlock symbol is displayed. You can look up more features of the SSL certificate in the Legal Notice section.

Who is the data controller responsible for processing the personal data?

Company name: CORPORACIÓN ACCIONA ENERGÍAS RENOVABLES S.A.

Tax ID: A85483311

Address: Avenida de la Gran Vía de Hortaleza, 1, 28033, Madrid.

Telephone: +34 91 790 77 00

Contact e-mail address: ComprasAdministracionAEGU@acciona.com

What personal data do we collect through our Website?

Personal data are considered to be data that identify persons or that may be used to identify them. Channels through which we can collect personal data:

Website. Sometimes personal data is obtained from the User when they visit our website. This website, in addition to using necessary cookies, will use its own and third-party analytical cookies to learn how our website is used; to evaluate and improve its operation; analyse traffic; personalise content and advertisements; or offer social media functions, only if the User configures it this way and depending on the selection the User makes (see our Cookies Policy).

When you submit a request through our site, we may process the following categories of data:

  • Identification and contact data.

Other channels. Personal data may also be receive from Users when they contact the User Service Centre (USC), either by email or by phone, when they request information from us, send requests or complaints, report incidents, etc.

In any event, Users are solely responsible for the veracity and lawfulness of the personal data provided.

For what purpose and in what lawful capacity do we process Users' personal data?

This Website is made available to Users with the purpose of providing the required dissemination of the contractor profile, in order to ensure transparency and public access to the information related to the contractual activity, in accordance with the applicable regulations.

  • Participation in tenders published through our website. In these cases, the processing of data is necessary for the implementation of pre-contractual measures, this being the basis of legitimacy.

  • Support for suppliers. If you contact us through Supplier Support, either by e-mail or by telephone, we will process your data in order to attend to and, process your request for information, incident, query, complaint, suggestion and/or enquiries received through the Suppliers Service Centre. In these cases, the processing of your data is based on consent or is necessary for the application of pre-contractual measures; these being the bases of legitimacy.

  • Compliance with legal obligation. This purpose of the treatment, in compliance with legal obligations of a commercial, tax, accounting or administrative nature may entail the communication of data to competent public bodies and authorities, as long as they are required.

    In these cases, the treatment is necessary for the fulfilment of a legal obligation applicable to the Controller for the treatment; this is the basis of legitimation.

  • Fraud Prevention. Protect, detect and prevent fraud and other illegal activities, unauthorised transactions, claims or incidents, manage the quality and risks associated with the business. Also to investigate incidents, illegal activities and potential violations of our terms of service and policies.

In these cases, the treatment is necessary for the fulfilment of a legal obligation applicable to the person responsible for the treatment; this is the basis of legitimation.

For how long does the Controller keep Users' personal data?

In general, the data will be kept i) for as long as is necessary for the purpose for which the data were collected and ii) during the applicable limitation periods, if liabilities might be incurred as the result of the processing.

Specifically,

  • The data collected for the purpose of responding to requests or enquiries, will be kept for the time necessary to be able to attend to the same.
  • The data collected based on your consent will be kept for as long as such consent is not withdrawn.

To whom may the Controller provide Users' data?

We are committed to not transferring or disclosing the personal information of our Users, except as provided in this Privacy Policy or, where appropriate, as informed at the time of data collection. When it is necessary

The following types of data communication may be expected, when necessary:

  • We may disclose your personal information (i) if we are permitted or required to do so by law or legal process (such as a court order or subpoena); (ii) to law enforcement authorities or other public officials to comply with a lawful and legitimate request; (iii) when we believe it is necessary to prevent physical harm or financial loss; (iv) to establish, exercise or defend our legal rights; (v) in connection with an investigation of suspected or actual fraud or illegal activity; or (vi) with your express and informed consent.
  • We may communicate personal information to different service providers, who are in some cases hired to perform services on our behalf. In these cases, the corresponding data processor agreements are signed whenever necessary, as established by the regulations on matters relating to data protection.

    Likewise, we would inform you that some of these service providers, third parties or Group companies may be located in territories outside the European Economic Area that do not provide a level of data protection comparable to that of the European Union. In such cases we transfer Users' data with appropriate safeguards, maintaining at all times the security of such data; these may include via the formulation of Standard Contractual Clauses approved by the Commission, the content of which may be examined by clicking on the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en.
  • Outside of these cases, personal data would only be sent, in compliance with legal obligations, to State Security Forces, Courts and Tribunals or administrations in the exercise of their administrative powers and legal authority.

What rights do Users have when they provide us with their personal data?

Data subjects may exercise their rights of access, rectification, erasure, portability and restriction or objection by writing to the Data Protection Department of the Controller at Avenida de la Gran Vía de Hortaleza, 1, 28033, Madrid, or by sending an email to the following email address: protecciondedatosenergia@acciona.com. When necessary, to be able to identify you, we may request that you provide a copy of your national ID or other identification document.

Likewise, you may at any time, withdraw the consent given by writing to the address indicated above, and by complaining to the Supervisory Authority (Spanish Data Protection Agency www.aepd.es)

Additional information

We have provided you below with a series of links where you can obtain additional information that might be of use to you, in relation to any other processing of personal data,

Validity

Any change made to the Privacy Policy and to information management practices will be reflected in a timely manner, with the Data Controller being permitted to add, modify or remove the said Privacy Policy whenever it deems this necessary.

This Privacy Policy is published in Spanish, and English; in the case of discrepancy between both versions, the Spanish version will prevail.

Last updated on November 30, 2021