Privacy policy
Iberdrola, S.A. (“Iberdrola”) is committed to protecting your privacy and complying with applicable data protection legislation (“applicable data protection legislation”), in particular, the General Data Protection Regulation (“GDPR”) and the Organic Law on Data Protection and Guarantee of Digital Rights (“LOPDGDD”). Your personal data will be processed lawfully, fairly and transparently, in accordance with specific purposes and only if the processing is adequate, relevant and limited to what is necessary in relation to those legitimate purposes. In addition, we will keep your data up to date and process it in a way that allows you to be identified only for as long as is necessary to fulfil the purposes of the processing, in accordance with applicable legislation.
Iberdrola has implemented the necessary technical and organisational measures to protect your data from accidental loss or alteration, unauthorised access, use or disclosure, and has established procedures to respond to any security incident that may affect your personal data.
Through this privacy notice ("Notice" or "Privacy Notice") we inform you about the processing of your personal data while you browse our website ("Website" or "Web") and use the features available on it.
Notwithstanding the foregoing, certain processing of personal data may be subject to other specific privacy notices, some of which are indicated in this Notice.
You should read this Notice and, where applicable, any updates to it, to understand how Iberdrola processes your personal data. Iberdrola may make changes to the Notice, in which case we will notify you when necessary.
In any case, you are solely responsible for the information you provide on the Website and if, in the future, Iberdrola wishes to use it for purposes other than those referred to, it will inform you of these new purposes and request your consent, if necessary.
By using our Website, you acknowledge that you have read and accept this Notice.
1. Who is responsible for processing your personal data?
The data controller is Iberdrola, S.A., with registered office in Bilbao (Bizkaia), Plaza Euskadi number 5, registered in the Mercantile Registry of Bizkaia, volume 17 of the Companies Book, folio 114, page 901 (now BI-167-A), 1st entry, and with Tax Identification Number A-48010615.
We inform you that Iberdrola has appointed the following Data Protection Officer, whom you may contact in relation to any matter concerning this Privacy Notice: dpo@iberdrola.com.
2. What personal data do we process?
Iberdrola may process the following personal data:
Data about your browsing on the Website.
3. How do we obtain your personal data?
Iberdrola obtains the data directly from you when you browse the website and use its features.
4. For what purposes do we process your personal data and on what legal basis?
Iberdrola informs you that your personal data will be processed for the following purposes:
To enable browsing of the website and maintain its activity and security. Iberdrola processes your browsing data based on its legitimate interest in ensuring access to the website and maintaining its security against possible incidents and security breaches.
5. How long do we process your personal data?
Your personal data processed for the purpose i) above will be processed while you browse the website.
Notwithstanding the foregoing, when the processing of your data is based on Iberdrola's legitimate interest and you exercise your right to object to it, your personal data will no longer be processed, unless there are compelling legitimate grounds for the processing that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. For its part, if the processing of your data is based on your consent, your personal data will no longer be processed when you request its withdrawal, without this affecting the lawfulness of the processing based on the consent prior to its withdrawal.
Once the periods mentioned in the previous paragraphs have elapsed, Iberdrola will retain the data, duly blocked where applicable, for the period permitted or required by applicable law and until the expiry of the limitation periods for (i) any legal obligations to which Iberdrola may be subject and (ii) any legal liabilities arising from the relationship established with the data subjects and the subsequent processing of their personal data.
The deletion of personal data will be carried out in such a way as to protect the privacy of such information and in accordance with our internal procedures and applicable legislation.
6. Who do we share your personal data with?
Your data may be communicated to other entities of the Iberdrola Group when necessary to carry out the purposes indicated: (i) for internal administration purposes; (ii) in compliance with legal obligations; or (iii) to comply with requirements from regulatory, judicial or other authorities.
The Iberdrola Group entities are those listed on the corporate website: https://www.iberdrola.com/documents/20125/42388/IB_Annual_Financial_Information.pdf.
In addition, the data may be processed by internal and/or external service providers and/or collaborators, such as IT services, tools and/or applications, web services and other third parties whose involvement may be required to carry out the purposes indicated in this Notice, who will be configured as data processors for Iberdrola and with whom Iberdrola has established a contractual relationship for this purpose.
In this context, we inform you that the aforementioned communications and processing orders may involve the transfer of personal data to third countries. In this regard, when Iberdrola carries out these transfers, it does so (i) to countries for which the European Commission has declared an adequate level of data protection; (ii) in the absence of such a decision, by implementing adequate safeguards which, following analysis of the regulations of the destination country, ensure the protection of your personal data in accordance with the requirements of the applicable regulations, such as the Iberdrola Group's Binding Corporate Rules (BCR) or the standard contractual clauses approved by the European Commission; and (iii) when it is not possible to rely on any of the above cases and the transfer is of a one-off nature, in accordance with the exceptions provided for in Article 49 of the GDPR.
For clarification purposes, the BCRs apply to certain processing operations carried out by Iberdrola Group companies located outside the European Economic Area (EEA) or the United Kingdom involving personal data originating from Group companies located within the EEA or the United Kingdom. The existence of the BCRs means that all entities within our Group that subscribe to them must comply with the same data protection rules when processing personal data transferred from the EEA or the United Kingdom. It also means that, where applicable, your rights remain the same, regardless of where Iberdrola processes your data. You can view and download a copy of the Iberdrola Group's BCRs at https://www.iberdrola.com/privacy-policy/binding-corporate-rules.
You may contact Iberdrola at any time to request additional information and/or a copy of the specific appropriate safeguards adopted by contacting the Data Protection Officer at dpo@iberdrola.com.
7. What are your data protection rights?
You may exercise any of the following rights free of charge:
- Right of access.
- Right of rectification.
- Right of erasure (right to be forgotten).
- Right to restriction of processing.
- Right to object.
- Right to portability.
- Right not to be subject to decisions based solely on the automated processing of your personal data, including profiling. Iberdrola informs you that it does not carry out automated decision-making processes, including profiling, unless you have explicitly authorised us to do so. In that case, we would inform you about the logic used in the decision, as well as the significance and expected consequences of such processing for you.
- Right to withdraw your consent when it has been provided for any purpose. We inform you that the withdrawal of consent will not affect the lawfulness of processing based on consent prior to its withdrawal.
You may exercise your rights through the channels indicated below:
If you are not satisfied with the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es or with any other competent supervisory authority.