Who is responsible for the processing of your data?

CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U, with TAX ID NO. A-95554630 and with registered address at Plaza Euskadi 5, 48009 in Bilbao (Spain), is the data controller for the data provided by the Customer and hereby guarantees the security and confidential processing thereof in accordance with the provisions of the General Data Protection Regulation (“GDPR”), and any other applicable regulation.

The user can contact the Data Protection Officer to resolve any queries relating to the processing of their personal data, through dpo@iberdrola.es.

Why do we process your personal data?

When customer and user data is processed within CURENERGÍA digital platforms.

Within CURENERGÍA's digital platforms, the user's personal data will be collected and processed, depending on the relationship with the user, for the following purposes:

• In the case of user registrations, to provide access to the digital platform and to the contracting data and contact information available for that user, as well as for access to and use of the digital platform and compliance with the legal obligations of CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U as a provider of information society services.

• The information is also used to manage enquiries or applications made.

• Likewise, your data from browsing and cookies may be used, in accordance with the consent given, to enhance your user access, customise and analyse your browsing habits, to show you advertisements based on your interests, including advertising spaces from third platforms (e.g. social networks, internet search engines, etc) in accordance with our cookies policy and the privacy policies of those platforms to which these cookies give access.
  In this same regard, CURENERGÍA may include additional functionalities within apps to collect usage and navigation data from its users for purposes of improving and customising them, as well as require the activation of other mobile resources (GPS, access to files or others) in order to display and share information of interest to users, its delivery by them and other services of the mobile terminal. In all these cases, the app will include specific information on such additional functionalities within its specific conditions of use and download, as well as in the requests for specific consents and permissions for the activation of such functionalities by the user.

• Other specific purposes specified in the data collection forms on the digital platform and without which CURENERGÍA would not be able to process the form in question.

• When signing up for services or products through the digital platforms, including WhatsApp, we inform you that the purpose will be to manage the relationship with CURENERGÍA, to provide the services requested, to provide customer service and, in general, to fulfil its contractual obligations. This includes the possibility of sending by electronic means a validation message, as well as sending you informative messages strictly in connection with the contractual relationship (for example, information about bills, selecting electricity plans, tariffs, incidents, information about customer services channels, etc.) and for processing all types of claims, complaints or requests regarding the contractual relationship and, if appropriate, taking such action as may be necessary to recover and collect payment of debts you may owe to CURENERGÍA, including updating the data provided by the debtor.

• Providing the user has given their consent, CURENERGÍA may update and add to user's personal data by acquiring databases from publicly accessible sources to allow improved management of relations and contact with the user.

• CURENERGÍA will also process personal data for the purpose of offering, by the means provided and including electronic means, in a segmented and personalised manner, information about the supply of energy, products and services of CURENERGÍA or of third parties promoted by CURENERGÍA, if it has been consented to, relating to energy, telecommunications, finance, home and entertainment. To this end, CURENERGÍA may use automated support systems and other means that allow profiling target audiences for campaigns, activities or actions, using information from CURENERGÍA as well as information from third-party sources if the user has consented thereto. Provided the users have given their consent, these actions in the case of customers may be carried out even after the contractual relationship with the customer has ended.

• Similarly, IBERDROLA may process the customer's personal data to carry out auditing processes for the purpose of supervising compliance with the regulations to which it is subject; the regulations, internal operating protocols or the corporate governance model.

• Additionally, CURENERGÍA may use the user’s unlinked data, always safeguarding their anonymity, even after the relationship has come to an end, so that the users of the support systems may use this in their decision-making and business management support systems, and to optimise customer management systems.

How long will we keep your data for?

a)     When customer and user data is processed within CURENERGÍA digital platforms

The personal data provided by the user when subscribing to products and services will be processed by CURENERGÍA throughout the duration of the contractual relationship with the customer, which will start at the moment when the Contract or Contracts are completed and will terminate, regardless of the supply period, when all reciprocal contractual obligations have been discharged and at least 3 years subsequent to their termination in compliance with the law.

Purpose 15: personal data will be processed, as a minimum, until the end of the financial year in which the audit takes place and, where appropriate, afterwards, insofar as is required to meet Iberdrola's legal obligations.

With the user’s consent, the data may be processed for the purpose of sending marketing messages, for a two-year period subsequent to the termination of the contracts or after the withdrawal of a user who does not have current contracts with CURENERGÍA.

In addition, personal data processed for sending commercial communications based on CURENERGÍAs legitimate interest will be kept for as long as the contractual relationship with the customer remains in force or the customer does not object to such processing.

In the case of other users registered in different platforms (web, apps, et cetera.), the data will be stored within our digital platforms until the user otherwise requests.

After this, CURENERGÍA will keep the personal data, duly blocked, to be made available to the competent Public Administrations, Judges and Courts or the Public Prosecutor's Office during the period of limitation of the actions that may arise from the relationship maintained with the user and/or the legally established retention periods, for a period of 5 years.

Finally, once the above blocking periods have elapsed, CURENERGÍA will proceed to physically delete the data.

What is the legal basis for the processing of your data?

The legitimacy for the processing of your data are the consents obtained from the user or potential customer, that derived from the use of digital platforms, the contracting of products or services, in accordance with article 28 of Law 34/2002, of 11 July, on information society services and electronic commerce (LSSICE), the regulations applicable to the supply of electricity, gas, and similar products and services and any other that may be applicable at any given time.

Users' consents are obtained both at the time of user registration and in the different contracts or requests made on digital platforms, whilst those of potential customers are obtained in data collection forms. These consents may be modified at any time by the user/potential customer by exercising the pertinent rights. For customers with contracts in force, or if data on potential customers are obtained from public access sources, the processing may also be based on the legitimate interests of CURENERGÍA regarding the energy supply offer and its own related products and services, loyalty programmes, including sports, cultural and charitable activities in which CURENERGÍA participates, the drawing up of profiles in order to offer products or services similar to those contracted. In the specific case of customers, these data may also be communicated to third-party companies for the performance of administrative procedures for the purposes of customer acceptance, fraud prevention, debt claims and collection.The legitimisation for carrying out audits may be compliance with a legal obligation, when this is provided for in a regulation, or IBERDROLA's legitimate interest in ensuring compliance with IBERDROLA's internal management and governance instruments.

Legitimate interest also includes the processing of user data on digital platforms for security management and controlling access to support information systems.

If, for any specific process or request, it should be necessary for the customer to provide the personal data of persons other than the contract holder, the customer must first and expressly inform them of the content of this policy and obtain their prior consent with respect to the processing of their data.

To register as a user on CURENERGÍA digital platforms and to use their services, users must be of legal age, thus precluding registration by minors. Accordingly, by registering, you thereby declare and guarantee that you are of legal age. CURENERGÍA will in no circumstances be held responsible for data processing carried out on minors without the consent of their parents or guardians.

In order to be able to access certain services, you need to sign up as a registered user of the digital platform. The data for filling in the Registration Form are provided freely and voluntarily, and for this reason they must be true and reflect reality. The user undertakes to make diligent use of, and not to reveal to third parties, his or her user name and password, and to inform CURENERGÍA as soon as possible of the loss or theft of same, or any risk of a third party gaining access to same.

The data that the user provides us with to arrange services or products are necessary for the maintenance of the contractual relationship. Failing or refusing to provide them would make it impossible for us to manage the relationship.

In this regard, in the event of contracting a new product and/or service by a legal entity, CURENERGÍA may contact the legal representative of the latter based on the entity's legitimate interest in managing the contractual relationship.

The user is responsible for the truthfulness of the data provided and should request their amendment whenever necessary to ensure they are properly processed, the proper provision of the contracted services and efficient communication.

Who will your data be passed on to?

a)     When customer and user data is processed within CURENERGÍA digital platforms

In the case of contracts, the data necessary to manage access to the network will be communicated to the Distribution Company, with CURENERGÍA acting as the consumer's agent in accordance with art. 3 of Royal Decree 1435/2002, of 27 December, which regulates the basic conditions of contracts for the purchase of energy and access to low-voltage networks.

These data will be incorporated into a database under their responsibility (Supply Point Information System--SIPS), to which those who may have access as determined by law at any given time may have access.

CURENERGÍA in turn works with third-party service providers such as sales channels, administrative support, call centres, banks, debt collection agencies, marketing and advertising firms, auditors and others which in certain cases may access your data, with the necessary safeguards, to achieve the objectives of the processing.

In the event of non-payment by the customer, CURENERGÍA may report this to those responsible for asset and credit solvency files, complying with the applicable legislation. It may also release the data to the competent authorities and bodies in compliance with such legal and tax obligations as may pertain. The information relating to possible supply contracts will also be disclosed to the Spanish tax authorities for the purposes of General Taxation Act No. 58/2003 and Tax Fraud Prevention Act No. 36/2006. Also, by virtue of Royal Decree 897/2017 which, inter alia, regulates the figure of vulnerable consumers, the personal data of these customers may be communicated to the bodies in charge of the protection of vulnerable consumers for them to implement the measures contained in the Decree, and to any other government department for such purpose as may legally be determined.

For contracting through digital platforms, no automated decisions are made.

Furthermore, to meet certain purposes, the Customer’s personal data may be accessed by or communicated to other companies located in countries outside the European Union, which entails an interational data transfer to third countries.

CURENERGÍA carries out these transfers, in any case, to (i) countries for which the European Commission has declared the existence of an adequate level of data protection or (ii) in the absence of such a decision, (ii) by implementing appropriate guarantees that, following an analysis of the regulations of the destination country, ensure the protection of your personal data in accordance with the requirements of the applicable regulations, such as signing with the entity receiving the data, the standard contractual clauses approved by the European Commission.

In this regard you are informed that CURENERGÍA currently has call centre services contracted with third-party providers that sometimes provide their services from countries outside the European Union, particularly Colombia and Chile. Such transfers are carried out in accordance with standard contractual clauses approved by the European Commission.

In addition, an international transfer of data to the United States takes place for the validation of the SMS contract. This transfer is carried out in accordance with the adequacy decision issued by the European Commission (EC) under the EU-US Privacy Framework.

Customers may request additional information and/or a copy of the appropriate safeguards implemented by CURENERGIA by contacting the Data Protection Officer at dpo@iberdrola.es

What are your rights when you provide us with your data?

Data subjects can exercise their rights of access and rectification or request that their data be deleted when they are no longer required for the purposes for which they were collected, among other reasons.

Data subjects may request restrictions on the processing of their data in the circumstances established in Article 18 of the General Data Protection Regulation, in which case they will be kept only for the exercise or defence of possible claims.

Data subjects may withdraw their consent given at any time, objecting to the processing of their data for a particular purpose without this affecting the legitimacy of the processing based on the consent prior to its withdrawal, or object to it, in which case their personal data will be kept only for the exercise or defence of possible claims.

If the user rejects marketing messages, these messages will include simple, free means to oppose the reception of further communications in the media specified. Likewise, the data subject may oppose the sending of marketing messages by exercising the right to opposition using the contact points that CURENERGÍA lists below.

The data subject may contact CURENERGÍA to challenge any decision that they believe may affect their rights and freedoms or legitimate interests and which is based on an automated decision, including profiling. This right allows the user to challenge such decisions and obtain a direct response from the CURENERGÍA controllers.

The data subject may ask CURENERGÍA for portability of their personal data, obtaining an electronic copy of it either by emailing the address provided or from the corresponding section of the CURENERGÍA website.

All these rights may be exercised by writing to CURENERGÍA CLIENTES COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U., Oficina del Cliente, Apartado de Correos 61343, 28080 Madrid, or through any of the CURENERGÍA channels: Regulated Electricity Tariff Customer Services Number 900 200 708; Regulated Gas Tariff Customer Services Number 900100309, email: protecciondatos.comercial@curenergia.es ; 'My Customer Area' at www.curenergia.es and any of the Service Points, thereby indicating the identification particulars, the postal or email address, the reasons for the request and any supporting documentation, for which proof of identity must be provided

In the event that the user does not obtain a satisfactory response, CURENERGÍA hereby informs the customer of their right to submit a complaint to the Spanish Data Protection Agency, Calle Jorge Juan 6, 28001 Madrid, Spain or through its website: www.agpd.es

Security measures

Access to the digital platforms through which the USER of the website or App contracts products or services from CURENERGÍA takes place in a secure environment. To confirm that you are on a website belonging to our Company, check that the word CURENERGÍA appear in the upper status line. You can also check that you are in a secure environment by looking at the "url" shown in properties (by clicking the right mouse button). The "url" in question begins with “https", where the "s" shows that the contents are offered by a secure server.

Links

CURENERGÍA's digital platforms in some cases provide links to other digital platforms or content owned by third parties. The sole purpose of such links is to provide the USER with the opportunity to glean further information from these links. CURENERGÍA will not be held liable for any outcome that access to such links may have for USERS.

USERS and, in general, any natural person or legal entity intending to establish any technical link between their digital platform and any of the digital platforms of CURENERGÍA, must obtain prior written permission from CURENERGÍA. The establishment of the link does not, under any circumstances, imply the existence of a relationship between CURENERGÍA and the owner of the platform with which the link is established, nor the acceptance or approval by CURENERGÍA of the content or services thereof.

Binding Corporate Rules (BCR)

Data transfers are carried out in accordance with applicable data protection laws and our Binding Corporate Rules ("BCR").

The Iberdrola Group's BCRs reflect European legislation on data protection (General Data Protection Regulation). The fact of having the BCRs implies that all the companies in our Group that sign them have to comply with the same internal rules.

You can download a copy of Iberdrola's BCR.