Who is responsible for the processing of your data?

Curenergía Comercializador de Último Recurso, S.A.U, with tax identification number C.I.F. A-95554630, whose registered offices are at Plaza Euskadi 5, 48009 Bilbao, is the data controller of the data provided by the Customer. It hereby guarantees its security and confidential processing in accordance with the provisions of the General Data Protection Regulation (GDPR), and any other laws which may be applicable.

The user may contact the Data Protection Officer to resolve any queries relating to the processing of their personal data, at dpo@iberdrola.es.

Why do we process your personal data?

Within CURENERGÍA's digital platforms, the user's personal data will be collected and processed, depending on the relationship with the user, for the following purposes:

In the case of user registrations , to provide access to the digital platform and to the contracting data and contact information available for that user, as well as for access to and use of the digital platform and compliance with the legal obligations of CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U as a provider of information society services.

In the case of enquiries or applications the information will be used to manage them.

Users' browsing data and cookies may also be processed to enhance their user accessibility, and to customise and analyse their browsing, as well as to display publicity and advertising based on their interests in accordance with our cookie policy which must be accepted prior to browsing on our digital platform.

Other specific purposes indicated in the data collection forms on the digital platform and without which CURENERGÍA would not be able to process the form in question.

For ordering services or products through the digital platform, the purpose will be to manage the relationship with CURENERGÍA, to provide the services requested, to handle customer service and in general to fulfil the obligations under the Contract. Providing the user has given their consent, CURENERGÍA may update and add to user's personal data by acquiring databases from publicly accessible sources to allow improved management of relations and contact with the user.

CURENERGÍA podrá, con el consentimiento del usuario, actualizar y enriquecer los datos personales del usuario mediante la adquisición de bases de datos provenientes de fuentes de acceso público y que permitan una mejora de la gestión de la relación y contacto con el usuario.

CURENERGÍA will also process personal data for the purpose of offering, by the means provided and including electronic means, in segmented and personalised form, information aabout the supply of energy, products and services of CURENERGÍA or of third parties promoted by CURENERGÍA, if the Customer has consented to this, relating to energy, telecommunications, finance, home and entertainment. To this end, CURENERGÍA may use automated support systems and other means that allow profiling of target audiences for campaigns, activities or actions, using information from CURENERGÍA as well as information from third-party sources if the user has consented thereto. Provided the user has given their consent, these actions in the case of customers may be carried out even after the contractual relationship with the customer has ended.

Additionally, CURENERGÍA may use the user's unlinked data, always safeguarding their anonymity, even after the relationship has come to an end, in its decision-making and business management support systems.

How long will we keep your data for?

The personal data provided by the user for the contracting of products and services will be processed by CURENERGÍA for the period during which the contractual relationship remains in force. This will start when the Contract is signed and end, irrespective of the supply period, once all the contractual obligations, such as dealing with the customer's requests for information, complaints and reviewing of invoices, have been fulfilled, without prejudice to the obligations of data blockage and/or data retention as may derive from applicable legislation in each case.

If the user has given their consent, their data may be processed after the end of the Contract or after the deregistration of the user who does not have valid contracts, for a period of 2 years, without prejudice to the data retention obligations required by the applicable legislation in each case to meet the responsibilities arising from the processing.

For all other users, the data retention period will be 2 years from the collection of the data without prejudice to the obligations of data blocking and/or data retention resulting from the applicable regulations in each case.

What is the legal basis for the processing of your data?

The legal basis for processing your data derives from the consent obtained from the user, that arising from the use of digital platforms, the contracting of products or services, the legislation applicable to the supply of electricity, gas and similar products and services and any other that might be applicable to users at any given time.

The users' consents are obtained both at the time of user registration and in the different contracts or requests made on the digital platform and may be amended at any time by the user through the exercise of their rights. For customers with contracts in force, the processing may also be based on the legitimate interests of CURENERGÍA regarding the supply of energy and its own related products and services, loyalty programmes, including sporting, cultural and charitable activities in which CURENERGÍA participates, and the drawing up of profiles in order to offer products or services similar to those contracted. This data may also be communicated to third-party companies for the performance of administrative procedures for the purposes of customer acceptance, fraud prevention, debt claims and collection.

Legitimate interest includes the processing of user data for security management and controlling access to support information systems.

If, for any specific process or request, it should be necessary for the user to provide the personal data of persons other than the contract holder, the user must first and expressly inform them of the content of this policy and obtain their prior consent with respect to the processing of their data.

In order to register as a user on CURENERGÍA's digital platforms, users must declare themselves to be of legal age, as it is restricted for minors, so your registration is a declaration and assurance that you are of legal age. CURENERGÍA will in no circumstances be held responsible for data processing carried out on minors without the consent of their parents or guardians.

Who will your data be passed on to?

For products or services contracted, the data needed to manage access to the grid will be sent to the Distribution Company and will remain incorporated in a file under its responsibility (Supply Point Information System) accessible by such persons as may be determined by the legislation at any given time.

CURENERGÍA in turn works with third-party service providers such as sales channels, administrative support, call centres, banks, debt collection agencies, marketing and advertising firms, auditors and others which in certain cases may access your data, with the necessary safeguards, to achieve the objectives of the processing.

In the event of non-payment by the customer, CURENERGÍA may report this to relevant credit agencies, complying with the applicable legislation. It may also release the data to the competent authorities and bodies in compliance with such legal and tax obligations as may pertain. The information relating to possible supply contracts will also be disclosed to the Spanish tax authorities for the purposes of General Taxation Act No. 58/2003 and Tax Fraud Prevention Act No. 36/2006. Also, by virtue of Royal Decree 897/2017 which, inter alia, regulates the figure of vulnerable consumers, the personal data of these customers may be communicated to the bodies in charge of the protection of vulnerable consumers for them to implement the measures contained in the Decree, and to any other government department for such purpose as may legally be determined.

The customer's personal data may be accessed by or communicated to other companies located in countries outside the European Economic Area, which constitutes an international transfer of data to those third countries.

CURENERGÍA carries out these transfers, in any case, to (i) countries for which the European Commission has declared the existence of an adequate level of data protection or (ii) in the absence of such a decision, (ii) by implementing appropriate guarantees that, following an analysis of the regulations of the destination country, ensure the protection of your personal data in accordance with the requirements of the applicable regulations, such as signing with the entity receiving the data, the standard contractual clauses approved by the European Commission.

In this regard you are informed that CURENERGÍA currently has call centre services contracted with third-party providers that sometimes provide their services from countries outside the European Union.

Customers may request additional information and/or a copy of the appropriate safeguards implemented by CURENERGIA by contacting the Data Protection Officer at dpo@iberdrola.es

What are your rights when you provide us with your data?

In order to be able to access certain services, you need to sign up as a registered user of the digital platform. The data for filling in the Registration Form are provided freely and voluntarily, and for this reason they must be true and reflect reality. The user undertakes to make diligent use of, and not to reveal to third parties, his or her user name and password, and to inform CURENERGÍA as soon as possible of the loss or theft of same, or any risk of a third party gaining access to same.

The data that the user provides us with to arrange services or products is necessary for the maintenance of the contractual relationship. Failing or refusing to provide it would make it impossible for us to manage the relationship.

The user is responsible for the truthfulness of the data provided and should request its amendment whenever necessary to ensure it is properly processed, the proper provision of the contracted services and efficient communication.

The user can exercise their rights of access and rectification or request that their data be deleted when it is no longer required for the purposes for which it was collected, among other reasons.

The user may request restrictions on the processing of their data in the circumstances established in Article 18 of the General Data Protection Regulation, in which case they will be kept only for the exercise or defence of possible claims.

The user may withdraw the consent given at any time, objecting to the processing of their data for a particular purpose, without this affecting the legitimacy of the processing based on the consent prior to its withdrawal, or object to it, in which case their personal data will be kept only for the exercise or defence of possible claims.

The user may contact CURENERGÍA to challenge any decision that the user believes may affect their rights and freedoms or legitimate interests and which is based on an automated decision, including profiling. This right allows the user to challenge such decisions and obtain a direct response from the CURENERGÍA controllers.

The user may ask CURENERGÍA for portability of their personal data, obtaining an electronic copy of it either by emailing the address provided or from the corresponding section of the CURENERGÍA website.

All these rights may be exercised by writing to CURENERGÍA CLIENTES COMERCIALIZADOR DE ÚLTIMO RECURSO, S.A.U., Oficina del Cliente, Apartado de Correos 61343, 28080 Madrid, or through any of the CURENERGÍA channels: Regulated Electricity Tariff Customer Services Number 900 200 708; Regulated Gas Tariff Customer Services Number 900100309, email: protecciondatos.comercial@curenergia.es ; 'My Customer Area' at www.curenergia.es, or any of the Service Points, giving details for identification purposes, postal or e-mail address, reasons for the request and supporting documentation including proof of identity.

In the event that the user does not obtain a satisfactory response, CURENERGÍA hereby informs the customer of their right to submit a complaint to the Spanish Data Protection Agency, Calle Jorge Juan 6, 28001 Madrid, Spain or through its website:

http://www.agpd.es/portalwebAGPD/CanalDelCiudadano

Security measures

Access to the digital platforms through which the USER of the website or App contracts products or services from CURENERGÍA takes place in a secure environment. To confirm that you are on a website belonging to our Company, check that the word CURENERGÍA appear in the upper status line. You can also check that you are in a secure environment by looking at the "url" address shown in properties (by clicking the right mouse button). The "url" address in question begins with "https", where the "s" shows that the contents are offered by a secure server.

Links

CURENERGÍA's digital platforms in some cases provide links to other digital platforms or content owned by third parties. The sole purpose of such links is to provide the USER with the opportunity to glean further information from these links. CURENERGÍA will not be held liable for any outcome that access to such links may have for USERS.

USERS and, in general, any natural person or legal entity intending to establish any technical link between their digital platform and any of the digital platforms of CURENERGÍA, must obtain prior written permission from CURENERGÍA. The establishment of the link does not, under any circumstances, imply the existence of a relationship between CURENERGÍA and the owner of the platform with which the link is established, nor the acceptance or approval by CURENERGÍA of the content or services thereof.

Binding Corporate Rules (BCR)

Data transfers are carried out in accordance with applicable data protection laws and our Binding Corporate Rules ("BCR").

The Iberdrola Group's BCRs reflect European legislation on data protection (General Data Protection Regulation). The fact of having the BCRs implies that all the companies in our Group that sign them have to comply with the same internal rules.

You can download a copy of Iberdrola's BCR.