PRIVACY POLICY CORPORATE EVENTS

Privacy policy for events

In the context of the provisions of the Purpose and Values of the Iberdrola group, Iberdrola, S.A. ("Iberdrola" or the "Company") pursues the sustainable development of the communities in which we carry on our activities and the wellbeing of the citizens, customers, suppliers, workers and shareholders, making them participants in our business project and our strategy of social responsibility, with measures aimed at promoting, among other things, education, culture and art. For that reason, in order to find out about and share their concerns, Iberdrola holds events to which it invites these stakeholder groups.

In accordance with the provisions of this Privacy Policy, Iberdrola undertakes to protect the privacy of your personal data as an attendant at events and to comply with the legislation on data protection as applicable at any given time.

In particular, it ensures that the personal data it holds will be processed (i) lawfully, fairly and transparently, (ii) in accordance with explicitly defined and legitimate purposes, (iii) appropriately, pertinently and confined to what is necessary for the processing, (iv) in accordance with the principle of accuracy, (v) such as to allow it to be evidentiary only for such time as is necessary for the purpose of processing, (vi) with means that ensure at all times appropriate security, protecting them from unauthorised or unlawful processing and avoiding their loss, destruction or accidental damage and (vii) respecting your right to the protection of your reputation and personal and family privacy.

In accordance with the provisions of the General Data Protection Regulation ("GDPR"), we inform you hereunder of how(1) Nota Iberdrola will process your personal data.

In the case that you wish to attend the event and this is accepted by the organization of the event prior to giving in the data of any third party you shall inform this third party of this privacy data policy and obtain any necessary consents.

What personal data do we process and where do we get it from?

The personal data that we process are those you have provided us on the occasion of your inscription to attend the event and within the context of any other event in which you have taken part, or that we have obtained from publicly accessible sources.

In particular, the following data are subject to processing: first name and surname(s), signature, ID card or Passport, postal and e-mail addresses, languages, education, position, company, nationality and if you have taken part in an event, any allergies or disabilities, image and voice.

Who is responsible for processing your data?

IBERDROLA, S.A
Address: Plaza Euskadi 5, 48009 Bilbao, Spain
Data Protection Officer: Tomás Redondo 1, 28033 Madrid or dpo@iberdrola.com.

What will we process your data for?

The personal information that you provide us with will be processed for the processing the management of corporate events and, where applicable, communication and broadcasting of images and videos to promote the respective activities on the website of the entity or of other Iberdrola Group companies, its social networks, reviews and publications or such other media, internal or external, as we consider appropriate.

Furthermore, we inform you that any additional personal data that you provide us with on the occasion of your attending any given event will be collected exclusively for reasons of private security and access control. Iberdrola will use these data only for this purpose and only temporarily, and will in no case use them for another purpose or disclose them to third parties, except for owners of the premises where the event is held and companies entrusted with their security. Thus we inform you that these additional data will not be stored, and after the event they will be deleted or destroyed.

What is the legal basis for processing your data?

All the purposes indicated above are legitimate, and the legal basis for the processing is the consent you grant on the occasion of your inscription to attend a given event and regarding the rest, the legitimate interest of Iberdrola in the creation of a network of contacts for the development and maintenance of public relations and/or networking with its stakeholder groups, as well as for the exchange of opinions on matters relating to its business project and social responsibility strategy, with a view to contributing to the development of the communities in which it conducts its business. This processing will be carried out respecting your right to the protection of your personal data, reputation and personal and family privacy.

How long will we keep your data?

In general, personal data will be kept for such period as you decide and, duly blocked, until the prescription period for possible legal actions has elapsed. Except for those gathered on the occasion of your attending a specific event, which will not be stored and will be erased or destroyed once the event is over.

Who will your data be revealed to?

Your data will be communicated to other companies in the Iberdrola group for purposes of internal administration or, in the case of certain events, publication on the websites of other Iberdrola group companies, security and organisation of events, as well as Public Administration bodies for organising events in which you take part, based on the consent you have granted and Iberdrola's legitimate interests. Such companies of the Iberdrola group are those listed on the company website Annual Financial Report [PDF].

We inform you that the communication of your data to Iberdrola group companies based outside the European Union constitutes an international transfer to a third country, which involves certain risks to your privacy due to the absence of an adequacy finding and adequate guarantees. Thus, in the case it is made necessary to perform an international data transfer you shall be informed of the same and will be asked for an explicit consent for such purpose.

Your data may also be accessible to external service providers related to the holding of events and the issue of accreditations. Iberdrola has signed the legally required contracts with all of them ensuring compliance with their obligations as processors.

What are your rights?

In accordance with the provisions of the legislation on data protection, you have the right to access your personal data, to request that inaccurate information be corrected or that it be removed where the information in question is no longer required for the purposes for which it was initially collected. You also have the right of objection to or limitation of data processing and to require data portability. You also have the right to revoke your consent at any time.

To exercise these rights you can present your requests to the Data Protection Officer at the addresses referred to above.

Information security

We have implemented the technical means needed to protect your data and information from any accidental loss, access, use or unauthorised disclosure. Nevertheless, despite implementing said measures diligently, the user must understand that security measures are not unbreachable. Iberdrola is not responsible for the actions of third parties who, in violation of these measures, access the aforementioned data and information.

Iberdrola has established procedures regarding how to respond to any data security incident.

  

(1) Nota Any operation or set of operations performed on personal data, whether or not by automated means, such as the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.