PRIVACY POLICY FOR EVENTS

Iberdrola, S.A. and the companies that make up the Iberdrola Group in accordance with commercial law (any of said companies hereinafter being referred to as "Iberdrola"), hereby undertake to protect your privacy and guarantee compliance with the laws governing the protection of personal data and, in particular, the General Data Protection Regulation ("RGPD") and the personal data protection legislation applicable in each country where the companies of the Iberdrola Group are domiciled. Your personal data will be processed: lawfully, faithfully and transparently; for specific, explicit, legitimate purposes; only as appropriate and pertinent; and to the extent strictly necessary for these purposes. We will keep your data accurate and updated. The data will be stored to allow your identification only for the time necessary to comply with the purposes for which it is being processed.

Iberdrola has implemented the necessary technical and organisational measures to protect your data from accidental loss or unauthorised alteration, access, use or disclosure, and has also established procedures to react to any security incidents that could affect your personal data.

This privacy policy informs you about how your personal data is processed when you take part in an Iberdrola event.

If this privacy policy is updated, you will be notified through this website.

If you will be accompanied to the event by other people, before providing us with the personal data of your companions you must inform them that their data will be processed in accordance with this privacy policy.

What personal data do we process and where do we get them from?

The personal data that we process about you are the data that you have provided for your registration to attend an event, as part of any other event, or data that we have obtained from publicly available sources.,In addition to your image and/or voice that appear on photographs taken and videos recorded during the Iberdrola event that you are attending.

On occasions, depending on the type of event, Iberdrola will make available to guests an email address for you to send information regarding disabilities or allergies, in which case such data will also be the subject of processing.

Who is the Data Controller responsible for processing your personal data?

The data controller is Iberdrola, S. A. with tax ID code A-48010615 and its registered offices at Plaza Euskadi 5 or the Iberdrola group company that is organising the event.

Iberdrola has appointed the following Data Protection Officers with respect to the following companies, which may be contacted in relation to any matter linked to this Privacy Notice:

For what purposes will we process your data?

The information you provide will be processed for the following purposes:

a) Sending an event invitation.

b) The management of your participation in the event and the event's organisation and logistics.

c) Controlling access to our facilities.

d) The editing of videos and audiovisual pieces and their subsequent publication on online and off-line communications media - the corporate website, intranet and social media accounts - for "IBERDROLA" brand image and promotional campaigns.

e) In some cases, to send you a satisfaction survey after the event.

What is the legal basis for processing your data?

The legal basis for the processing of your personal data for the purposes detailed in section a) is Iberdrola's legitimate interest in the creation of a network of contacts for the development and maintenance of public relations and/or networking with its stakeholders, as well as for the exchange of opinions on matters related to its business project and social responsibility strategy, for the purpose of contributing to the development of the communities in which it operates.

The legal basis for processing your personal data for the purpose indicated in section b), once you have requested to take part in the event in question by registering for it, is Iberdrola's legitimate interest in appropriately managing and holding said event so that it can take place safely and all attendees can properly take part in it.

In addition, the legal basis for the processing provided for in section c) is Iberdrola's legitimate interest in ensuring the safety of its facilities and of the individuals and assets found therein.

In the case of purpose d), the legal basis varies depending on the type of image:

  • When these are general images and background sound, the legal basis for processing your personal data is Iberdrola's legitimate interest in advertising and promoting the IBERDROLA image and brand, both internally and externally, so as to make the company and the group to which it belongs better known and to paint a public picture of IBERDROLA and the people linked to it that is in keeping with the ideals and values that govern its activity, through the publication of the activities and events it organises.
  • In the event that, as part of collecting images during the holding of the above-mentioned events, IBERDROLA, either directly or through the third parties hired for this purpose, captures images in which it is possible to directly recognise - close-ups -, the processing of the images and voices of the attendees has its legal basis in the consent that they gave to attend the event, which includes or may include the international transfer of data to a third country, which implies certain risks to their privacy due to the absence of a legal adaptation decision and appropriate guarantees. By attending the event, you are authorising this transfer of image rights free of charge for use both in currently-known technical media and any that may be developed in the future for a period of 2 years and with no geographical limitation.

In the case of purpose e), the legal basis is Iberdrola's legitimate interest in understanding the opinion and degree of satisfaction of event attendees with the aim of implementing a continuing improvement process for events.

How long will we keep your data?

We will keep your personal data for access to the facility and the management of the event until it ends. Your image or voice in any audiovisual clips will be retained unless and until you express an objection to their use, or withdraw your consent, as indicated in the section on legitimising bases.

If you exercise your right of opposition or withdraw your consent, the images in which you appear will be immediately deleted.

Nevertheless, when the above deadlines pass, said images will be duly locked and stored until the statute of limitations expires for any potential liabilities related to the processing thereof.

Who will receive your data?

Your data will be communicated to other Iberdrola group companies for internal administration purposes, or in the case of some events, for publication on the websites of other companies in the Iberdrola group, for the security and organisation of events, as well as to Public Administration bodies for the organisation of events in which you take part, based on the consent granted by you and in Iberdrola's legitimate interest. The companies in the Iberdrola Group are those listed on the company website https://www.iberdrola.com/wcorp/gc/prod/en_US/corporativos/docs/IB_Annual_Financial_Information.pdf [PDF]

In this context, in the event that the communication of your personal data occurs to Iberdrola Group companies located outside the European Economic Area, in countries that do not offer an adequate level of protection of personal data equivalent to that established in the European Union, we inform you that such transfers will be made in accordance with applicable data protection laws and our binding corporate rules ("BCR"). Having BCRs in place means that all entities in our group that subscribe to them have to comply with the GDPR and the same internal rules. It also means that you have the same rights regardless of where Iberdrola processes your data. You can download a copy of the Iberdrola Group BCRs https://www.iberdrola.com/privacy-policy/binding-corporate-rules

In addition, we inform you that for those events that celebrates outside the European Economic Area by the companies of Iberdrola group established in the European Union, in countries that do not offer an adequate level of protection of personal data equivalent to that established in the European Union, we hereby inform you that the communication of your personal data to corresponding Public Administrations that are necessary to organizes the event may, in some cases, involve an international transfer to a third country. This involves certain risks to your privacy due to the absence of an adaptation agreement and suitable guarantees. Therefore, should it be necessary to undertake an international transfer of your personal data, you will be suitably informed and your express consent for it will be sought.

Your data will not be communicated to any third party outside Iberdrola, except to providers of external services related to the organisation of events, security services, catering services, issue of accreditations, recording of images and video, web services, security services and the owner companies of the premises where the event is being held, with whom Iberdrola has signed the legally required contracts that guarantee compliance with their obligations as data processors. In these contracts, when the companies are located in a third country that does not offer an adequate level of protection of personal data equivalent to that established in the European Union, Iberdrola will ensure that it has the appropriate measures in place so that your data is protected in the country and organization of destination in identical or similar terms to those provided for in European and Spanish regulations. You may contact Iberdrola at any time to learn about the specific guarantees that have been implemented for the adequate and appropriate protection of your data.

What are your rights?

You have the right to access those of your personal data which are subject to processing and to request that any information be corrected if it is inaccurate or erased when it is no longer required for the purposes for which it was initially collected. You also have the right to object to or limit the processing of your data and seek the portability thereof. In addition, you are entitled to withdraw your consent at any time, under the terms indicated in the following paragraph, although said reversal will not affect the legitimacy of any processing done prior to your withdrawal.

You can exercise your right to object to images being shot or withdraw your consent during the holding of the event that you are attending by approaching the photographers and videographers to request that your image not be captured or recorded.

You can exercise these rights free of charge by writing to the following email address dpo@iberdrola.es

You also are entitled to submit a complaint to the Spanish Data Protection Agency via its website, www.aepd.es