PERSONAL PASSWORD REQUEST FOR SHAREHOLDERS

Legal Conditions

Iberdrola, S.A. ("Iberdrola" or the "Company") is committed to protecting your privacy and guarantees compliance with the legislation on the protection of personal data and, in particular, that your personal information will be processed: in a lawful, loyal and transparent manner; in accordance with specific explicit and legitimate purposes; only if it is adequate, relevant and limited to what is necessary in relation to the processing; accurate and up to date; in such a way as to allow identification of the data subject only for the time necessary for the purposes of processing; guaranteeing their security.

In accordance with the provisions of current legislation on the protection of personal data, specifically the General Data Protection Regulation ("GDPR"), we inform you about the processingsup(1)# of the personal data as member of On Line Shareholders Office during your relationship with Iberdrola and after it has ended.

You should read this notice, and any updates to it, in order to know the purpose of the processing of your personal data and the circumstances thereof.

What personal data do we collect and process from you?

Iberdrola shall only process your data needed to comply with the purposes detailed below. The data are your name and surname, identity card or passport, country, postal and/or electronic address, phone number, date of birth and numbers of shares.

How do we collect your personal data?

You provide us with your personal information through your registration in the On Line Shareholders Office.

If you do not provide us with your requested personal information, we may not be able to manage your registration.

We ask you to update your personal data as it changes, and always provide truthful information, as we must have your current information.

Who is responsible for the processing of your personal data?

IBERDROLA, S.A.
Plaza Euskadi 5, Bilbao
Data Protection Officer: dpo@iberdrola.com

For what purposes do we process your data?

The information you provide us with will be treated in accordance with the following purposes:

1. Answer your questions in the OLA application as a shareholder of the Company.

2. Send you information regarding the exercise of your rights as a shareholder.

3. Verify your status as a shareholder.

What is the legitimacy for the processing of your data?

The legal basis for the treatment of your data with the purpose detailed in paragraphs 1 and 2, above is the providing of the services that Iberdrola upon you required when you register in the On Line Shareholders Office.

The legal basis for the treatment of your data with the purpose detailed in paragraph 3 above is the legitimate interest of Iberdrola. Such processing is carried out with respect to your right to the protection of your personal data, to your honor and to your personal and family privacy.

How long do we keep your data?

The personal data provided will be kept to the extent you remain as a member of the On Line Shareholders Office, during the provision of the services requested and, in any case, once the statute of limitations for any legal actions involved has expired.

We also inform you that Iberdrola will be able to check annually if you are still a shareholder and, if you have lost that condition, we will proceed with your withdrawal from the the On Line Shareholders Office.

However, the personal data provided may be kept duly blocked for as long as required by the applicable regulations.

To whom will your information be communicated?

Your data may be communicated to the Iberdrola Group companies in Spain. These Iberdrola Group companies are those listed in the IBERDROLA corporate website https://www.iberdrola.com/wcorp/gc/prod/en_US/corporativos/docs/gsm18_FinancialStatements_AuditorsReport_Consolidated.pdf [PDF].

What are your rights?

You have the right of access to the personal data being processed, as well as the right to request the rectification of inaccurate data or, where appropriate, to request their erasure when the data are no longer necessary for the purposes for which they were collected, as well as the right to object and restrict the processing and the data portability. If your consent was obtained, you have the right to revoke it at any time.

You may submit their requests to exercise their rights free of charges (including a copy of your national identity card or equivalent document) through the following channels:

  • Sending a written notice to: OLS, C/ Tomás Redondo, 1, 28033 Madrid.
  • Data Protection Officer: Tomás Redondo 1, 28033 or dpo@iberdrola.com.

In the event that you have not obtained satisfaction in the exercise of your rights, you may file a complaint with the Spanish Data Protection Agency or equivalent control authority.

More Information

We have implemented the necessary technical measures to protect your data and information from accidental loss, unauthorized access, use and disclosure. However, despite the diligent implementation of such measures, the user should be aware that security measures are not indefeasible. Iberdrola is not responsible for the actions of third parties who, in violation of these measures, access the aforementioned data and information.

We have established procedures for any data security incident.

 

(1) Any operation or set of operations carried out on personal data, whether automated or not, such as the collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of access, checking or interconnection, limitation, deletion or destruction.