Welcome to the Elecnor Group's (hereinafter referred to as Elecnor) Privacy Policy. In this document you will find information about how Elecnor processes your personal data and your rights in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and Organic Law 3/2018, of 5 December, on Data Protection and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller identity and contact details

Below is a list of the companies that form part of the Elecnor Group, all of which are equally affected by this Privacy Policy:

COMPANY	NIF (TAX ID No.)	ADDRESS
ELECNOR SERVICIOS Y PROYECTOS, S.A.U	A-79486833	Calle Marqués de Mondéjar, 23. Madrid
ÁREA 3 EQUIPAMIENTO DISEÑO E INTERIORISMO, S.L.U.	B-85779494	Calle Maestro Alonso, 21-23. Madrid
HIDROAMBIENTE, S.A.U.	A-48581904	Calle Mayor, 23 E 1º. Guecho (Vizcaya)
ELECNOR, S.A.	A-48027056	Calle Marqués de Mondéjar, 33, Madrid
APLICACIONES TÉCNICAS DE LA ENERGÍA, S.L.U. (ATERSA)	B-62618442	Parque Industrial Juan Carlos I. Avenida de la Foia, 14. Almussafes (Valencia)
ENERFÍN SOCIEDAD DE ENERGÍA, S.L.U.	B-84220755	Paseo de la Castellana, 141. Planta 16. Edificio Cuzco IV. 28046 Madrid
INTERNACIONAL DE DESARROLLO ENÉRGETICO, S.A.U. (IDDE)	A-28458008	Calle Orense, 4. Madrid
JOMAR SEGURIDAD, S.L.U.	B-19168582	Calle Francisco Medina y Mendoza, nº 17-A. Cabanillas del Campo (Guadalajara)
EHISA CONSTRUCCIONES Y OBRAS, S.A.U.	A-50119569	Calle Doctor Aznar Molina, 15-17. Zaragoza
AUDECA, S.L.U.	B-33302696	Calle Marqués de Mondéjar, 33. Madrid
ELECNOR SEGURIDAD, S.L.U.	B-83680132	Calle Marqués de Móndejar, 33. Madrid

Elecnor is one of the leading global corporations in project development, construction and operation through two major mutually-enriching business areas: Infrastructure and Concessions.

You can contact Elecnor via the following channels:

• In person or by post addressed to the company headquarters at Paseo de la Castellana 81 planta 20º, 28046 Madrid.
• By email addressed to lopd@elecnor.com
• Via the different forms of contact with the head office and offices mentioned on the website: https://www.elecnor.com/where-we-are

2. Why do we process your personal data and on what grounds?

Your personal data will be processed by Elecnor for the purposes and on the grounds indicated below:

a. For security reasons, there are surveillance cameras filming the entrance to our facilities. In this case, the legitimate interest of Elecnor in keeping its facilities safe constitute the legal grounds for processing personal data.

b. Customers and contacts. We process customer data for accounting and administrative management purposes and in order to conduct customer satisfaction surveys. The legal grounds that support this processing is the execution of an agreement and the legitimate interest associated with business and commercial relations, marketing and quality management.

c. Suppliers. We process the data of our suppliers to manage the services hired and the financial and administrative management thereof, in addition to carrying out satisfaction surveys. The legal basis for the processing of this data is the execution of the agreement and the legitimate interest linked to commercial and business relations and quality management.

d. Staff selection. We process candidate data in order to perform selection processes for jobs at Elecnor, based on the consent of the interested party.

e. Access control. We process the data of the individuals who visit our facilities on the basis of a legitimate interest in the security of our facilities and monitoring the individuals who visit Elecnor at any of our buildings or offices.

f. External staff. We process the data of subcontracted individuals and those associated with recruitment in such a way as to ensure the fulfilment of a legal obligation, specifically Law 31/1995 of 8 November on Occupational Health and Safety.

g. Ethical Code. We process data using our internal complaints channel as required by law, specifically by Organic Law No. 1/2015 of 30 March, which amends Organic Law No. 10/1995 of 23 November on the Spanish Criminal Code.

In addition to the processing mentioned above, certain companies belonging to the Elecnor Group perform specific processing. Enerfín Sociedad de Energía, S.A. processes personal data for land lease and easement agreements with private individuals based on the execution of an agreement signed with the interested party. Elecnor, S.A. processes the personal data of its shareholders in compliance with the applicable legal obligations and Aplicaciones Técnicas de la Energía, S.L. processes personal data for the sale of products to private individuals through the website and by sending marketing communications regarding products offered on said website, pursuant to the execution of the agreement and the consent of the interested party.

Elecnor also performs other types of data processing associated with human resource management that are not set forth in this Privacy Policy.

3. Accuracy of the data on the interested party and obligatory nature of the information provided

With regard to all of the data that you share with us, you guarantee its authenticity and, furthermore, you undertake to keep said information updated to reflect your current situation at all times; you shall be solely liable for any false or inaccurate statements that you make and for any damages that Elecnor suffers as a result.

4. Recipients

We may share your data with other companies in the Group, which are listed on the website in the "Webs of the group" section, for administrative and commercial management purposes. You are hereby informed that companies in the Group are sometimes located outside of the European Economic Area and, therefore, your data may be transferred internationally. In this regard, Elecnor has adequate procedures in place to guarantee that your data is processed properly.

We also share your data with third party service providers that handle data on behalf of Elecnor and with whom we hold agreements that establish the conditions and requirements for using said data. At Elecnor, in order to fulfil our data protection commitments, we use strict selection criteria when choosing our service providers.

You are also hereby informed that we will share your data with Public Entities in order to comply with legal obligations affecting certain processes. Other than in the cases mentioned above, we will not share your data with any third parties unless it is necessary for compliance with a legal obligation to which we are subject.

5. How long will we keep your personal data for?

We will store the personal data with which you are able to provide us for the period of time necessary according to the purpose for which the data is gathered and, in cases in which we have other duties, your data will be stored for the period of time strictly necessary for the purpose for which it is processed.

You are hereby informed that your personal data may be encrypted by Elecnor for the period of time established by the regulations applicable to each case in order to deal with legal, administrative or fiscal complaints.

6. What are your rights as a data subject?

We hereby inform you that you may exercise the following rights:

Right to access.  The right to request that we, at any time, confirm whether or not we are processing your personal data, for us to grant you access to said data and the information regarding its processing and for you to obtain copy of said data.

Right to rectification. The right to rectify any inaccurate, outdated or incomplete data that concerns you.

Right to erasure. The right to request the removal of your personal data when, among other reasons, the data is no longer required for the purpose for which it was gathered. Notwithstanding, this right is not absolute insofar as Elecnor may continue to hold the data, duly encrypted, in the cases set forth in the applicable regulations.

Right to restrict processing. The right to request that the processing of your personal data be restricted when its accuracy, legality or the need for the processing of said data is uncertain, in which case, we may retain the data in order to file or respond to complaints.

Right to data portability. The right to have your data shared with another party responsible for processing in a structured, widely-used and machine-readable format. This right applies when the processing of your personal data is based on consent or the execution of an agreement and such processing is performed using automated means.

Right to object. This right entitles you to object to the processing of your personal data, including profiling. Elecnor shall only be entitled to disregard your right to object when it has legitimate grounds to process your data or to file, assert or respond to complaints.

Right not to be subject to automated decision-making, including profiling. This right means that you are entitled to not be subject to decision-making based solely on automated processing, including profiling, when said decisions have legal effects or affect you in a similar way. Unless such a decision is required for the execution of an agreement, is authorised by law or is based on consent.

Right to withdraw consent. In cases in which we have obtained your consent to process your personal data in relation to specific activities, you have the right to withdraw your consent at any time.

The interested party or their representative, as applicable, may exercise the aforementioned rights by submitting a written request addressed to the company at the registered address appearing in the first paragraph or by email to: lopd@elecnor.com. You can also contact our Data Protection Representative at the email address provided.

All requests must include a copy of your DNI (national identity document) or equivalent and the minimum content established by applicable regulations:

• Name and surname of the interested party, photocopy of their national identity document, passport or other valid form of identification.
• Application setting forth the exact request.
• Address for communication purposes, date and signature of the interested party.
• Documents to support your request.

In the event that you are unsatisfied with the service you have received in relation to your rights, Elecnor reminds you that you have the right to file a complaint with the Spanish Data Protection Agency or the corresponding supervisory body.

7. Personal data processed by Elecnor

For the purposes set forth in this Privacy Policy, Elecnor collects and processes the following personal data:

• Identifying data, name, surname, DNI, date of birth, image.
• Contact details: postal address, email address, home phone number and mobile phone number.
• Professional and education data: data associated with your CV.
• Contractual and employment data: those legally necessary for the execution of a contract.
• Images: recording of images on surveillance cameras at the facilities.
• Tax and contribution data.

8. Methods of collecting personal data

Elecnor collects and processes the personal data that you supply voluntarily:

• During a telephone conversation or by written or electronic means of communication.
• When signing an agreement or authorisation.
• With the surveillance cameras.
• Using paper or electronic forms.
• When filing a complaint.
• Via third parties to which Elecnor is contractually linked.

9. What security measures do we have in place?

Elecnor undertakes to fulfil its obligation of confidentiality in relation to the personal data that it processes.

Elecnor has the necessary technical and organisational security measures in place in order to guarantee the security of your personal data and to prevent its alteration, loss and unauthorised processing and/or access, taking into account the technological conditions and the nature of the data stored as well as the nature of the risks to which it is exposed, whether caused by human intervention or the physical or natural environment, in accordance with the provisions of the applicable regulations.

10. Links

The Elecnor website may include hyperlinks to other websites that are not operated or controlled by Elecnor. As such, Elecnor does not guarantee, nor is it responsible for, the lawfulness, reliability, usefulness, truthfulness or current applicability of such websites or their privacy practices. Before providing your personal information on these websites, please note that their compliance with data protection laws may differ from our own.

11. Modification of the Privacy Policy

Elecnor may amend its Privacy Policy in accordance with applicable legislation at any time. We recommend that you consult the Privacy Policy each time you visit our website in order to learn how Elecnor processes your personal data.