EVENTS PRIVACY NOTICE

Iberdrola, S.A and the companies that are part of the Iberdrola Group in accordance with commercial law (hereinafter any of them), “Iberdrola” are committed to protecting your privacy and guarantee compliance with personal data protection legislation, in particular the General Data Protection Regulation (“GDPR”), and the personal data protection legislation applicable in each country in which the Iberdrola Group companies are located. Your personal data will be processed lawfully, faithfully and transparently for specific, explicit, legitimate purposes, and only where appropriate, pertinent and limited to what is strictly necessary for the purposes for which it is processed. We will keep your data accurate and updated. The data will be stored to allow your identification only for the time necessary to comply with the purposes for which it is processed.

Within the framework of the provisions of the Iberdrola Group's Purpose and Values, at Iberdrola, we pursue the sustainable development of the communities in which we carry out our activities and the well-being of citizens, customers, suppliers, employees and shareholders, making them participants in our business project and our social responsibility strategy, with measures aimed at promoting, among others, education, culture and art. For that reason, in order to find out about and share their concerns, Iberdrola holds events to which it invites these stakeholder groups.

Iberdrola has implemented the necessary technical and organisational measures to protect your data from accidental loss or unauthorised alteration, access, use or disclosure, having also established procedures to respond to any security incident that could affect your personal data. 

By means of this privacy notice we inform you about the way in which your personal data will be processed due to your participation in an event organised by Iberdrola.

In the event that this privacy notice is updated, we will notify you through this website.

If you are to be accompanied to the event by other people, before providing us with the personal data of such companions, you must inform them about the processing of their data in accordance with this privacy notice.

Who is the data controller for your personal data?

The data controller for your personal data is the Iberdrola Group company organising the event. These Iberdrola Group companies are those indicated on the corporate website https://www.iberdrola.com/documents/20125/42388/IB_Annual_Financial_Information.pdf.

Iberdrola has appointed the following Data Protection Officers with respect to the following companies, to whom you may address any questions regarding this Privacy Policy:

What personal data do we process and where do we get them from?

The personal data we process fall into the following categories: 

  • Identifying and contact data: name and surnames, National Id/Foreign Id (DNI/NIE)/Passport or similar identity document, postal and/or e-mail address, telephone number or vehicle registration number and image and voice (general plans).
  • Data concerning personal characteristics: date and place of birth, age, gender, nationality, languages and, if guests are accompanied by relatives, family details.
  • Academic and professional data: professional experience, membership of professional or training bodies or associations, and qualifications.
  • Data concerning social circumstances: membership of clubs or associations or hobbies and lifestyles.
  • Employment details: profession and professional positions.
  • Commercial information: artistic, literary, scientific or technical creations.
  • Other information: date and time of access to the Event.
  • Occasionally, given the characteristics of the event, Iberdrola will provide guests with an e-mail address so that they can send data related to their health or physical or anthropometric characteristics, such as allergies, special dietary requirements or mobility problems, which may be necessary for the adoption of the necessary measures to guarantee their appropriate participation in the event.

The above data can come from a variety of sources:

  • The data subject (or, in the case of minors, their legal representatives), who provides them when completing the event registration form and/or attending the event or in the framework of any other event in which they have previously taken part. It is also possible that the organiser entity may have the data in advance, for example, as a result of a contractual or commercial relationship with the data subjects themselves.
  • Other Iberdrola Group entities other than the one organising the Event.
  • Private entities which the data subjects represent or in which they provide their services.
  • Public Administrations and educational entities.

For what purposes will we process your data?

The information you provide will be processed for the following purposes:

a)    Sending of the invitation to the event.

b) Management of your participation in the event and its organisation and logistics.

c) Access control to the event.

d) Capture of images and videos for the production of audiovisual materials and their subsequent dissemination in corporate media online and offline (e.g. corporate website, intranet and social media profiles).

e) In some cases, to carry out a satisfaction survey after the event.
 

What is the legal basis for processing your data?

The legal basis for the processing of your personal data for the purpose indicated in section a) is Iberdrola's legitimate interest in creating a network of contacts for the development and maintenance of public relations and/or networking with its stakeholders, as well as for the exchange of opinions on issues related to its business project and social responsibility strategy, in order to contribute to the development of the communities in which it conducts its business. 

The legal basis for the processing of your personal data for the purpose indicated in section b), once you have requested to participate in the event in question by registering for it, is Iberdrola's legitimate interest in the proper management and holding of such event, allowing the event to be held with full guarantees and for all attendees to suitably participate in it. In the specific case of data related to health or physical or anthropometric characteristics, the legitimate basis is the consent you give when you communicate such information to us.

In addition, the legal basis for the processing provided for in section c) is Iberdrola’s legitimate interest in ensuring the safety of its facilities and of the individuals and assets found therein.

In the case of purpose d), the legal basis varies depending on the type of image:

  • In the case of general plans and environmental sound, the legal basis is Iberdrola's legitimate interest in publicising and promoting the "Iberdrola" image and brand and of the organising entity, both internally and externally, in order to provide them with greater visibility and to shape a public image of the Iberdrola Group in accordance with the ideals and values that govern its activity, through the dissemination of the activities and events it organises. Iberdrola uses its website and other online and offline media appropriate for this purpose -e.g. social networks-, which enables access to a wider audience, thus optimising the effectiveness of its communication actions.  
  • In the event that, within the framework of the collection of images during the holding of the aforementioned events, Iberdrola, directly or through third parties contracted by Iberdrola, captures shots in which you can be recognised directly (close-ups), the processing of your image and voice has its legal basis in the consent you give when attending the event..  By attending the event, you are authorising this transfer of image rights free of charge, for the use of the technical means currently known and those that may be developed in the future, for the maximum period permitted by intellectual property legislation and without geographical limitation. 

In the case of purpose e), the legal basis is Iberdrola’s legitimate interest in gleaning the opinion and degree of satisfaction of participants regarding events so as to make ongoing improvements.

Finally, we inform you that when processing of data is based on Iberdrola's legitimate interest, the latter has analysed the weighting between legitimate interests and the rights of the data subject, in order to guarantee that the guarantees necessary for adequate protection of your data have been taken into account.
 

How long do we keep your data?

The personal data processed for the purpose a) will be kept as long as the data subject does not express their opposition to the processing of their data for this purpose.

With regard to the data processed for the purpose indicated in paragraph b), in the case of data subjects who are or may be recurrently invited to events, the data will be kept until such time as they express their opposition to the processing. In the event that the data pertains to persons invited to a particular event, the data will be retained until the conclusion of the event. 

The personal data processed for purpose c) will be kept for a period of one month from the time they were collected, unless it is necessary to do so for a longer period, when there have been acts against persons, goods or facilities for access to the facilities.

On the other hand, the personal data processed for purpose d) will be kept as long as you do not express your opposition or withdraw your consent to said processing, as indicated in the section on legitimate bases. If you exercise your right to object or withdraw your consent, the images in which you appear will be deleted immediately.

Finally, personal data processed for purpose e) will be processed until the conclusion of the analysis of the survey results.

However, once the periods mentioned in the preceding paragraphs have elapsed, the data shall be kept, duly blocked, during the periods of limitation of (i) the legal obligations to which Iberdrola may be subject to and (ii) the possible legal liabilities arising from the relationship established with the data subjects and the consequent processing of their personal data. 

To whom will your data be disclosed?

Your data will be communicated to other Iberdrola Group entities when this is necessary for the correct organisation of the Events -including their security-, for internal administration purposes or for the publication of the audiovisual material captured during the Events on the websites of said entities. These Iberdrola Group companies are those indicated on the corporate website  https://www.iberdrola.com/documents/20125/42388/IB_Annual_Financial_Information.pdf [PDF] External link, opens in new window.

The data may also be communicated to Public Administration bodies when this is necessary for the organisation of events involving such bodies. 

The legitimate basis for the communications described in the two preceding paragraphs is Iberdrola's legitimate interest in the proper management and holding of said event, allowing it to be held with full guarantees and allowing all attendees to properly participate in it; and, with respect to audiovisual material, the legitimate interest of Iberdrola and of the entity receiving the data in the advertising and promotion of the "Iberdrola" image and brand and of the entity organising the event in question. 

Finally, your data may also be communicated, when the event so requires, to accommodation, transport and/or travel agency service providers. The legitimate basis for such communications is the application of pre-contractual measures at the request of the data subject and Iberdrola's legitimate interest in the proper management and holding of the event, allowing the event to be held with full guarantees and all attendees to participate appropriately.

Likewise, with respect to the aforementioned images and videos, taking into account the nature and purposes of the processing and, particularly, their dissemination through the Internet, such data may be accessible by any third party who may view the online or offline corporate media in which the audiovisual material is published.

In addition, the aforementioned data may be accessed by internal and/or external service providers - e.g. IT services, catering services, access control services and other security services, image and video recording services, web services and companies owning the premises where the event is held, which shall be configured as data processors and with whom Iberdrola has signed the corresponding legally required agreement. 

In this context, we inform you that the aforementioned communications and processing orders may involve the transfer of personal data to third countries. In this regard, IBERDROLA carries out these transfers, in any case, to (i) countries for which the European Commission has declared the existence of an adequate level of data protection; (ii) in the absence of such a decision, by putting in place adequate safeguards that, after analysis of the regulations of the country of destination, ensure the protection of their personal data in accordance with the requirements of the applicable regulations, such as the Binding Corporate Regulations (“BCR”) of the Iberdrola Group (you can download a copy of the Iberdrola Group's BCRs at https://www.iberdrola.com/privacy-policy/binding-corporate-rules) or the signature with the data recipient of the standard contractual clauses approved by the European Commission; and (iii) where it is not possible to rely on any of the above cases and the transfer is of a one-off nature, in accordance with one of the exceptions provided for in Article 49 GDPR.

You may contact Iberdrola at any time to request additional information and/or a copy of the specific appropriate safeguards adopted by contacting the Data Protection Officer at the following address dpo@iberdrola.es.

What are your rights?

You have the right to access your personal data that are subject to processing, to request the rectification of inaccurate data or, where appropriate, to request their deletion when the data are no longer necessary for the purposes for which they were collected, as well as to exercise the rights of opposition and limitation of processing. You also have the right to withdraw your consent at any time, although such withdrawal will not affect the lawfulness of the processing prior to the withdrawal.

You may exercise your right to object to the taking of images or withdraw your consent during the event you are attending by contacting the photographers and cameramen to request that your image not be captured or recorded. 

With respect to processing based on legitimate interests, you may request information regarding the conclusions of the weighting carried out by Iberdrola, as well as object to any such processing.

You can exercise these rights free of charge via the following e-mail address  dpo@iberdrola.es External link, opens in new window.

You are also entitled to file a claim with the Spanish Data Protection Agency through their website www.aepd.es. External link, opens in new window.