Privacy policy

Date of update: 13 November 2024

Iberdrola, S.A. ("Iberdrola") is committed to protecting your privacy and complying with applicable data protection legislation ("Applicable Data Protection Legislation"), in particular, the General Data Protection Regulation ("GDPR") and the Organic Law on Data Protection and Guarantee of Digital Rights ("LOPDGDD"). Your personal data will be processed lawfully, fairly and transparently, in accordance with specified purposes and only if the processing is adequate, relevant and limited to what is necessary in relation to those legitimate purposes. In addition, we will keep your data up to date and process them in a way that allows your identification only for as long as necessary to fulfil the purposes of the processing, in accordance with applicable law.

Iberdrola has implemented the necessary technical and organisational measures to protect your data from accidental loss or unauthorised alteration, access, use or disclosure and has established procedures to react to any security incident that may affect your personal data.

By means of this privacy notice ("Notice" or "Privacy Notice") we inform you about the processing of your personal data while you are browsing our website ("Website"), as well as during the use of the features made available to you on the Website.

Notwithstanding the foregoing, certain processing of personal data may be subject to other specific privacy notices, some of which are set out in this Notice.

You should read this Notice and any of its updates to know how Iberdrola processes your personal data. Iberdrola may make changes to the Notice, in which case we will inform you as necessary.
In any case, you are solely responsible for the information you provide on the Website and if in the future Iberdrola wishes to use it for purposes other than those referred to above, it will inform you of these new purposes and request your consent, if necessary.

By using our Website, you acknowledge that you have read and agree to this Notice.

1. Who is the controller of your personal data?

The data controller is Iberdrola, S.A., with registered office in Bilbao, Bizkaia, Plaza Euskadi number 5, registered in the Companies Register of Bizkaia, volume 17 of the Companies Book, sheet 114, page 901 (now BI-167-A), 1st entry and with tax identification number A-48010615.

Please be informed that Iberdrola has appointed the following Data Protection Officer, who may be contacted in relation to any matter relating to this Privacy Notice: dpo@iberdrola.com.

2. What personal data do we process?

Iberdrola may process the following personal data:

• Identification data: name and surname, e-mail, telephone number.
• Professional and academic data, such as CV, work experience, education, work history, skills, degrees and qualifications.
• Publication data: may contain any data you provide in the post.
• Images and voice.
• Data about your web browsing.

3. How do we obtain your personal data?

Iberdrola obtains the data directly from you when you browse the Website and use the Website’s features as well as through the forms and e-mails provided on the Website that allow you to contact Iberdrola.

Iberdrola may also obtain personal data from third parties when so required.
Refusal or failure to provide certain data may prevent us from fulfilling our legal obligations.

We ask you to update your personal data as it changes and to always provide accurate information, as we need to have current information to fulfil the purposes of the processing.

4. What purposes do we process your personal data for and on what legitimate basis?

Iberdrola informs you that the personal data will be processed to:

1. Allow you to browse the Website and maintain its activity and security. Iberdrola processes your browsing data based on its legitimate interest in guaranteeing access to the Website and maintaining its security in the event of possible incidents and security breaches.
2. Respond to queries and requests for information. Iberdrola processes your data to provide you with the requested service based on the execution of the website’s conditions of use.
3. Send the Newsletter. Iberdrola processes your data on the basis of the consent you provide when you subscribe to the Newsletter.
4. iv.    Publish third-party content of professional interest. Iberdrola processes your data on the basis of the consent you give to Iberdrola by the means provided for this purpose.

5. How long do we process your personal data for?

Your personal data processed for purpose i above will be processed while you browse the Website.

Your personal data processed for purpose ii above will be processed for the time necessary to resolve and respond to your request or query.

Your personal data processed for purpose iii above will be processed for as long as you remain subscribed to the Newsletter or until you withdraw your consent.

Your personal data processed for purpose iv above will be processed for as long as the publication remains on the Website or until you withdraw your consent.

Without prejudice to the foregoing, when the processing of your data is based on Iberdrola’s legitimate interest and you exercise your right to object to it, your personal data will no longer be processed, unless compelling legitimate grounds for the processing are demonstrated that override your interests, rights and freedoms, or for the formulation, exercise or defence of claims. In the event that the processing of your data is based on your consent, your personal data will no longer be processed when you request the withdrawal of your consent, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

Once the periods mentioned in the preceding paragraphs have elapsed, Iberdrola shall keep the data, duly blocked if applicable, for the period permitted or required by the applicable legislation and until the expiry of the statute of limitations for: (i) the legal obligations to which Iberdrola may be subject; and (ii) the possible legal liabilities arising from the relationship entered into with the data subjects and the consequent processing of their personal data.

Disposal of personal data will be carried out in a manner that protects the privacy of such information and in accordance with our internal procedures and applicable law.

6. Who do we share your personal data with?

Your data may be disclosed to other Iberdrola Group entities when necessary to carry out the purposes indicated: (i) for internal administration purposes; (ii) in compliance with legal obligations; or (iii) to comply with the requirements of regulatory, judicial or other authorities.

The Iberdrola Group companies are listed on the corporate website: https://www.iberdrola.com/documents/20125/3643974/gsm24-annual-accounts-consolidated-2023.pdf.

The data may also be processed by internal and/or external service providers and/or contractors, such as IT services, tools and/or applications, web services and other third parties whose intervention may be required to carry out the purposes indicated in this Notice, who shall be configured as Iberdrola's data processors and with whom Iberdrola has established a contractual relationship for that purpose.

In this context, we hereby inform you that the aforementioned communications and processing orders may entail the transfer of personal data to third countries. In this regard, when Iberdrola carries out such transfers, it does so: (i) to countries for which the European Commission has declared the existence of an adequate level of data protection; (ii) in the absence of such a decision, by implementing adequate safeguards that, following an analysis of the regulations of the destination country, ensure the protection of your personal data in accordance with the requirements of the applicable regulations, such as Iberdrola Group’s Binding Corporate Rules ("BCR") or the standard contractual clauses approved by the European Commission; and (iii) where it is not possible to rely on any of the above and the transfer is a single event, in accordance with the exceptions set out in Article 49 GDPR.

By way of clarification, the BCR apply to certain processing by Iberdrola Group companies located outside the European Economic Area (EEA) or the United Kingdom of personal data originating from Group companies located within the EEA or in the United Kingdom. Having BCR in place means that all companies within our Group that subscribe to them have to comply with the same data protection standards when processing personal data transferred from the EEA or the UK. It also means that, where applicable, your rights remain the same, regardless of where Iberdrola processes your data. You can view and download a copy of the Iberdrola Group's BCR at https://www.iberdrola.com/privacy-policy/binding-corporate-rules.

You may contact Iberdrola at any time to request additional information and/or a copy of the specific appropriate safeguards adopted by writing to the Data Protection Officer at dpo@iberdrola.com. 

7. What are your data protection rights?

You may exercise any of the following rights free of charge:

• Right of access.
• Right to rectification.
• Right to erasure (‘right to be forgotten’).
• Right to restriction of processing.
• Right to object.
• Right to data portability.
• The right not to be subject to decisions based solely on automated processing of your personal data, including profiling. Iberdrola informs you that it does not carry out automated decision-making processes, including profiling, unless you have explicitly authorised us to do so. In that case, we would inform you about the logic behind the decision, as well as about the meaning and expected consequences for you of that processing.
• The right to withdraw your consent when it has been given for any purpose. Please note that withdrawal of consent will not affect the lawfulness of the processing based on consent prior to its withdrawal.

You can exercise your rights:

• By writing to the following postal address: Ref: Dirección Canales Digitales y Web. Tomás Redondo 1, 28033 Madrid.
• By writing to the following e-mail address: cdc@iberdrola.com. 

In the event that exercising your rights is related to a purpose of the processing regulated in a specific privacy notice, it must be done through the channels set out in clause 10.

We will send you an acknowledgement of receipt after receiving the request to exercise your rights and, after completing the relevant investigation, we will normally respond within one (1) month of receipt of the request unless, due to the complexity or number of requests received, this period needs to be extended.

In the event that you have not obtained satisfaction in the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency at www.aepd.esEnlace externo, se abre en ventana nueva.  or with any other competent supervisory authority.

8. Specific privacy notices and channels to exercise your rights

The following are the specific privacy notices that you can find on the Website as well as the channels through which you can exercise the rights indicated in the clause above in relation to the processing of data associated with them.

Previous version of our Privacy Polic

 Privacy Policy, 8 September 2023 [PDF]