Employment Channel Privacy Notice

Date of last update: 2 November 2023

Iberdrola, S.A and the companies that are part of the Iberdrola Group (any of them, hereinafter, “Iberdrola” and jointly, the “Iberdrola Group”) are committed to protecting your privacy and to complying with the laws and regulations governing personal data protection, in particular and as may be applicable, the European General Data Protection Regulation (“GDPR”)  and the personal data protection laws and regulations applicable in the jurisdictions where the companies of the Iberdrola Group are located . Your personal data will be processed lawfully, fairly and transparently for specific, explicit, legitimate purposes; and only where appropriate, pertinent and limited to what is necessary for the purposes for which it is processed. In addition, we will store your data in a form which permits their identification only for as long as is necessary to fulfil the purposes of the processing.

Iberdrola has implemented the necessary technical and organizational measures to protect your data from accidental loss or unauthorized alteration, access, use or disclosure. Procedures to manage and react to any security incident that could affect your personal data are also in place. 

We hereby inform you of the processing of your personal data on the Iberdrola Group Employment Channel (“Employment Channel”) when you register and possibly take part in any Iberdrola Group selection processes for staff or interns.

If, as a result of your taking part in a selection process for any of the companies in the Iberdrola Group, you provide us with personal data on third parties, you must, prior to the personal data being provided, inform said third parties that it will be processed under the terms in this notice. 

In the event of any changes to this privacy notice, we will notify you in a timely manner. Furthermore, this privacy notice may also be supplemented by specific notices in accordance with the local legislation applicable in each country where Iberdrola Group companies are located.

Who is the data controller in charge of your personal data?

The data controller in charge of your personal data are the Iberdrola Group companies that are responsible for recruitment. You can access the information about each of the data controllers on the corporate website:
https://www.iberdrola.com/documents/20125/2931678/gsm23_FinancialStatements_AuditorsReport_Consolidated2022.pdf (Appendix I) 

We inform you that the companies of the Iberdrola Group have designated Data Protection Officers. You may contact them, or the local privacy teams, at the following email addresses, when applicable:

What personal data do we collect and process?

We will process the personal data of email address and login data required to register into the Employment Channel. Additionally, we will process the personal data and documentation you provide when applying for a specific job or internship offer, which will be in general: name and surname, gender, telephone number, country, address, CV, qualifications, professional experience, certifications, languages, websites and social media URLs. 

In addition, we will process your mobile phone number and login data in order to apply a two-factor authentication to certify your identity when accessing the Employment Channel.

In addition, depending on the location of the Iberdrola Group company offering the vacancy, the following data will be processed:

  • Spain: date of birth, nationality and disability.
  • United Kingdom: date of birth, nationality, disability, marital status and, if you voluntarily choose to provide it, religion, sexual orientation and race/ethnicity.
  • Mexico: date of birth, nationality, disability, document of accreditation of marital status, place of birth and additional nationalities.
  • USA: disability, race/ethnicity and veteran status
  • Brazil: date of birth, nationality, disability, race/ethnicity, marital status, place of birth and gender identity.
  • Other countries than those listed above: date of birth and nationality

In addition, we will process the information obtained as a result of conducting tests during a specific recruitment process or pre-selection tests so you may take part in selection processes for future vacancies. 

In addition, should you take part in and pass a selection process, we may request and process, depending on the country that has the vacancy with the selection process in which you took part, additional data such as your identity document and/or Social Security and/or passport number, ID document photo, birth certificate, health records after a medical check-up, and where appropriate, bank account data, family data, and medical certificate of fitness for work (“Additional Data”).

The Additional Data may also include the following information:

  • For vacant positions in Spain: marital status and place of birth.
  • For vacant positions in Mexico: document proving marital status, CIF (Tax Identification Card), FIEL (Advanced Electronic Signature), the certificate of studies, a socio-economic study (which aims to corroborate the way of life, schooling and work references of the candidate and consists of home interview and validation of personal references), proof of address, credit withholding letter either INFONAVIT or FONACOT, psychometric tests, sexual orientation, race / ethnicity, disability, blood group and emergency contact. 
  • For vacant positions in Brazil: the work card, CPF (Individual Taxpayer's Registry), certificate of investor, voter's card, CNH (national driver's license), PIS (social integration program), SUS card, proof of education, proof of address, vaccination card, additional nationalities and blood type.
  • For vacant positions in the USA: forms I-9, W-4 and SWH, the information you provide to our external provider of job applicant due diligence services (which includes information on personal details, a list of previous addresses, employment record, criminal record, financial information and references from previous jobs), date and place of birth, and additional nationalities. 
  • For vacant positions in the United Kingdom: form HMRC, document P45 and the information you provide to our external provider of job applicant due diligence services (which includes information on personal details, a list of addresses, employment record, criminal record, financial information and references from previous jobs), place of birth, gender identity, additional nationalities and military service.
  • For vacant positions in Australia: Iberdrola Australia Limited and its subsidiary companies, as permitted by law, may collect information that is reasonably necessary for its functions and activities (as further described in its Privacy Policy), including health screening checks, references, financial probity (for example, bankruptcy checks), identity (including ID photo), criminal background, drug and alcohol tests, evidence of eligibility to work (including citizenship, residency and immigration status, visa or passport details). In accordance with our legal obligations, we will also collect your tax file number, bank account details and superannuation fund details via a separate local employee self-service portal. 
  • In case of vacancies in other countries than those listed above: marital status, place of birth and additional nationalities.

We inform you that the Additional Data will only be accessible to the Iberdrola Group Company in charge of the relevant selection process.
 
We may ask you to provide original documents and copies as evidence of the information you have provided.

How do we obtain your personal data?

You provide us with your personal data when you register for the Employment Channel and in the application process for the offered vacancies and, where appropriate, during the selection process in which you are taking part. We obtain other information directly from the tests conducted during a selection process. 

If you do not provide us with the personal data requested, we may not be able to register you as an applicant for employment, process your participation in recruitment processes, process any request, where appropriate, to receive alerts with job or internship offers, comply with our legal obligations and manage our activity. 

Please update your personal data as and when it changes and provide us with accurate information as we need your current details at all times. 

What is the purpose for processing your data and what is the lawful basis? 

To the extent required by local legislation, your personal information will be processed for the following purposes and based on the following lawful bases: 

  • a)    Register as a user of the Employment Channel, manage your account, and communicate with you about your account, based on the execution of the Iberdrola Employment Channel Terms of Use.
  • b)    To allow you to take part in the selection processes (whether for a job or an internship) for which you apply, which includes an analysis of your suitability, and to ensure that you meet the requirements for the job or internship offer, based on the necessity of applying pre-contractual measures or the intention to conclude a contract.
  • Application into a vacancy will entail your incorporation into a database of possible applicants for jobs or internships with the Iberdrola Group, to invite you to take part in pre-selection and selection processes for future vacancies that fit your professional profile for the company to which you have initially applied as well as the rest of the Iberdrola Group companies, based on the legitimate interest of the Iberdrola Group in having a common database of candidates interested in a job or internship in the Iberdrola Group.
  • c)    If you pass the selection process, the Additional Data will be processed to prepare all the prior administrative steps required for hiring an employee or signing an academic agreement, based on the necessity of applying pre-contractual measures or the intention to conclude a contract.
  • d)    To inform you of active vacancies on the Employment Channel if you request to receive job and/or internship alerts, based on the consent you provide when you activate such alerts within the Employment Channel. This consent may be withdrawn at any time in accordance with the provisions of the section “What are your rights?” without retroactive effect.
  • e)    Anonymize and aggregate personal data based on Iberdrola's legitimate interest in being able to exploit large volumes of information while respecting the privacy of the interested parties. Thus, with the resulting information and which will not be considered personal data, Iberdrola Group may prepare internal reports and statistics related to selection process, in order to analyse or study the adoption of common policies or the internal administrative management of the Iberdrola Group and of each of the companies that comprise it.
  • f)    Apply a two-factor authentication system to send you a code that you must include along with your login data to certify your identity when accessing the Employment Channel, based on Iberdrola's legitimate interest in guaranteeing the security of its systems and information.

    
In the specific case of your image in the ID photo, Iberdrola's legitimate interest in carrying out your accreditation for the control and management of access to Iberdrola's workplaces and facilities.

We inform you that when the processing is based on the legitimate interest of any of the Iberdrola Group companies subject to data protection legislation that requires it, these companies have carried out the corresponding balancing analysis between the legitimate interest and the rights of the Data Subject, in order to ensure that the necessary guarantees for the adequate protection of your rights have been taken into account. If you wish to know the conclusions of any of the balancing analysis of the legitimate interest, you can request it to the Data Protection Officer at the address mentioned in the section "Who is the data controller in charge of your personal data”.

Who will your data be shared to?

Your data will be shared to Iberdrola Group companies with the purpose of including you in a database of possible applicants for jobs or internships of the Iberdrola Group, to invite you to take part in pre-selection and selection processes for future vacancies that fit your professional profile based on the legitimate interest of the Iberdrola Group in having a common database of candidates interested in a job or internship in the Iberdrola Group. Such companies in the Iberdrola Group are as listed on the company website:
https://www.iberdrola.com/documents/20125/2931678/gsm23_FinancialStatements_AuditorsReport_Consolidated2022.pdf (Appendix I)

In this context, in the event that the communication of your personal data occurs to Iberdrola Group companies located outside the European Economic Area or United Kingdom, in countries that do not offer an adequate level of protection of personal data equivalent to that established in the European Union and United Kingdom, we inform you that such transfers will be made in accordance with applicable data protection laws and our binding corporate rules ("BCR"). Having BCRs in place means that all entities in our Group that subscribe to them have to comply with the GDPR and the same internal rules. It also means that you have the same rights regardless of where Iberdrola processes your data. You can download a copy of the Iberdrola Group BCRs https://www.iberdrola.com/privacy-policy/binding-corporate-rules.

Your data may also be disclosed to third parties and the authorities, depending on applicable legislation. 

Finally, your personal data will be accessible by third parties that provide services related to the selection process such as the Employment Channel application supplier, the Employment Channel administrator, or personal recruitment services suppliers. We sign contracts required by GDPR with third party service providers which regulate their obligations as data processors. In these contracts, when the companies are located in a third country that does not offer an adequate level of protection of personal data equivalent to that established in the European Union and United Kingdom, Iberdrola will ensure that it has the appropriate measures in place so that your data is protected in the country and organization of destination in identical or similar terms to those provided for in European and Spanish regulations. You may contact Iberdrola at any time to learn about the specific guarantees that have been implemented for the adequate and appropriate protection of your data.

How long will we keep your data?

Your personal data for registering in the Employment Channel will be processed for 3 years from the last access to the Employment Channel.

In case of having applied to a vacancy, and as long as you have not objected to the processing of your data for future vacancies, the data will be processed for 3 years from the end of the selection process.

In case you have given your consent for receiving job and/or internship alerts when you activate such alerts within the Employment Channel, your personal data will be processed until consent is withdrawn.

We will keep the Additional Data if you are successful in joining the organization either as an employee or intern following the relevant selection process, as part of the information retained on you as an employee or intern, as appropriate, but the Additional Data will be deleted from the Employment Channel. Should you be unsuccessful in joining the organization, either as an employee or intern, the Additional Data will be permanently deleted. 

At the end of the above periods, Iberdrola may keep the personal data, blocked, for additional periods as permitted or required by applicable law and until the expiration of the statute of limitations of (i) obligations to which Iberdrola may be subject (including, for such additional periods as may be required by applicable law or regulation, court, administrative or arbitration proceedings, legal, regulatory or audit requirements, etc.), and (ii) potential liabilities arising from the processing itself.

What are your rights?

You have the right to access your personal data and request the correction of inaccurate information and, where applicable, the erasure of data no longer required for the purposes for which it was initially gathered. You also have the right to object to or restrict the processing and portability of the data. Where consent is the lawful basis, you may also withdraw your consent at any time without retroactive effect.

You may exercise these rights free of charge by writing to: CandidateDataProtection@iberdrola.com.

You may view, update, modify and where appropriate delete your data directly by accessing your applicant profile on the Employment Channel, using your username and password. 

Please note that you have the right to lodge a complaint with the Spanish Data Protection Agency or with the competent supervisory or regulatory authority in your country.

You may view the staff recruitment and selection policy here:
-    Spanish version: Política de selección y contratación (iberdrola.com) 
-    English version: Selection and Hiring Policy (iberdrola.com)