We may share your data with other companies within the Group, which you can consult on the website under the "Group Websites" section, for administrative and commercial management purposes. We inform you that on some occasions, Group companies are located outside the European Economic Area, and therefore, international transfers of your data may occur. In this regard, Elecnor has established appropriate procedures to guarantee the proper processing of your personal data. 

Likewise, we share your data with third-party service providers who process data on behalf of Elecnor, with whom we have established the conditions and requirements for using personal data within a contract. At Elecnor, we follow strict selection criteria for service providers in order to comply with our data protection obligations.

On the other hand, we inform you that we will transfer your data to Public Administrations to comply with legal obligations that affect certain processing operations. Outside of these scenarios, we will not transfer your personal data to third parties, unless it is necessary to comply with an applicable legal obligation. 

V. How long do we keep your personal data?

The personal data you provide will be kept for the time necessary to fulfill the purpose for which it was collected and, in cases where other potential liabilities could arise, it will be kept for the time strictly necessary according to the basis that legitimizes those processing operations.

Likewise, we inform you that your data may remain blocked by Elecnor for the handling of legal, administrative, or tax claims, during the periods legally determined by each applicable regulation. 

VI. What are the rights of the data subjects?

We inform you that you may exercise the following rights:

Right of access. Right to request at any time that we confirm whether we are processing your personal data, to provide you with access to it and to information about its processing, and to obtain a copy of said data. 

Right of rectification. Right to request the rectification of inaccurate, outdated, or incomplete personal data concerning you. 

Right of erasure (Right to be forgotten). Right to request the erasure of your personal data when, among other reasons, the data is no longer necessary for the purposes for which it was collected. However, this right is not absolute, meaning that Elecnor may continue to keep it duly blocked in the scenarios provided for by applicable regulations.

Right to restrict processing. Right to request the restriction of the processing of your personal data when the accuracy, legality, or necessity of the data processing is in doubt, in which case we may retain the data for the exercise or defense of claims.

Right to data portability. Right to have your data transmitted to another data controller in a structured, commonly used, and machine-readable format. This right applies when the processing of your personal data is based on consent or on the execution of a contract, and such processing is carried out by automated means.

Right to object. This right allows you to object to the processing of your personal data, including profiling. Elecnor may decline your right to object only when it demonstrates compelling legitimate grounds for the processing or for the formulation, exercise, or defense of claims.

Right not to be subject to automated decisions, including profiling. This right allows you not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Unless such decision is necessary for entering into or performing a contract, is authorized by law, or is based on consent.

Right to withdraw consent. In cases where we have obtained your consent to process your personal data in relation to certain activities, you may withdraw it at any time. 

These rights may be exercised free of charge by the data subject, and where applicable by whoever represents them, by means of a written request sent to the company's registered office indicated in the first section or via email to: lopd@elecnor.com. Likewise, you can contact our Data Protection Officer at the indicated email address.

The request must contain a copy of your DNI (National ID) or other equivalent identification document, as well as the minimum content required by applicable regulations:

• Name and surname of the data subject, photocopy of their national identity document, passport, or other valid document that identifies them.
• Specific request establishing the petition.
• Address for notification purposes, date, and signature of the data subject.
• Supporting documents for the request being made.

Elecnor reminds the data subject that they have the right to file a complaint with the Spanish Data Protection Agency (AEPD) or corresponding supervisory authority if they do not agree with the response received regarding their rights.

• Identification data: name, surname, DNI (National ID), date of birth, image.
• Contact details: postal address, email address, landline phone number, mobile phone number.
• Professional and training data: data relating to the curriculum vitae.
• Contractual and labor data: those legally necessary to formalize a contract.
• Images: image recording on the facility security cameras.
• Fiscal and tax data.

VIII. Mechanisms for collecting your personal data

Elecnor collects and processes personal data that you voluntarily provide:

• When maintaining a telephone conversation and other types of written or electronic communications.
• When signing a contract or authorization.
• Through security cameras.
• Through both paper and electronic forms.
• When filing a complaint.
• Through third parties with whom Elecnor maintains contractual relationships.

IX. What security measures do we have implemented?

Elecnor is committed to fulfilling its obligation of secrecy regarding the personal data it processes.

Elecnor has implemented the necessary technical and organizational security measures to guarantee the security of your personal data and prevent its alteration, loss, and unauthorized processing and/or access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed, whether they come from human action or the physical or natural environment, in accordance with the provisions of applicable regulations.

X. Links

The Elecnor website may include hyperlinks to other sites that are not operated or controlled by Elecnor. Therefore, Elecnor does not guarantee, nor is it responsible for, the legality, reliability, utility, truthfulness, and timeliness of the contents of such websites or their privacy practices. Please, before providing your personal information to these websites outside of Elecnor, keep in mind that their compliance with data protection may differ from ours.

XI. Modification of the Privacy Policy

Elecnor may modify its Privacy Policy in accordance with the applicable legislation at any given time. We recommend that every time you visit our website, you check the Privacy Policy to know at all times how Elecnor processes your personal data.