We may share your data with other Group companies, which can be consulted on the website under the "Group Websites" section, for administrative and commercial management purposes. We inform you that on some occasions Group companies are located outside the European Economic Area, and therefore, international transfers of your data may occur. In this regard, Elecnor has established appropriate procedures to guarantee the proper processing of your personal data. 

Likewise, we share your data with third-party service providers who process data on behalf of Elecnor, with whom we have established the terms and requirements for using personal data in a contract. At Elecnor, we follow strict selection criteria for service providers in order to comply with our data protection obligations.

On the other hand, we inform you that we will transfer your data to Public Administrations to comply with legal obligations affecting certain processing operations. Outside of these cases, we will not transfer your personal data to third parties, unless it is necessary to comply with an applicable legal obligation. 

V. How long do we keep your personal data?

The personal data you provide us will be kept for the time necessary to fulfill the purpose for which they are collected and, in cases where there could be other possible liabilities, they will be kept for the strictly necessary time according to the legal basis that legitimizes those processing operations.

Likewise, we inform you that your data may remain blocked by Elecnor to handle judicial, administrative, or tax claims, for the periods legally determined by each applicable regulation. 

VI. What are the rights of the data subjects?

We inform you that you may exercise the following rights:

Right of access. The right to request at any time that we confirm whether we are processing your personal data, to provide you with access to them and to information about their processing, and to obtain a copy of said data. 

Right of rectification. The right to request the rectification of inaccurate, outdated, or incomplete personal data concerning you. 

Right to erasure (Right to be forgotten). The right to request the erasure of your personal data when, among other reasons, the data are no longer necessary for the purposes for which they were collected. However, this right is not absolute, meaning Elecnor may continue to keep them duly blocked in the cases provided for by applicable regulations.

Right to restriction of processing. The right to request the restriction of the processing of your personal data when the accuracy, legality, or necessity of the processing is doubtful, in which case we may retain the data for the exercise or defense of claims.

Right to data portability. The right to have your data transmitted to another data controller in a structured, commonly used, and machine-readable format. This right applies when the processing of your personal data is based on consent or the execution of a contract and said processing is carried out by automated means.

Right to object. This right allows you to object to the processing of your personal data, including profiling. Elecnor may decline your right to object only when it demonstrates compelling legitimate grounds for the processing or for the establishment, exercise, or defense of claims.

Right not to be subject to automated decision-making, including profiling. This right allows you not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Except when such decision is necessary for entering into or executing a contract, is authorized by law, or is based on consent.

Right to withdraw consent. In cases where we have obtained your consent for the processing of your personal data in relation to certain activities, you may withdraw it at any time. 

Such rights may be exercised free of charge by the data subject, and where applicable by their representative, by means of a written request addressed to the company's registered office indicated in the first section or by a request via email to: lopd@elecnor.com. Likewise, you can contact our Data Protection Officer at the indicated email address.

The request must include a copy of your DNI (ID card) or other equivalent identification document, as well as the minimum content stipulated by applicable regulations:

• First name and surname of the data subject, photocopy of their national identity document, passport, or other valid document that identifies them.
• The specific request in which the application is materialized.
• Address for notification purposes, date, and signature of the data subject.
• Supporting documents for the request being made.

Elecnor reminds the data subject that they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or the corresponding supervisory authority if they do not agree with the response received regarding their rights.

• Identification data: first name, surname, DNI (ID number), date of birth, image.
• Contact details: postal address, email, landline phone number, mobile phone number.
• Professional and training data: data relating to the curriculum vitae (resume).
• Contractual and labor data: those legally necessary to formalize a contract.
• Images: image recording on the facilities' security cameras.
• Tax and financial data.

VIII. Mechanisms for collecting your personal data

Elecnor collects and processes personal data that you voluntarily provide:

• When maintaining a telephone conversation and other types of written communications or by electronic means.
• When signing a contract or authorization.
• Through security cameras.
• Through both paper and electronic forms.
• When filing a claim.
• Through third parties with whom Elecnor maintains contractual relationships.

IX. What security measures do we have implemented?

Elecnor is committed to complying with its obligation of secrecy regarding the personal data it processes.

Elecnor has implemented the necessary technical and organizational security measures to guarantee the security of your personal data and prevent its alteration, loss, and unauthorized processing and/or access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed, whether from human action or the physical or natural environment, in accordance with the provisions of applicable regulations.

X. Links

Elecnor's website may include hyperlinks to other sites that are not operated or controlled by Elecnor. Therefore, Elecnor does not guarantee, nor is it responsible for, the legality, reliability, usefulness, veracity, and timeliness of the contents of such websites or their privacy practices. Please, before providing your personal information to these third-party websites outside of Elecnor, bear in mind that their compliance with data protection may differ from ours.

XI. Modification of the Privacy Policy

Elecnor may modify its Privacy Policy in accordance with the applicable legislation at any given time. We recommend that each time you visit our website, you consult the Privacy Policy to know at all times how Elecnor processes your personal data.