DIGITAL PLATFORM PRIVACY POLICY (IBERDROLA ENERGIE FRANCE)

  • This privacy policy applies to personal data processing by Iberdrola Energie France S.A.S. (hereinafter, "Iberdrola Energie France" or "Iberdrola") on its websites, apps and any other digital platforms or electronic means involving data processing. This policy also applies, insofar as any incidents may occur, to processing the data of users of the social networks on which Iberdrola processes data, according to their relationship with Iberdrola.

  • HOW WILL YOUR PERSONAL DATA BE PROCESSED?

  • Who is responsible for processing your data?

    Iberdrola Energie France S.A.S., registered with SIREN number 509 395 570 and domiciled at 16-18 Rue Londres, 75009 PARIS, is responsible for processing the data provided by the client and for ensuring that they are safeguarded and treated confidentially, in accordance with the provisions of the General Data Protection Regulation ("GDPR") and with any other regulations. The data subject will be entitled to contact the data protection officer to resolve any issues relating to personal data processing, by sending an email to protectiondonnees.commercial@iberdrola.fr.

  • What will we process your personal data for?

    On Iberdrola's digital platforms, the user's personal data will be collected and processed for one or more of the following purposes, depending on the relationship between Iberdrola and the user: Regarding user registration, to enable access to the digital platform, to contractual information and to the contact information made available to users, as well as to enable use of the digital platform and to comply with the legal obligations of Iberdrola Energie France as a service provider. Regarding questions and requests, the data will be used for the purpose of answering and resolving them. Similarly, the user's browsing data and cookies may be processed for the purpose of improving accessibility, customising and analysing browsing, and displaying advertisements according to the user's interests, in accordance with our cookies policy, which users will be required to accept before browsing on our digital platform. Other specific purposes specified in the data collection forms on the digital platform, without which Iberdrola would not be entitled to process the forms in question. Regarding agreements to provide services or goods via the platform, you are advised that the purpose of processing will be to manage your relationship with Iberdrola, provide the services requested, provide our customer care service and, generally speaking, execute contractual obligations. Iberdrola may also check solvency and credit files to assess a client's financial solvency in order to make decisions based on said checks, which may make the entry into force of a contract or its validity conditional upon a payment guarantee. Nevertheless, Iberdrola shall always grant users the possibility to present all and any arguments they consider appropriate to defend their rights and interests. In the event of non‑payment, Iberdrola may make a record of it in said files, pursuant to current regulations.

    Iberdrola may, with the user's consent, update and complete the user's personal data by using data from publicly accessible sources for the purpose of improving the management of its relationship and contact with the user. Iberdrola may also process personal data to offer information by any means available to it, including electronic means, in a segmented and customised manner, regarding the supply of proprietary or third party energy, goods and services promoted by Iberdrola within the field of energy, telecommunications, finance, home and leisure, subject to the user having granted their consent. To this end, Iberdrola may use automated support systems and other means enabling it to establish public profiles for segmenting campaigns, activities and other actions using information from Iberdrola and/or any information from third party sources for this purpose, subject to the user having granted their consent. Regarding clients, these actions may continue to be carried out after the contractual relationship with the client has ended, subject to the client having granted their consent.

    Furthermore, Iberdrola may use data dissociated from the user, always on an anonymous basis, and may continue to do so once their relationship has ended, for the purposes of using it in systems to aid in the company's decision-making and management.

  • How long will we keep your data?

    The personal data provided by the user under goods and service agreements will be processed by Iberdrola throughout the duration of the contractual relationship, which will begin at the time when the agreement is signed and will end, regardless of the established duration, once all of the contractual obligations have been fulfilled, including processing information requests and claims by the client, checking invoices, etc., without prejudice to Iberdrola's obligations regarding storing and retaining data pursuant to applicable regulations, as the case may be. Subject to the user granting their consent, their data may be processed for a period of two years after the agreement has ended, or after their registration has been cancelled if no agreements were entered, without prejudice to Iberdrola's obligations regarding retaining data pursuant to applicable regulations to comply with its data processing responsibilities. In the absence of such consent, the data retention period will be two years as from the gathering thereof, without prejudice to the data processor's duty to safeguard and/or retain data pursuant to applicable regulations, as the case may be.

  • On what grounds is your data processing lawful?

    The lawfulness of processing your data lies in the consent obtained from you as the data subject, deriving from the use of the digital platforms, from service and/or goods agreements, from applicable regulations on the provision of electricity, gas and similar goods and services, and from any other justification applicable at any given time. User consent is obtained both at the time when the user registers and upon entering any agreements or making any requests on the digital platform, but may be modified or revoked by the user at any time by exercising their rights. For clients with existing agreements, processing may also be justified based on Iberdrola's legitimate interests relating to the provision of proprietary electricity, gas and related goods and services; loyalty programmes including sports, cultural and charity programmes in which Iberdrola is involved; profiling to offer similar goods or services to those that are the subject of the agreement; and to disclose their data to third parties for the purpose of administrative procedures enabling the client's admission, or to deal with fraud prevention, claims and sums outstanding.

    The concept of legitimate interests comprises processing personal data to ensure security and controlled access to ancillary information systems. If the completion of any contractual procedures or specific requests requires the user to provide personal data belonging to others, the user must expressly inform said data subjects in advance of the content of this policy and obtain their prior consent for the processing of their data. In order to sign up as a user on Iberdrola's digital platforms, the user will be required to declare that they are of legal age, given that access thereto by minors is not permitted. Therefore, by signing up, users declare and guarantee that they are of legal age. In any case, Iberdrola waives any liability for processing the data of minors without the consent of their parents or guardians.

  • Who will receive your data?

    Regarding contracts, the data needed to manage access to the network will be sent to the network manager and included in a file under his or her responsibility (supply point information system), which may be accessed by authorised parties pursuant to the regulations applicable at any given time. Iberdrola also works with third party service providers, such as distributors, administrative assistants, telephone hosting services, banks, debt collectors, marketing and publicity associations, auditors and other parties, who may access the data in certain cases for processing purposes, subject to the necessary guarantees. In the event of non-payment by the client, Iberdrola may report this to the holders of solvency and credit files, pursuant to applicable regulations. Iberdrola may also transfer data to the competent authorities and organisations pursuant to its legal and tax-related obligations. Data relating to possible supply contracts will also be reported to the tax authorities for the purposes envisaged in applicable tax laws. Furthermore, according to the laws applicable to vulnerable consumers, the data pertaining to such clients may be disclosed to the organisations in charge of protecting vulnerable consumers for the purpose of applying the measures envisaged, and/or to any other administrative bodies for the legally established purposes.

    Users may contact Iberdrola through its profile on social networks such as Facebook and Twitter, which are located in the USA. In such cases, data transfers will be covered by the EU-US Privacy Shield framework (see https://www.privacyshield.gov/welcome for further information) or by the express consent of the data subject, as the case may be.

  • What rights do you acquire upon providing your personal data to us?

    Access to certain services is conditional upon you signing up as a digital platform user. The data requested in the registration form are provided freely and voluntarily, and must therefore be true and accurate. The user undertakes to use their user ID and password carefully and not to reveal them to third parties, and also to inform Iberdrola as soon as possible of any loss, theft or risk of access by third parties. The data provided by the user for service or goods agreements are necessary in order to carry out the contractual relationship. Failure to provide them will make it impossible to hold said relationship. The user is responsible for the veracity of the data provided and must ask that they be modified whenever necessary to ensure they are properly processed, the services contracted are rendered correctly and communication can be made. The user may exercise their rights of access, rectification or, where applicable, erasure of their data, for instance, when they are no longer necessary to serve the purposes for which they were gathered. The user may demand the restriction of the processing of their data in the circumstances envisaged in article 18 of the GDPR, in which case they will only be retained for the purpose of exercising or challenging any eventual claims. The user may, at any time, withdraw their consent and object to the processing of their data for certain purposes, with this not affecting the lawfulness of the data processing carried out based on the consent granted before withdrawal, or may alternatively oppose processing altogether, in which case they will only be preserved for the purpose of exercising or challenging any eventual claims. The user may contact Iberdrola to challenge any decisions that they consider may affect their rights and freedoms or legitimate interests, and which were made based on an automated decision, including profiling. This right enables the user to challenge the decision in question and to obtain a direct response from Iberdrola's managers. The user may claim the portability of their personal data and obtain an electronic copy thereof from Iberdrola, either by writing to the email address provided or through the corresponding section of the Iberdrola website.

    All of the foregoing rights can be exercised by writing to Iberdrola Energie France, S.A.S. - to the attention of the Data Controller at 16-18 Rue Londres, 75009 PARIS -, or by any other means of communication established by Iberdrola: Customer Care line: 0 800 902 471; email: protectiondonnees.commercial@iberdrola.fr; 'My customer space' on www.iberdrola.fr, providing your credentials, a postal address or email address, the reason for your request and any justifying documents. You will be required to provide some form of ID. If you do not receive the desired response or if you are not satisfied, Iberdrola informs you of your right to file a claim with the CNIL (French National Information and Freedoms Commission).

  • Security measures

    Access to digital platforms by means of which the user of the website or app enters agreements involving Iberdrola goods and/or services will be done within a secure environment. To verify that you are on our website, check that the word 'Iberdrola' is shown in the browser bar at the top. You can also verify that you are in a secure environment by checking the URL address under properties (right click). The URL starts with "https", with the 's' ensuring that the content offered by the server is secure.

  • Links

    In certain cases, Iberdrola's digital platforms include links to third party digital platforms or content. Said links are solely intended to provide the user with the option of obtaining further information through said links. Iberdrola takes no responsibility for the consequences that may arise from the user's access to said links. The user and, generally speaking, any individual or corporate body intending to establish a link between their digital platform and one belonging to Iberdrola must seek written authorisation from Iberdrola in advance. The presence of a link does not in any case entail the existence of a relationship between Iberdrola and the owner of the platform to which the link leads, nor the acceptance or approval by Iberdrola of their contents or services.