1. Identification and Contact Details of the Data Controller

The companies of the ELECNOR GROUP to which this Privacy Policy applies equally are listed below:

ELECNOR is one of the leading global corporations in the development, construction, and operation of projects through two business lines that complement and enrich each other: Infrastructure and Concessions.

You can contact ELECNOR through the following channels:

• In person or by postal mail addressed to the headquarters located at Paseo de la Castellana 81 planta 20º, 28046, Madrid.
• By email sent to lopd@elecnor.com.
• Through the different contact methods for the headquarters and branches defined on the website: https://www.elecnor.com/contacto.

2. For what purpose do we process your personal data and on what lawful basis?

Your personal data will be processed by ELECNOR for the purposes and based on the lawful grounds indicated below:

• CCTV / Video Surveillance: For security reasons, there are security cameras recording access to our facilities. In this case, the legal basis for processing is ELECNOR's legitimate interest in keeping its facilities secure.
• Clients and Contacts: We process our clients' data for their administrative and accounting management and for conducting satisfaction surveys. The legal basis that legitimizes this processing is the performance of a contract and the legitimate interest related to commercial and business relations, marketing, and quality management.
• Suppliers: We process our suppliers' data to manage the contracted services and their economic-administrative management, as well as to conduct satisfaction surveys. The legal basis that legitimizes the data processing is the performance of a contract and the legitimate interest linked to commercial and business relations and quality management.
• Information Requests: Personal data provided through the contact form will be processed for the purpose of attending to and managing the request for information, query, or doubt raised. If the corresponding box is ticked, it will be used to manage the contact request and/or arrange a meeting. The legal basis is the application of pre-contractual measures at the request of the data subject.
• Recruitment / Selection of Personnel: We process candidates' data for the management of recruitment processes for job vacancies at ELECNOR, based on the consent of the data subject and the application of pre-contractual measures.
• Access Control: We process data of individuals visiting our facilities based on the legitimate interest regarding facility security and controlling visitors at any of ELECNOR's buildings and offices.
• External Personnel: We process data of subcontracted personnel or those belonging to a contractor based on the compliance with a legal obligation, specifically Law 31/1995, of November 8, on the Prevention of Occupational Risks.
• Internal Information System: We process data through our internal whistleblowing channel in compliance with a legal obligation, specifically Law 2/2023, of February 20.

In addition to the aforementioned processing, certain companies carry out specific operations. ELECNOR, S.A. processes personal data of its shareholders in compliance with applicable legal obligations, and APLICACIONES TÉCNICAS DE LA ENERGÍA, S.L. processes data for the sale of products to individuals through the website based on the performance of a contract and consent.

Furthermore, ELECNOR carries out other types of processing related to human resources management that are not detailed in this Privacy Policy.

3. Accuracy of the Data Subject's Information and Compulsory Nature of the Provided Information

Regarding all data you communicate to us, you guarantee its authenticity and undertake to keep said information updated. You will be the solely responsible for any false or inaccurate statements you make and for any damages you may cause to ELECNOR as a result.

4. Recipients

We may share your data with other group companies (which you can check under the "Group Websites" section) for administrative and commercial management purposes. Please note that, on some occasions, group companies are located outside the European Economic Area (EEA), meaning international data transfers may occur; ELECNOR has established appropriate procedures to ensure secure processing.

On the other hand, we will transfer your data to Public Administrations to comply with legal obligations. Outside of these cases, your personal data will not be transferred to third parties, unless required by law.

5. How long do we keep your personal data?

Personal data will be kept for the time necessary to fulfill the purpose for which it was collected and to address potential legal liabilities.

Likewise, your data may remain blocked by ELECNOR for the handling of judicial, administrative, or tax claims during the legally established timeframes.

6. What are the rights of the data subjects?

We inform you that you may exercise the following rights before the data controller:

Right of access:

The right to confirm whether we are processing your data, to access it, obtain information about its processing, and receive a copy of said data.

Right to rectification:

The right to request the correction of inaccurate, outdated, or incomplete data.

Right to erasure (Right to be forgotten):

The right to request the deletion of your data when it is no longer necessary. ELECNOR may keep it duly blocked in accordance with applicable regulations.

Right to restriction of processing:

The right to request the limitation of processing when the accuracy or legality of it is in doubt, keeping it exclusively for the exercise or defense of claims.

Right to data portability:

The right to receive your data in a structured, commonly used, and machine-readable format, or transmit it to another controller, when processing is based on consent or a contract and is carried out by automated means.

Right to object:

Allows you to object to the processing of your data (including profiling). ELECNOR may only refuse it by demonstrating compelling legitimate grounds or for the defense of claims.

Right not to be subject to automated decision-making:

The right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you in a similar way, unless necessary for a contract, allowed by law, or based on your consent.

Right to withdraw consent:

In cases where processing is based on your authorization, you may withdraw it at any time in a straightforward manner.

These rights may be exercised free of charge by the data subject (or their representative) via a written request addressed to the company's registered office or via email at: lopd@elecnor.com. You can also contact our Data Protection Officer (DPO) at the same address.

ELECNOR reminds the data subject that they have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider their rights have been violated.

9. What security measures do we have implemented?

ELECNOR is committed to fulfilling its duty of secrecy regarding the personal data it processes.

To this end, it has implemented the necessary technical and organizational security measures to ensure data integrity and prevent its alteration, loss, unauthorized processing, or access, taking into account the state of technology and the risks to which it is exposed.

10. Links

The website may include hyperlinks to sites that are not operated or controlled by ELECNOR. Therefore, ELECNOR does not guarantee nor is it responsible for the legality, reliability, and timeliness of the contents of such websites or their privacy practices.

11. Modification of the Privacy Policy

ELECNOR may modify its Privacy Policy in accordance with the applicable legislation at any given time. We recommend that you consult this policy periodically whenever you visit our website.