PRIVACY POLICY

April 2020 Version

1. General information
The Enagás Group would like to inform you about how we collect and process your personal data, through this Privacy Policy. This is how we comply with the principle of transparency stated in the current regulations on personal data protection.
We hereby inform you that your data will be processed in accordance with Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights and with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).
This policy applies to all personal data processing undertaken by any Enagás Group company through their Websites and in the services where it is indicated.
However, it does not apply to third-party websites, including external websites accessed via links on our websites.

2. The Data Controller
The main entity responsible for processing your data is Enagás S.A. (hereinafter, Enagás). However, your data may be processed by the member companies of Enagás depending on the relationship you have established with each of the companies. When your data is collected, you will be informed of the identification details of the company responsible for the processing. The locations and functions of the member companies of the Enagás Group can be found at http://www.enagas.es.
In addition, we would like to inform you that if you have any queries in connection with the processing of your data by Enagás, you can email us at protecciondedatos@enagas.es or write to our headquarters at Paseo de los Olmos 19, 28005 Madrid, Spain.
3. Personal data we process and how we obtain the data
By way of example, we may process the following personal data by the following means:
Data that you voluntarily provide to us through e-mail addresses in the “Contact Us” sections of our website(s) or data extracted from your communications with us.
Data that you send us to register as a user of our products or services, where you have been previously informed of the applicable conditions.
Should you access our premises, we will process your image through our video surveillance system to protect the people in the Enagás building and the Enagás facilities.
Data from your interactions on social media, such as when you comment on Enagás posts or pages, and data relating to your account that can be used to identify you.
When you provide personal data relating to a third party, you warrant that you have obtained their consent to provide us with their data for the purposes set out in this Privacy Policy.
If you apply for a job, by sending a speculative letter in response to the publication of Enagás’ personnel selection processes on any of our web pages.
When you choose to be a candidate or competitor in other types of projects or initiatives undertaken by the Group, such as those related to support for entrepreneurs, specifically, at the date of publication of this policy, the following call: https://callenergiapositiva.com/
When special conditions apply to the processing, you will be informed specifically of the processing operation and purpose, and these conditions shall prevail over this Privacy Policy.
4. Purpose and legal basis for processing
As an example, you are hereby notified that Enagás may process your personal data for the following purposes and with the following authorisation :

a) Customer, user or interested party management service

You can find our contact details on the website – for communication by post, telephone or e-mail. Through these channels, we will process your data to answer the questions, suggestions or complaints you send us. The legal basis authorising the processing is the performance of the contractual or pre-contractual (contract request) relationship itself.

b) Surveys and events
Once you have visited our facilities or used or subscribed to our services, we may use your professional contact details to manage your relationship with Enagás and inform you about all kinds of company events that may interest you, and to carry out surveys on our services. This processing is based on Enagás’ legitimate interest in managing and maintaining its professional relationship with you and in informing you of the services in which you have shown interest and/or a level of satisfaction. Likewise, in the event that you attend an event of a personal nature, we may use your details for the purpose of attending an event organised by the Enagás Group, and in such cases, we may take images of the event in order to publish them on our website. For this purpose, we will inform you beforehand so that you can decide on this matter. In this case, we will use your consent as the legal basis for the use of your details.

c) Entrepreneurship projects and initiatives

Through the pages listed below, we can receive the projects you send us in accordance with the Enagás Corporate Entrepreneurship and Innovation Programme or other initiatives that Enagás organises, coordinates or participates in related to these sectors or areas.
This processing is authorised in Enagás’ interest in offering you information regarding your application, participation and evaluation of your project in the Programme and in providing you with the corresponding follow-up:
Websites related to entrepreneurship:
http://www.emprende.enagas.es
https://callenergiapositiva.com/
https://ingeniaenergychallenge.com/

We hereby inform you that if you participate in this type of project as a candidate or competitor, your image may be captured or recorded for illustration and information about the selection processes, competitions and progress of your project in the initiative, so that you can be informed about it and you will need to give us your explicit consent at the appropriate time.
We hereby inform you that as a candidate for these projects, your data may be shared with third parties collaborating in the project or initiative but that the Enagás Group will be responsible for the processing and for formalising the related data processor contracts with these third parties to enable them to obtain the authorisation to process the data for Enagás.
d) Management of data relating to contract representatives and potential clients
In order to manage and fulfil the contractual relationship we have with companies such as marketers, distributors and/or suppliers, we process the contact details of their representatives. This processing is therefore based on the performance of the contract between both parties.

Similarly, we process the details of potential customers such as legal entities, representatives of institutions, representatives of public bodies, journalists, analysts or investors and shareholders who have provided us with their details. The legal authorisation of the processing in these cases will be the consent provided by the interested party.

e) Relationship with suppliers
Enagás may process employee data held by the supplier (either through the supplier or through the employee him or herself) in order to guarantee the quality of the service provided by the supplier, to facilitate access to Enagás’ facilities and in compliance with legal obligations regarding Social Security. The legal basis for this processing is our legitimate interest in monitoring the relationship with our suppliers and the responsibilities associated with these relationships.

f) Enagás’ news or publications
We will use your identification data to receive news or publications on Enagás Group activities through your subscription to our Newsletter. We will only use these details if we have your consent, which is the legal basis for such use.
g) Job offers
We usually publish job offers and have a channel where we also receive speculative applications. If you contact us and show interest in joining Enagás, we will process your data, together with all the documentation you send us, to evaluate your profile and consider you for possible vacancies within Enagás. This means that we may share your information with the Group company that has the vacancy. The basis for this processing will be your consent, which will be provided by you filling in a form and submitting your application.
h) Training
We organise training programmes not only for our employees but also for third parties. If you take part in training organised by Enagás, we will process your data for the purpose of managing your participation and gauging your satisfaction with the training.
If we wish to publicise the training, we may capture your image by means of photography or recording. You will be informed about this beforehand and we will also request your specific consent to use your image to illustrate or publicise our training.

The legal basis of the processing is our legitimate interest in promoting the exchange of knowledge and skills by our employees, or if you are not an employee, your consent expressed through your registration for the training.

i) Control of access to our premises
When you access our facilities, we process your data because we control all visits. In this case, Enagás is authorised by its legitimate interest in ensuring security in the establishments of the Enagás Group.

j) Video surveillance
Our facilities are fitted with video surveillance cameras to ensure the security and safety of the Group’s people and facilities. The legal basis for the data processing is our legitimate interest in preventing or investigating, as the case may be, any incidents occurring in our establishments against Enagás’ people or facilities.

k) Responsibilities
In order to comply with fiscal, commercial, labour and/or administrative obligations we will process your data when necessary. The legal basis of this processing is compliance with our legal obligations in each case.
l) Automated processing
You are informed that your data will not be processed in order to take decisions about your information based solely on automated processing – automated decisions – including profiling. This means that decision-making does not include automated – and non-human – profiling of your personal data to evaluate personal aspects relating to you, such as analysing or predicting aspects relating to economic situations, health, personal preferences or interests, reliability or behaviour, the situation of the data subject, all to the extent that it has legal consequences for you or significantly affects you.
In any case, it would only apply where a law requires it and, where appropriate, such processing would be subject to appropriate safeguards, including information specific to you as a data subject and the right to obtain human intervention where appropriate; also to express your point of view, to receive an explanation of the decision taken following such an assessment and to challenge the decision where appropriate.

5. Data retention
We will hold your personal data for the time necessary to comply with the purpose for which the data was collected, such as managing a consultation, complaint or claim or while the contractual relationship with you is ongoing, provided that you do not exercise the right of deletion and your data is not to be deleted in fulfilment of a legal obligation or exercise and defence of claims. In each specific case, you will be informed of the criteria or duration of processing.

After this relationship, we will keep your data locked but made available to government agencies, judges and courts for any criminal, civil, commercial and/or administrative responsibilities that may arise from the processing, and for the exercise and defence of claims against the Spanish Data Protection Agency.
6. Disclosure of data
If Enagás plans to divulge your personal data, we will inform you when the data is collected about the identity or categories of recipients to whom we may communicate the data. For example:

– Third parties to whom we must communicate your data under a legal obligation, for example, government, tax or social security authorities.
– Third parties to whom we have to disclose your data to fulfil the basic purposes of the relationship.
– Other companies in the Enagás Group, where applicable, to fulfil the purposes described above.
– Entities that subsidise training activities, as part of processing for training purposes.

Furthermore, we also maintain relationships with third party providers who, as data processors, supply us with certain services. Enagás, for its part, requires that they comply with guarantees when processing your data, and concludes with them the corresponding contracts with the clauses that regulate their role as data processors.

In the event that such access is undertaken by companies from countries outside the European Economic Area (EEA) that do not offer a suitable level of protection similar to that of the EEA, we will avail ourselves of one of the guarantee mechanisms established by the GDPR, requiring those who agree to comply with the provisions of these regulations.

7. Security of your data
With the aim of safeguarding the security of your personal data, we inform you that Enagás is adopting all the technical and organisational measures necessary to guarantee the security, integrity and confidentiality of the personal data provided in order to avoid its alteration, loss and/or unauthorised processing or access.

To guarantee the security of our Website, we have put in place a security system enabling us to maintain the confidentiality and integrity of the data of our Users, sent or collected through the means mentioned in the first point.
The Enagás Group therefore maintains the data protection security levels required by Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights and the European Data Protection Regulation 679/2016, of April 27, and has deployed all the technical resources available to it to prevent the loss, misuse, alteration, unauthorised access and theft of the data that the User provides through our Website(s).
Also, as a User of our platform you understand, accept and acknowledge that Internet security measures are not impregnable and that, therefore, you are required to adopt the necessary security measures to enable you to trust the truthfulness of the Web page on which you are entering your data. We will also do our utmost to guarantee the privacy and security of your identification data at all times, always using the maximum diligence and implementing the necessary measures.
We therefore inform you that you will be solely responsible for the security measures that you implement in relation to the protection of your data. Enagás is not responsible for situations where the User has not implemented the corresponding security measures, nor for their consequences, nor for causes or damages caused by third parties outside the company, including unforeseeable circumstances and/or force majeure.
In accordance with the above, the Enagás Group cannot guarantee that unauthorised third parties will not gain awareness of the type, conditions, characteristics and circumstances of the use that Users make of the services offered on the Platform. However, as a measure, conditions of use have been set out in our Legal Notice.
In order to keep your personal data up-to-date in our Record of Processing Activities, you are required to inform us of any changes to your personal information, otherwise we cannot accept responsibility for data that is not accurate or truthful, or for the consequences this may have for the Enagás Group or third parties.

8. Processing of your data in social media
Enagás has a presence on social media through different corporate profiles. So, if you decide to share personal information in these forums, your data will be processed in accordance with this Privacy Policy.
Specifically, the data that you provide us with through any of our social networks will be processed by Enagás S.A., with registered address at C/ Paseo de los Olmos No. 19, Madrid, in order to relate and interact with you through the different social networks so that you can learn more about our activities or skills and/or so that we can respond to your questions or requests.

The legal basis of this processing is your status as a “user”, “friend” or “follower” of our social profile or the need to respond to you if you mention our profile in your comments, even if you are not following us; in the latter case, we will process the minimum data needed to respond to you.

We hereby inform you that, once you have stopped “following” our profile on the social network, we will keep your data for a period of 2 years, unless a law requires otherwise.

However, you should bear in mind that, when interacting with us through social networks, the conditions of use established by each social network are beyond our control and are not covered by the content of this policy. We therefore recommend that you ensure that you know and agree to its legal conditions and privacy regulations before continuing to use it or providing any type of personal information.

However, we recommend that you avoid including your own or third party personal information when interacting with us on social networks.
With regard to the cookie policy used by these social networks, you must abide by what is established on each of these platforms or social networks, notwithstanding the provisions of our Cookie Policy. [INSERT LINKS TO COOKIES]

9. Minors
Generally, Enagás does not process the personal data of children aged under 18 years. Both the content and the services it offers are normally aimed at people aged over 18 years, as stated in our Legal Notice. [INSERT LINKS TO LEGAL NOTICE]
However, there may be corporate events in which, in some cases, the data of minors is processed. In such cases, we will not process their data (name, surname, photograph, image, etc.) without first notifying the minor’s parent or guardian about processing and obtaining their consent and authorisation if the minor is aged under 14 years.
Enagás accepts no responsibility for personal data published by minors on our social media pages without their parents’ or guardians’ consent.

10. The data subject’s rights
At any time, you may exercise your rights of access, correction, deletion and/or to be forgotten, portability, limitation, opposition to the processing of your data and not to be subject to automated decisions, when appropriate, by sending your request to protecciondedatos@enagas.es or to the address: Paseo de los Olmos 19, 28005 Madrid, providing a copy of your ID card or equivalent document and, specifying your request, specifying which of these rights you want to be satisfied.

In the event that you act through a legal or voluntary representative the latter must also provide a document proving the representation and their identification document.
We briefly explain what each of the rights you can exercise involves:

Access
Through the exercise of this right you can find out which of your personal data is being processed by the company; its purpose, origin or possible transfer to third parties
Correction
This involves being able to edit your personal data where inaccurate or incomplete. Your request must specify the data you wish to be changed
Deletion
This allows your personal data to be deleted as inappropriate or excessive
Opposition
You have the right to object to the processing of your data in cases such as: advertising and business prospecting activities or when the purpose of such processing is to obtain a decision relating to you based solely on the automated processing of your personal data
Portability
You may receive your personal data in a structured, commonly used and machine-readable format and you may transfer them to another controller, if technically possible
Right to be Forgotten
You may ask for your personal data to be deleted without due delay in any of the above cases, e.g. illegal processing of data, or when the purpose for which the data were processed or collected has disappeared
Limitation on processing
In general, in cases where it is not clear whether personal data should be deleted, you can exercise your right to limit the processing. This right exists in the following cases: (i) when the accuracy of the data concerned is in doubt; (ii) when you as a User do not want the data to be deleted, (iii) when the data are no longer necessary for the original purpose, but cannot be deleted for legal reasons, (iv) when the decision to object to the processing is pending.
The limitation means that your personal data may (except for retention) only be processed with your consent for the drafting, exercise or defence of claims, with a view to protecting the rights of another natural or legal person or for reasons of public interest of the EU or a certain EU Member State. As a User you must be informed before the lifting of such limitation
Likewise, if you have provided us with your consent for any specific processing, you can revoke the consent you have given us for any specific purpose at any time by sending the request to the address protecciondedatos@enagas.es or to the postal address specified above.

You can view the templates, forms and further information on the rights referred to on the official website of the Spanish Data Protection Agency.
If you believe your data have not been processed correctly by the Enagás Group, you may send a complaint to the inbox of our Group, for the attention of our Data Protection Officer: proteccióndedatos@enagas.es or to the data protection authority which, in Spain, is the Spanish Data Protection Agency (www.aepd.es).

11. The data subject’s responsibility
We are not responsible for the truthfulness, inaccuracy, updating and/or authenticity of the data you provide, or for any consent given. Likewise, Enagás is not responsible for any third party data you have provided us with without obtaining their consent.

12. Changes to this Privacy Policy

We may change this Policy at any time. We shall inform you of any significant change to it. We will process your data in accordance with the new version of the Policy so we recommend that you consult it periodically.
13. Inclusion with other legal texts
This privacy policy is supplemented by the Legal Notice and the Cookie Policy associated with our Website(s).
[INSERT LINKS TO LEGAL NOTICE AND COOKIES]