IBERICA PRIVACY POLICY

Last update: 14/07/2022

SOLARPROFIT IBERICA, S.L.U.  (hereinafter "IBERICA") with Tax Identification Number B-88597539 and registered office at C/ Francisco Alonso 9 - Polígono Industrial La Gar 28806 - (Alcalá De Henares) - Madrid, duly registered in the Companies Register of Madrid in Volume 40182, Sheet 145, Page M-714008, informs you by means of this Privacy Policy how your personal data will be treated.

As a rule, the completion of all the data requested by IBERICA is necessary to achieve an optimal provision of the services made available to the User. If all the required data is not provided, IBERICA does not guarantee that the information and services provided will be able to be provided, will be provided correctly or will meet the needs of the client or user.

The term User/s is used here to refer to all persons of legal age who are customers or potential customers of IBERICA.

BASIC INFORMATION ON DATA PROCESSING

DETAILED INFORMATION ON DATA PROCESSING

1. Identity and contact details of the Data Controller

In accordance with the terms of the applicable data protection regulations and, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR"), Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (hereinafter, the "LOPDGDD") and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (hereinafter, "LSSICE"), the Data Controller is:

2. Compliance with applicable regulations

IBERICA has adapted its activity in accordance with the GDPR and the LOPDGDD. To do so, it has implemented those policies, measures and technical and organisational procedures to guarantee and protect the confidentiality, integrity and availability of your personal data.

The transmission of data by the user, client and potential clients of IBERICA's services (hereinafter, jointly, the "User"), whether by automated or non-automated means, is carried out voluntarily and the User is informed prior to processing of the use and purposes of the same.

3. The principles we apply to your personal information

The data supplied to IBERICA by different measures, online or offline contact forms or any other procedure used to collect your data, will be carried out in accordance with current data protection regulations, and with the sole purpose of providing the service you have been informed about.

In the processing of your personal data, we apply the following principles that comply with the requirements of the GDPR:

• The principles of lawfulness, fairness and transparency: We will always have a legal basis for processing your personal data for one or more specific purposes, which we will inform you about in advance in full transparency. IBERICA hereby notifies you that only the information necessary to achieve the purpose of the processing is collected, and only the data you have provided will be processed for the purpose(s) for which you have been informed.
• The data minimisation principle: We will only ask you for data that is strictly necessary in relation to the stated purposes.
• The principle of limitation of the term of retention: Personal data shall be kept for the time strictly necessary to the end of the purpose for which they were collected, and as long as the cause that made the processing of these personal data legitimate is maintained. When the reason that legitimised the processing has ended, the personal data will be kept securely stored for the term of the statute of limitations for any actions that may arise from the relationship between the parties and/or the legally stipulated storage periods.
• Principle of integrity: Your data will be processed in such a way as to ensure adequate security of personal data and to guarantee confidentiality. You should be aware that we take all necessary precautions to prevent unauthorised access or misuse of data by third parties.
• Principle of confidentiality: In its capacity as Data Controller, IBERICA guarantees the confidentiality in the processing of all the User's personal data to which it has access. As with any other person involved in any phase of the processing, the Data Controller is subject to the strictest professional confidentiality, with a special commitment to adopt the necessary levels of protection and measures, both strategy and organisational, to guarantee the security of personal data and to avoid its alteration, misuse, loss, theft, unauthorised processing or access.
• Principle of data accuracy: All information provided by the User to IBERICA must be truthful, and the User will be solely responsible for any false or inaccurate statements made and for any damages caused to IBERICA or third parties.

IBERICA reserves the right to exclude any User who has provided false data from the services, without prejudice to any other legal action that may be appropriate.

4. Processing of personal data

4.1. Collection and processing of personal data

In providing us with their data through the Website, online or offline forms or by any other means, the User guarantees that they are truthful, exact, complete and up to date, and shall be liable for any direct or indirect damage or harm that may be caused as a result of non-compliance with this obligation.

When providing IBERICA with third party data, the User must have the consent of the third party and undertake to provide them with the information contained in this clause, exempting IBERICA from any responsibility in this regard. IBERICA may, however, carry out the necessary verifications to verify this fact, adopting the corresponding due diligence measures, in accordance with data protection regulations.

4.2. Purposes of processing

IBERICA processes the User's personal data for the following purposes:

Upon termination of the legitimate grounds for the processing of your data, said data may be kept duly stored and will not be processed unless it is necessary for the submission, exercise or defence of claims or when it is required to provide the same to the Public Administration, Judges and Courts during the period of limitation of their legal rights or obligations.

4.3. Data Category

In accordance with the purposes mentioned above, IBERICA collects and processes the following categories of User data:

1. Identification and contact details: name, surname and email address.
2. We also collect certain information related to your navigation through cookies. Their treatment and purposes are explained in our  Cookies Policy.

Other User data obtained from the consultation itself or from the commercial relationship, which are necessary for the management of the pre-contractual relationship and for the resolution of the consultation, may be gathered and processed.

Under no circumstances will the User communicate data of any special nature (such as, for example, health data, religious data, etc.). In the event of doing so, the User exempts IBERICA from all liability. In the event that unsuitable queries or content are submitted, IBERICA will promptly remove them.

5. Data processing by third parties and transfer

Depending on the purposes for which personal data are collected, your personal data may be processed by:

• Authorised IBERICA personnel or their representatives acting on their behalf, subject to the applicable data protection regulations in force.

• Grupo Solar Profit entities, when strictly necessary to carry out the purposes of the reported data processing and for internal administrative purposes.

The entities that currently make up the Solar Profit Group are: Solarprofit Sales, S.L.U.; Solar Profit Energy Services S.L.; PROFITHOL, S.A.; Ingenia Ambiental S.L.U.; SOLARPROFIT IBERICA, S.L.U.; and Solarma Sistemas de Control y Seguridad S.L. Any changes to the structure of the Grupo Solar Profit will be communicated through this privacy policy.

• Third parties with which Grupo Solar Profit maintains collaborative relationships and/or other entities that offer products and services related to the sector, as well as products and services from other sectors that may be of interest to the User, as long as the interested party is informed of the processing of their data beforehand and consent or another legitimate basis has been obtained in accordance with this policy.

• Public Administrations, Public Authorities and Bodies, including Courts and Tribunals, when required by the applicable regulations.

• Third-party external service providers that IBERICA contracts and that have data processor status [IT service providers that process information, hosting servers, database support maintenance, software and applications]. This is only after we have taken steps to ensure that we can share such information in compliance with data protection regulations.

In the event of a sale, merger, consolidation, change in corporate control, substantial transfer of assets, reorganisation or liquidation of IBERICA, we may, at our discretion, transfer, sell or assign the information collected on the Site to one or more other relevant parties.

6. Security measures

IBERICA applies the security levels required by GDPR, appropriate to the nature of the data that are processed at any given time due to its activity. In this sense, it uses encryption techniques that do not allow a third party to trace the identity of the User interacting with our services. Similarly, it may also carry out secure anonymisation strategies for the personal data it processes in order to carry out its activities. Notwithstanding, the strategy in a medium such as the Internet is not infallible and there may be fraudulent activities by third parties, although IBERICA uses all the means at its disposal to avoid such actions.

7. International data transfer

No data is disclosed to third parties outside the European Economic Area. In this sense, IBERICA takes appropriate technical and organisational measures to guarantee data security. It also requires its third party service providers and partners, where applicable, to have adequate safeguards in place.

Should it be necessary to make an international transfer of your data, IBERICA ensures that (i) such personal data are transferred to countries offering an equivalent level of protection, or (ii) the transfer is made in accordance with appropriate safeguards, for example, by adopting the standard data protection clauses established by the European Commission.

8. The rights of data subjects and the exercise of these rights

In accordance with both the GDPR and the LOPDGDD, Users may exercise the following rights:

• Right of access: The User may ask IBERICA if it is processing their data and, if so, access them.
• Right of rectification: The User may request rectification of the data if it is inaccurate or incomplete.
• The right to request the erasure of their data, where possible. However, as soon as the User exercises this right, all personal data linked to his/her account, as well as the information and content included in his/her profile, will be deleted and will remain stored until the end of the legally stipulated term. Similarly, in the event that the User exercises the right to suppress the data necessary for IBERICA to be able to provide the contracted services, IBERICA will be obliged to terminate its relationship with the User, removing him/her from the list, without the right to any claim whatsoever on the part of the User.
• Right to request the limitation of processing: In this case, we will only retain them for the exercise or defence of claims.
• Right to object to processing: IBERICA will stop processing personal data, with the exception that they must continue to be processed for reasons of compelling legitimate interest or for the exercise or the defence of possible claims.
• The right to data portability: In the event that the User wants their data to be processed by another data controller, IBERICA will facilitate the transfer of their data to the new data controller provided that both have the necessary technical means to do so.
• The right not to be subject to a decision based solely on automated processing of their personal data.
• Right to revoke consent: If the User has given consent for a specific purpose, he or she may withdraw such consent at any time, without this affecting the lawfulness of the processing based on the consent prior to its withdrawal.
• Right to make a complaint with the Spanish Data Protection Agency: If you consider that a breach of data protection legislation has been committed with regard to the processing of your personal data (https://www.aepd.es/es)

To exercise your rights, you can use the templates and forms available on the Spanish Data Protection Agency's official website (https://www.aepd.es/es/derechos-y-deberes/conoce-tus-derechos), and write to IBERICA's Data Protection Officer at the following email address: dpo@solarprofit.es, REF: "Data Protection".

9. User Consent

The User declares to have read and expressly accepted this Privacy Policy and accepts it when the legal basis for the processing is his or her consent.

The User undertakes to indemnify IBERICA against any possible claim, fine or sanction that it may be obliged to bear as a consequence of the User's non-compliance with the duty described in this paragraph.

10. Changes to the privacy policy

We will only use personal data in accordance with the Privacy Policy in effect at the time such data is collected.

IBERICA reserves the right to modify this Privacy Policy at any time with effect from the date of publication of such modifications, so it is recommended that you review it whenever you access it. If at any time we decide to use personal data in a manner different from that stated at the time it was collected, this will be communicated to the User by email, where available to us. At this point, you will be given the option to consent to other uses or disclosures of the personal information you provided to us prior to the change in our Privacy Policy.

Should any clause of this Privacy Policy be annulled or considered null and void, the rest of the conditions shall not be affected, and shall remain fully valid and in force, in accordance with the applicable regulations in force at any given time.

11. Governing Law

The privacy of all information provided, both by the User through the different forms for requesting personal data, as well as that made available through the Website, is regulated by the data protection regulations in force, especially by the GDPR and the LOPDDGDD.

12. Cookies

Access to the website may involve the use of cookies. Cookies are small pieces of information that are stored on the browser used by each user so that the server remembers certain information that can be subsequently used. This information allows us to distinguish you as a specific user and to store your personal preferences, as well as strategic information about the use and operation of the Website.

Users who do not wish to enable cookies or who wish to be informed before they are stored on their devices can configure their own device to that effect. For more information, you can consult our Cookie Policy.