Blue Atlantica

Privacy Policy

In accordance with Regulation (EU) 2016/679 (“GDPR”), Blue Atlantica Energy Iberia, S.A. (“Company” or “Data Controller”) provides the information below concerning the processing of personal data in order to allow users (“User” or “Users”) of the www.blueatlantica.com website (“Website”) to know its personal data protection policy and understand how personal information of Users is collected and managed when they navigate the Website and when they use its services.

Identity and contact details of the Data Controller

The Data Controller is Blue Atlantica Energy Iberia, S.A., with its registered office in Spain, 08036 Barcelona, Avda. Diagonal 463 bis, 9.2, which can be contacted through the “Contact Us” section.

Contact: info@blueatlantica.com

Purposes of processing and legal basis

(a) Regulatory purposes and the necessity for the provision of services: Processing of personal data when necessary to fulfil a contractual or legal obligation to which the Data Controller is subject, or to comply with a specific request from the data subject.

The User’s personal data may be processed, without the need for consent, in cases where it is necessary to comply with obligations arising from legal provisions, as well as rules, codes, or procedures approved by authorities and other competent institutions.

The User’s personal data will also be processed for purposes related to and/or connected to the provision of services by the Company in the context of navigating the Website, such as specifically:

  • For the provision of services requested by the User during navigation on the Website, including the collection, storage, and processing of data for its establishment and subsequent operational and technical management.
  • Managing relations with authorities and third-party public bodies for purposes related to particular requests, compliance with legal obligations, or specific procedures.
 

The data – whose provision is necessary for the operational execution of the service – will also be processed electronically, recorded in special databases, and used strictly and exclusively in the context of navigating the Website.

Since the communication of the User’s personal data for the purposes mentioned is necessary for the maintenance and provision of all services related to navigation on the Website, failure to provide them will make it impossible to provide the specific services in question.

(b) Commercial and marketing purposes: consent

The User’s personal data may also be processed, with the User’s consent, for the following additional purposes functional to the activity of the Data Controller or a third party:

  • market studies, economic analyses, and statistics;
  • marketing of the Data Controller’s services and/or those of a third party, sending of advertising/informational/promotional material, and participation in initiatives and offers aimed at rewarding the Data Controller’s customers;
  • surveys of the degree of customer satisfaction with the quality of services provided.
 

These activities may refer to the products and services of the Data Controller, as well as those of the companies affiliated with or its commercial partners, and may also be carried out through an automated calling system, without the intervention of an operator, by mail, including email, and by SMS (Short Message Service).

Consent for the processing of data and communication to the entities listed below for the purposes mentioned is optional and can be revoked at any time through the “Contact Us” section.

(c) Defense of a right in court

Furthermore, the User’s personal data will be processed whenever necessary to ascertain, exercise, or defend a right of the Data Controller or other companies within the scope of control of Blue Atlantica Energy Iberia, S.A. in court.

(d) Legitimate interest of the Data Controller

The Data Controller may process, without the User’s consent, the personal data collected in the following cases:

  • in the case of extraordinary operations of merger, sale, or transfer of a business activity, to allow for the performance of the operations necessary for due diligence activities and preparation for the sale. It is understood that the data processed for the purposes mentioned will limited to that which is strictly necessary, in the most aggregated/anonymized form possible.
  • anonymous and aggregate analysis of the use of the services utilized, in order to identify users’ habits and inclinations, to improve the services provided and meet the specific needs of users, or to prepare initiatives related to the improvement of services provided.
  • analysis of Blue Atlantica Energy Iberia, S.A.s brand positioning and reputation on the web (web listening). This includes, in particular, identifying and assessing what is said on the web – whose contents are accessible to the public – about Blue Atlantica Energy Iberia, S.A. and its activities/clients, in order to capture the opinions, intentions, moods, and market trends, as well as the needs of Blue Atlantica Energy Iberia, S.A.’s stakeholder groups to be able to improve the services offered by the Company. This is done through keyword searches, without identifying the users.

Recipients of personal data

The Data Controller may communicate the User’s personal data to third parties, such as those belonging to the following entities or categories of entities:

  • Law enforcement, armed forces, and other public administrations, for the fulfillment of obligations provided by law, regulations, or community legislation. In these cases, under the applicable data protection legislation, there is no obligation to obtain the prior consent of the interested party for such communications.
  • Companies, bodies, or associations, or parent companies, subsidiaries, or related companies as per article 42 of the Spanish Commercial Code, or between these and companies under joint control, as well as between consortia, business networks, and temporary groupings and associations of companies and with the entities adhering to them, limited to communications made for administrative and/or accounting purposes.
  • IT service providers.
 

The Data Controller takes the utmost care to ensure that the communication of the User’s personal data to the mentioned recipients refers only to the data necessary to achieve the specific purposes for which they are intended.

The User’s personal data are stored in the Data Controller’s databases and will only be processed by authorized personnel. These individuals will receive specific instructions on the methods and purposes of processing. Such data will also not be communicated to third parties, except in the cases provided above and, in any case, within the limits established therein.

Lastly, it is reminded that the User’s personal data will not be disclosed, except in the cases described above and/or provided by law.

Transfer of Personal Data Outside the EU

The User’s personal data may be transferred outside the EU, including insertion into databases shared and managed by third parties, whether or not they are part of the control perimeter of Blue Atlantica Energy Iberia, S.A. The management of the database and the processing of such data are bound to the purposes for which they were collected and are carried out in strict compliance with the confidentiality and security norms established in the applicable data protection laws.

Whenever the User’s personal data are transferred outside the EU, the Data Controller will adopt all appropriate and necessary contractual measures to ensure an adequate level of protection of personal data in accordance with the provisions of this privacy policy, including, among others, the standard contractual clauses approved by the European Commission.

Data Retention Period

The data will be retained for a period not exceeding the time necessary for the purposes for which they were collected or subsequently processed in accordance with legal obligations.

Rights of the Data Subjects

As a data subject, the User has the following rights over the personal data collected and processed by the Data Controller: (i) the right of access, in particular by requesting, at any time, confirmation of the existence of the User’s personal data in the Company’s files and the provision of such information in a clear and intelligible form, as well as the right to know the origin, the logic, and the purpose of the processing with an explicit and specific indication of those responsible and in charge of processing and of the third parties to whom the User’s personal data may be communicated; (ii) the right to obtain the updating and rectification of the data (except for evaluation data), the deletion of superfluous data or its anonymization, as well as the blocking of processing and definitive deletion in case of unlawful processing; and (iii) where appropriate, the limitation of processing and the portability of data. The law also recognizes that data subjects have the right to lodge a complaint with the Data Protection Supervisor if the User believes that their rights under the current data protection legislation have been infringed.

The User may exercise the aforementioned rights in the “Contact Us” section or by writing to info@blueatlantica.com.