CONTENTS

1. Objective of the Privacy Policy
2. Definitions
3. Data Controller Identity
4. Applicable laws and regulations
5. Principles applicable to the processing of personal data
6. Data processing activities carried out
7. Necessary and updated information
8. Personal information of minors
9. Technical and organizational security measures
10. Rights of the interested parties
11. Claims before the Control Authority
12. Acceptance and changes in the Privacy Policy

1. PURPOSE OF THE PRIVACY POLICY

The purpose of this "Privacy and Data Protection Policy" is to inform you of the conditions governing the collection and processing of personal data by EXCLUSIVAS ENERGÉTICAS, making every effort to safeguard the fundamental rights, honor and freedoms of the individuals whose personal data is processed, in compliance with current regulations and laws governing the protection of personal data according to the European Union and the Spanish Member State, and specifically those expressed in the "Processing Activities" section of this Privacy Policy.

Therefore, in this Privacy and Data Protection Policy, users of the Website https://exclusivas-energeticas.com are informed of all the details of interest to them regarding how these processes are carried out, for what purposes, that other entities may have access to their data and what the rights of the users are.

2. DEFINITIONS

"Personal Data": Any information relating to an identified or identifiable natural person ("the Website user"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing": any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Limitation of processing": the marking of personal data held in order to limit its processing in the future.

"Profiling": any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

"Pseudonymization": the processing of personal data in such a manner that they can no longer be attributed to a data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

"File": any structured set of personal data, accessible according to certain criteria, whether centralized, decentralized or distributed functionally or geographically.

'Controller' or 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of the processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be laid down by Union or Member State law.

"Data processor" or "processor": the natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

"Recipient" means the natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not that person is a third party. However, public authorities which may receive personal data in the context of a particular investigation pursuant to Union or Member State law shall not be considered recipients; the processing of such data by those public authorities shall comply with the data protection rules applicable to the purposes of the processing.

"Third party": natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons authorized to process personal data under the direct authority of the controller or the processor.

"Consent of the data subject": any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

"Personal data security breach": any security breach resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;

"Genetic data": personal data relating to the inherited or acquired genetic characteristics of a natural person which provide unique information about the physiology or health of that person, obtained in particular from the analysis of a biological sample from that person.

"Biometric data": personal data obtained from a specific technical processing, relating to the physical, physiological or behavioral characteristics of a natural person that allow or confirm the unique identification of that person, such as facial images or fingerprint data.

"Health data": personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about their health status.

'Main establishment': (a) in the case of a controller with establishments in more than one Member State, the place of its central administration in the Union, unless decisions on the purposes and means of processing are taken at another establishment of the controller in the Union and that latter establishment has the power to enforce those decisions, in which case the establishment which has taken those decisions shall be deemed to be the main establishment; (b) in the case of a processor with establishments in more than one Member State, the place of its central administration in the Union or, if it has no central administration, the establishment of the processor in the Union where the main processing activities are carried out in the context of the activities of an establishment of the processor to the extent that the processor is subject to specific obligations under this Regulation.

'Representative' means a natural or legal person established in the Union who, having been designated in writing by the controller or the processor pursuant to Article 27 of the GDPR, represents the controller or the processor with regard to their respective obligations under this Regulation.

"Company": natural or legal person engaged in an economic activity, regardless of its legal form, including companies or associations that regularly carry out an economic activity.

“Supervisory authority” means the independent public authority established by a Member State pursuant to Article 51 of the GDPR. In the case of Spain, this is the Spanish Data Protection Agency.

'Cross-border processing' means: (a) the processing of personal data carried out in the context of the activities of establishments in more than one Member State of a controller or processor in the Union, where the controller or processor is established in more than one Member State; or ( b) the processing of personal data carried out in the context of the activities of a single establishment of a controller or processor in the Union, but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

"Information society service": any information society service, that is, any service normally provided for remuneration, remotely, electronically and at the individual request of a service recipient.

3 IDENTITY OF THE RESPONSIBLE FOR THE TREATMENT

The Data Controller is that natural or legal person, of a public or private nature, or administrative body, which alone or jointly with others determines the purposes and means of personal data processing; in case the purposes and means of the treatment are determined by the Law of the European Union or of the Spanish Member State.

In the aspects expressed in this Data Protection Policy, the identity and contact information of the Data Controller is:

EXCLUSIVAS ENERGÉTICAS SL – CIF B12936670

Cuadra Vía Casaña, Nº1. 12006, Castellón de la Plana (Castellón), Spain

• Email: admin@exclusivas-energeticas.com
• Phone: 964 125 643

4. APPLICABLE LAWS AND REGULATIONS

This Privacy and Data Protection Policy is developed based on the following regulations and data protection laws:

• Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data. Hereinafter GDPR.
• Organic Law 3/2018, of December 5, Protection of Personal Data and Guarantee of Digital Rights. Hereinafter LOPD/GDD.
• Law 34/2002, of July 11, on Services of the Information Society and Electronic Commerce. Hereinafter LSSICE.

5. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

The personal data collected and processed through this website will be treated in accordance with the following principles:

• Principle of legality, loyalty and transparency: All processing of personal data carried out through this Website will be lawful and loyal, being completely clear to the user when the personal data that concerns him or her is being collected, used, consulted or processed. The information regarding the treatments carried out will be transmitted in advance, easily accessible and easy to understand, in simple and clear language.
• Purpose Limitation Principle: All data will be collected for specific, explicit and legitimate purposes, and will not be subsequently processed in a manner incompatible with the purposes for which they were collected.
• Principle of data minimization: The data collected will be adequate, pertinent and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy principle: The data will be accurate and, if necessary, updated, adopting all reasonable measures so that personal data that is inaccurate with respect to the purposes for which it is processed is deleted or rectified without delay.
• Principle of limitation of the conservation period: The data will be kept in a way that allows the identification of the interested parties for no longer than is necessary for the purposes of the processing of personal data.
• Principle of integrity and confidentiality: The data will be processed in such a way as to guarantee adequate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss or damage, through the application of appropriate technical and organizational measures.
• Proactive responsibility principle: The entity that owns the Website will be responsible for compliance with the principles set forth in this section and will be able to demonstrate it.

6. DATA PROCESSING ACTIVITIES

The data processing activities carried out through the website are detailed below, specifying each of the following sections:

• Activity: Name of the data processing activity
• Purposes: Each of the uses and treatments that are carried out with the data collected
• Legal base: The legal basis that legitimizes the processing of data
• Processed data: Typology of processed data
• Origin: Where the data is obtained
• Conservation: Period during which the data is kept
• Target: Third parties or entities to whom the data is provided
• International transfers: Cross-border transfers of data outside the European Union

6.1. MAIN TREATMENT ACTIVITIES

They are those data processing activities whose purposes are necessary and essential for the provision of services.

6.2 OPTIONAL TREATMENT ACTIVITIES (if the user has marked their acceptance)

These are personal data processing activities whose purposes are not essential for the provision of the service and which are only carried out if the user has checked YES in the consent for the performance of these activities.

7. NECESSARY AND UPDATED INFORMATION

All the fields that appear marked with an asterisk (*) in the Website forms must be filled in, in such a way that the omission of any of them could make it impossible for the services or information requested to be provided.

You must provide truthful information, so that the information provided is always up-to-date and does not contain errors. You must notify the Data Controller as soon as possible of any modifications and corrections to your personal data that occur by sending an email to: admin@exclusivas-energeticas.com.

Likewise, by "clicking" on the "I accept" button (or equivalent) incorporated in the aforementioned forms, you declare that the information and data that you have provided in them are accurate and true, as well as that you understand and accept this Privacy Policy. Privacy.

8. DATA OF MINORS

In compliance with the provisions of Article 8 of the GDPR and Article 7 of the LOPD/GDD, only those over 14 years of age may give their consent for the processing of their personal data in a literal manner by EXCLUSIVAS ENERGÉTICAS.

Therefore, children under 14 years of age may not use the services available through the Website without the prior authorization of their parents, guardians or legal representatives, who will be solely responsible for all acts carried out through the Website by them. minors in their charge, including the completion of the electronic forms with the personal data of said minors and the marking, where appropriate, of the boxes that accompany them.

9. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

The Treatment Manager adopts the necessary organizational and technical measures to guarantee the security and privacy of your data, avoid its alteration, loss, treatment or unauthorized access, depending on the state of the technology, the nature of the data stored and the risks to which they are exposed.

Among others, the following measures stand out:

• Guarantee the confidentiality, integrity, availability and resiliency permanent treatment systems and services.
• Restore availability and the access to personal data quickly, in the event of a physical or technical incident.
• Verify, evaluate and assess, on regular basis, the effectiveness of technical and organizational measures implemented to guarantee the security of the treatment.
• Pseudonymize and encrypt personal data, in the case of sensitive data.

On the other hand, the Data Controller has made the decision to manage the information systems in accordance with the following principles:

• Principle of regulatory compliance: All information systems will comply with the regulations of regulatory and sectorial legal application that affect the security of information, especially those related to the protection of personal data, security of systems, data, communications and electronic services.
• Risk management principle: Risks will be minimized to acceptable levels and a balance will be sought between security controls and the nature of the information. Security objectives should be established, reviewed and consistent with information security aspects.
• Principle of awareness and training: Training, awareness programs and awareness campaigns will be coordinated for all users with access to information, in terms of information security.
• Proportionality principle: The implementation of controls that mitigate the security risks of assets will be carried out seeking a balance between security measures, nature and information and risk.
• Responsibility principle: All members of the Data Controller will be responsible for their conduct in terms of information security, complying with the established standards and controls.
• Continuous improvement principle: The degree of effectiveness of the security controls implemented in the organization will be reviewed on a recurring basis to increase the ability to adapt to the constant evolution of risk and the technological environment.

10. RIGHTS OF INTERESTED PARTIES

Current data protection regulations protect the user in a series of rights in relation to the use given to their data. Each and every one of such rights are unipersonal and non-transferable, that is, they can only be exercised by the owner of the data, after verifying their identity.

The rights of Website users are detailed below:

• Right of access: It is the right that the user of the Website has to obtain confirmation of whether or not the Data Controller is treating their personal data and, if so, to obtain information about their specific personal data and the treatment that the Data Controller has carried out. or perform, as well as, among others, the information available on the origin of said data and the recipients of the communications made or planned in them.
• Right of rectification: It is the right that the user of the Website has to modify their personal data that turns out to be inaccurate or, taking into account the purposes of the treatment, incomplete.
• Right of withdrawal: It is usually known as the “right to be forgotten”, and it is the right that the user of the Website has, provided that current legislation does not establish otherwise, to obtain the deletion of his or her personal data when these are no longer necessary for the purposes for which they were collected or processed; the User has withdrawn his or her consent to the processing and there is no other legal basis for this; the User opposes the processing and there is no other legitimate reason to continue with it; the personal data have been processed unlawfully; the personal data have been obtained as a result of a direct offer of information society services to a minor under 14 years of age. In addition to deleting the data, the Data Controller, taking into account the available technology and the cost of its implementation, will adopt reasonable measures to inform other potential controllers who are processing the personal data of the interested party's request to delete any link to said personal data.
• Right to data limitation: It is the Website User's right to limit the processing of their personal data. The User of the Website has the right to obtain the limitation of the treatment when he contests the accuracy of his personal data; the processing is unlawful; the Data Controller no longer needs the personal data, but the User needs it to make claims; and when the User of the Website has opposed the treatment.
• Right to data portability: In those cases where the processing is carried out by automated means, the Website User shall have the right to receive from the Data Controller their personal data in a structured, commonly used and machine-readable format, and to transmit them to another data controller. Whenever technically possible, the Data Controller will transmit the data directly to that other Controller.
• Right of opposition: It is the User's right not to carry out the processing of their personal data or to cease the processing thereof by the Data Controller.
• Right not to be subject to automated decisions and/or profiling: The right of the User of the Website not to be the subject of an individualized decision based solely on the automated processing of their personal data, including the creation of profiles, existing unless the current legislation establishes otherwise.
• Right to revoke consent: It is the right of the User of the Website to withdraw, at any time, the consent given for the processing of their data.

The Website user can exercise any of the aforementioned rights by contacting the Data Controller and prior identification of the User using the following contact information:

• Controller: EXCLUSIVAS ENERGÉTICAS SL
• Address: Cuadra Vía Casaña, Nº1. 12006, Castellón de la Plana (Castellón), Spain
• Phone: 964 125 643
• Email: admin@exclusivas-energeticas.com
• Website: https://exclusivas-energeticas.com

11. RIGHT TO COMPLAIN TO THE CONTROLLING AUTHORITY

The user is informed of his right to file a claim with the Spanish Data Protection Agency if he considers that an infringement of data protection legislation has been committed regarding the processing of his personal data.

Control authority contact information:

Spanish Agency for Data Protection
Email: info@aepd.es
Phone: 912663517
Website: https://www.aepd.es
Address: C/. Jorge Juan, 6. 28001, Madrid (Madrid), Spain

12. ACCEPTANCE AND CHANGES IN THE PRIVACY POLICY

It is necessary that the user of the Website has read and agrees with the data protection conditions contained in this Privacy Policy, as well as accepting the processing of their personal data so that the Data Controller can proceed with it in the manner, deadlines and purposes indicated.

The Data Controller reserves the right to modify this Privacy Policy, according to its own criteria, or motivated by a legislative, jurisprudential or doctrinal change of the Spanish Data Protection Agency. The changes or updates made to this Privacy Policy that affect the purposes, retention periods, data transfers to third parties, international data transfers, as well as any right of the User of the Website, will be explicitly communicated to the user.

Version of July 31, 2023