Privacy and Data Protection Policy

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), AXIS ENERGIA S.L. informs users of the website www.axisenergia.com about its personal data protection policy so that users can freely and voluntarily determine whether they wish to provide their personal data through the forms enabled to contact the company or for the provision of services.

1. Data Controller

Personal data that may be collected directly from the interested party will be treated confidentially and will be incorporated into the corresponding processing activity owned by:

2. Data Processing Principles

Personal data will be processed in accordance with the principles established in Article 5 of the GDPR:

• Lawfulness, fairness and transparency: data will be processed lawfully, fairly and in a transparent manner.
• Purpose limitation: data will be collected for specified, explicit and legitimate purposes.
• Data minimization: data will be adequate, relevant and limited to what is necessary.
• Accuracy: data will be accurate and kept up to date.
• Storage limitation: data will be kept for no longer than necessary.
• Integrity and confidentiality: data will be processed in a manner that ensures appropriate security.
• Accountability: the controller will be responsible for compliance with these principles and must be able to demonstrate it.

3. Categories of Personal Data Collected

AXIS ENERGIA S.L. may collect and process the following categories of personal data:

• Identification data: full name (first and last name), national identity document (DNI/NIE), date of birth.
• Contact data: postal address (street, number, floor, postal code, locality, province), telephone number (landline and/or mobile), email address.
• Economic and transaction data: bank details for payments and collections (IBAN), billing and payment information, consumption and energy supply data.
• Technical data related to the installation: characteristics of the building (roof type, area, orientation, inclination), current and projected electricity consumption, photographic images of the installation site (facade, roof).
• Commercial data: information about quote requests, preferences and interests expressed by the User.
• Navigation data: IP address, browser type, operating system, visited pages, access date and time (collected through web server logs and, where applicable, cookies).
• Other data provided voluntarily: any other personal data that the User provides voluntarily through contact forms, emails or other communication channels.

4. Purposes and Legal Basis of Processing

Personal data collected will be processed for the following purposes, based on the corresponding legal basis:

5. Data Retention Periods

Personal data will be retained for the time strictly necessary to fulfill the purposes for which they were collected and, once these periods have expired, they will be deleted or anonymized. Specifically, the following retention periods apply:

• Inquiries and information requests without continuity: data will be retained for a maximum period of 2 years from the last interaction with the User, after which they will be deleted or anonymized.
• Quotes and commercial offers not accepted: data will be retained for a maximum period of 2 years from the issuance of the quote.
• Current clients: during the contractual relationship and, once finalized, during the limitation period for legal actions that may arise from the contractual relationship.
• Legal obligations: data necessary to comply with legal obligations (for example, invoices, contracts) will be retained for the periods established by applicable regulations. Generally, a minimum of 6 years in accordance with Spanish tax and commercial regulations.
• Commercial communications: data will be retained until the User withdraws consent or requests cancellation of commercial communications.
• Claims or litigation: in case of claims, litigation or administrative or judicial proceedings, data will be retained until their final resolution, including applicable limitation periods and appeals.

Once the indicated retention periods have elapsed, personal data will be deleted or, where appropriate, anonymized so that they do not allow the identification of the User.

6. Recipients and Data Transfers

The User's personal data may be communicated to the following recipients when necessary for the proper provision of services or by legal imperative:

• Public administrations: tax administration bodies (State Tax Administration Agency, Regional Administrations), energy sector regulatory bodies, Local Administrations (Town Councils) for processing licenses and permits.
• Service providers: web hosting and hosting service providers, email services, web data analysis and statistics services, business management software providers (CRM, ERP, billing), banks and payment gateways for payment and collection management, messaging and transport services.
• Technical collaborators: manufacturers and installers of photovoltaic equipment, engineering and subcontracted companies for project execution, maintenance companies.
• Advisors and professionals: law firms, agencies, tax and accounting advisors who provide services to AXIS ENERGIA S.L.

AXIS ENERGIA S.L. will not transfer or communicate personal data to third parties, except in the cases indicated above, in cases where there is a legal obligation or when the transfer is necessary for the provision of the service requested by the User and the User has given express consent.

International transfers: In case it is necessary to carry out international data transfers to countries outside the European Economic Area (EEA), AXIS ENERGIA S.L. will ensure that such transfers are carried out with all guarantees and in compliance with the requirements demanded by the GDPR, through the subscription of standard contractual clauses approved by the European Commission or through other adequate guarantee mechanisms.

7. User Rights

Any person has the right to obtain confirmation as to whether AXIS ENERGIA S.L. is processing personal data concerning them or not. Interested parties have the right to exercise the following rights recognized in the GDPR and LOPDGDD:

• Right of access: know what personal data is being processed and obtain a copy thereof.
• Right of rectification: request the correction of inaccurate or incomplete data.
• Right of erasure ('right to be forgotten'): request the deletion of data when, among other reasons, they are no longer necessary for the purposes for which they were collected.
• Right to restriction of processing: request that the processing of personal data be limited under certain circumstances.
• Right to data portability: receive personal data in a structured, commonly used and machine-readable format, and transmit them to another controller.
• Right to object: object to the processing of personal data for reasons related to their particular situation. In particular, the User has the right to object at any time to the processing of their data for direct marketing purposes.
• Right not to be subject to automated individual decision-making (including profiling) that produces legal effects or similarly significantly affects them.
• Right to withdraw consent: when the processing is based on consent, the User has the right to withdraw it at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

To exercise the rights indicated above, the User can contact AXIS ENERGIA S.L. through the following means:

The request must contain: name and surname of the interested party, photocopy of ID card/foreigner's identity card or equivalent document that proves the identity of the applicant, specific request that is formulated (clearly indicating the right that is desired to exercise), address for notification purposes, date and signature of the applicant. AXIS ENERGIA S.L. will respond to the request within a maximum period of one month from receipt thereof, which may be extended by two more months in case of special complexity, informing the interested party of such extension.

Right to complain to the Control Authority: The User has the right to file a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their personal data is not in accordance with applicable regulations. You can contact the AEPD at: Calle de Jorge Juan, 6, 28001 Madrid, or through its electronic office: www.aepd.es

8. Security Measures

AXIS ENERGIA S.L. has adopted and implemented the necessary technical and organizational security measures to guarantee the security of personal data and prevent their alteration, loss, processing or unauthorized access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed. Security measures adopted include:

• Encryption of communications through SSL/TLS protocol (https) for data transmission through the website.
• Access control to systems and databases through secure credentials (username and strong password).
• Use of firewalls and intrusion detection and prevention systems.
• Periodic backup of data.
• Staff training on data protection and information security.
• Establishment of confidentiality agreements with employees and collaborators who have access to personal data.
• Periodic review and update of implemented security measures.

Notwithstanding the foregoing, the User must be aware that security measures on the Internet are not impregnable. AXIS ENERGIA S.L. cannot guarantee the absolute invulnerability of its systems and, consequently, assumes no responsibility for damages arising from alterations that third parties may cause to the User's computer systems, electronic documents or files.

9. Minors

The services offered through the website are exclusively aimed at persons over 18 years of age. AXIS ENERGIA S.L. does not deliberately collect personal data from minors under 18 years of age. In case a minor has provided personal data without the consent of their parents or legal guardians, they should immediately contact AXIS ENERGIA S.L. through info@axisenergia.com to proceed with the immediate deletion of such data.

10. Update and Modification of the Privacy Policy

AXIS ENERGIA S.L. reserves the right to modify this Privacy Policy to adapt it to legislative, jurisprudential or interpretative developments of the Spanish Data Protection Agency, as well as to industry practices. In case of substantial modification, AXIS ENERGIA S.L. will inform Users sufficiently in advance through the website or, where appropriate, by communication to the email address provided. Users are recommended to periodically review this Privacy Policy. The date of the last update is indicated at the top of this document.

11. Contact for Data Protection Matters

For any question related to the processing of your personal data or the exercise of your rights, the User can contact AXIS ENERGIA S.L. at: