PRIVACY POLICY

1. Who is the data controller?

The data controller for the data you provide us is Aby Marketing Dreams SL, with VAT ESB65209801, and with registered office at Hijas de la caridad 108, 48003, Bilbao Spain.

2. For what purpose do we collect your personal information?

As established by Regulation (EU) 2016/679, General Data Protection Regulation, and Organic Law 3/2018, of December 5, on Personal Data Protection and Guarantee of Digital Rights, Aby collects your personal data for the specific purposes listed below:

• To properly handle your contact and subscription requests through our form on our Website, as well as your requests for: information, suggestions and possible complaints.
• To provide you with the best service, manage data maintenance, as well as the professional, commercial and/or contractual relationship you establish with us, including corresponding billing and delivery.
• To conduct surveys, statistics, market studies and commercial prospecting in order to evaluate service quality, market trends, consumption habits, profile analysis, sales evolution analysis and business and investment decision-making.
• To send you commercial communications and keep you informed about services, products, offers, promotions, opportunities, events or news relevant to users, via email, instant messaging data systems such as WhatsApp, telegram..., postal mail, telephone calls, automatic telephone calls, including with Artificial Intelligence assistance, SMS, Push messages, as well as IDchek unless you show your opposition to such processing by the means provided for this purpose, as indicated below. To this end, ABY guarantees compliance with current regulations regarding electronic communications. If you wish to stop receiving such communications you can request unsubscription by clicking on the link provided in the communications themselves or by sending an email to the following address: bajas@aby.group
• If they have given their consent, transfer your data to Aby's sponsors or clients to receive commercial offers by email, telephone and/or SMS from their partners or clients or third-party companies from any sector (among others, from the energy sector for commercial purposes). The list of sponsors is available in this Privacy Policy. The transfer of your data to third parties includes the possibility of data aggregation operations in the databases of these third parties, duplication and any other processing operation necessary to fulfill the purpose of processing your data. We will require third parties to comply with Regulation (EU) 2016/679, European Data Protection Regulation.
• To comply with legally established obligations, as well as verify compliance with contractual obligations, including fraud prevention.
• Cross-referencing of your data with other third-party databases, including specialized partners, in order to verify my identity, prevent fraudulent use and, where appropriate, improve the personalization of communications and content.

3. Therefore, what personal data do we process?

To browse our Website, you do not need to provide us with your personal data.

You will only need to provide them to us if you contact us through the form on our Website or through any communication made by email.

In such case, Aby will collect and process the data that is strictly necessary for the purposes described in the previous point.

Therefore, we will only collect your personal contact data to identify you and to initially attend to your communications and, subsequently, the relationship that, if applicable, is established.

The data we will collect and process from the registration process are:

• Identification and contact data: name, surname, date of birth, complete postal address, gender, email address, telephone, other data that the form may request, related to socioeconomic data.
• Commercial information data.
• Your browsing, traffic and location data.

The data we will collect and process from cross-referencing with databases, if applicable, are:

• Economic, academic, professional, sociological profile data.

The data we will collect and process from the user in case of email marketing campaigns refer to:

• Commercial interest data.
• Your browsing, traffic and location data.

Aby does not collect personal data from minors, therefore if you accept our privacy policy you guarantee that you are over 18 years old, and that the data you provide us is true, accurate, complete and up to date.

In this sense, as a user you will be responsible for any false or inaccurate information you provide us through the Website or by email and, therefore, for the damages -direct and indirect- caused to Aby or third parties.

Finally, if you provide us with data from third parties, you guarantee that you have their respective consents, so that Aby is exempt from any responsibility in this regard.

Notwithstanding the foregoing, Aby may carry out the verifications it considers appropriate and necessary.

For its part, Aby guarantees having the necessary technical measures to guarantee the security of your data.

4. What is the legal basis for processing your data?

The legal basis or legitimation to carry out the indicated processing is your free, informed and unambiguous consent.

Data may be processed on the basis of legitimate interest, in cases where there is a balancing test that authorizes the processing and in the case of processing contact persons of legal entities.

Data may be processed on the basis of compliance with a Law, in case of identity verification, fight against money laundering, crime prevention and similar activities, or where applicable, based on legitimate interest after due balancing.

Data is also processed based on the pre-contractual and contractual relationship that ultimately binds us in order to provide you with the service you request.

Consent may be revoked at any time.

In case you withdraw your consent to any of the processing, this will not affect the lawfulness of the processing carried out previously.

5. How long do we process your data?

We will keep your data for the time necessary for each of the above purposes. In this way:

• Your contact data will be kept for 30 days until your contact request, information or any other communication is attended to.
• The data necessary for the management and maintenance of the professional, commercial and/or pre-contractual and contractual relationship we establish, will be stored and processed until said relationship ends.
• Likewise, we will keep your data subsequently during the legally established periods and while they may be necessary for the formulation, exercise or defense of claims and to meet legal obligations and any liability that may arise from the previous relationship.
• In case the legal basis is consent, we will process your data until you revoke it or oppose the processing, taking into account that when you revoke it or oppose the processing, your data will be kept blocked during the time in which claims may be filed.

During this period your data will be duly blocked, remaining available to Judges and Courts, or the competent Public Administrations and, in particular, available to data protection authorities to address possible liabilities derived from data processing.

6. To whom may we communicate your data?

Aby may communicate your personal data, in accordance with the purposes described in point two of this policy, to the following categories of recipients, which include entities from the activity sectors you can consult by clicking here

• Consulting, auditing, administrative, financial and banking management services.
• Postal, distribution and courier services.
• Archive, custody and digitization services, storage and information processing.
• Security, IT, hosting and cloud services.
• Information withdrawal and destruction services.
• Advertising and communication services.
• Legal activities services, organizations and authorities in case of legal obligation.
• Services provided by third-party companies in the energy sector for commercial mailings.
• Content verification services.
• Data cross-referencing with other databases.

The recipients of the indicated services may be located within or outside the European Economic Area, being in the latter case duly legitimized to carry out international data transfers. To this end, Aby guarantees the adoption of all necessary measures to guarantee your rights.

7. What are your rights?

Rights of access, rectification, opposition, erasure, restriction, portability, and automated individual decisions.

Through the exercise of the right of access, at any time and at no cost, you can access your data, know what personal data you have provided us, you can correct them if they are erroneous, inaccurate or incomplete, and you can request that we delete them when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Through the exercise of the right of opposition, you can oppose the processing of your data, so that your personal information will no longer be processed for those purposes for which you have expressed your opposition.

Right of rectification: you may request the rectification of inaccurate or incomplete data.

Right of erasure: you may request the erasure of personal data when the circumstances legally provided in Art. 17 of Regulation (EU) 2016/679 apply.

Right of restriction of data: if you wish, and when the conditions provided in data protection regulations are met, you may request the restriction of the processing of your data.

Right of portability: in certain circumstances, you may request the portability of your data to another data controller.

Right not to be subject to a decision based solely on automated processing, including profiling if it produces legal effects on the data subject.

In the above cases, Aby may retain your data for the formulation, exercise or defense of claims and to meet legal obligations and any liability that may arise from the previous relationship.

Finally, you have the right to file a complaint with the Spanish Data Protection Agency when you consider that Aby has violated the rights that data protection regulations recognize. For more details you can consult the website www.aepd.es. You can choose to file the complaint with the Data Protection Officer by sending it to dpo@aby.group

8. Where is the data stored?

Your data is stored on European servers, with no transfer of the same outside the European Union.

9. Modifications to this information

We will review and update data protection information at least once a year or when there are modifications in legislation or in any of the procedures for processing your personal information, indicating the date of the last update, content and date.

If we have your email address, we will send you an email with information about said changes.

If necessary, we will renew your consent so that you confirm that you agree with these changes.

10. Commercial Communications

Participants in the various free promotions are informed that, provided they present their authorization by checking the corresponding box, their data may be processed for advertising purposes and consequently receive commercial messages from companies in the sectors referred to in this privacy policy to which their data has been previously transferred.

This communication may be made through all channels provided by the participant: email, SMS, telephone, postal mail or through the use of computer applications and social networks. Such communications may, where appropriate, incorporate cookies/beacons/markers that, anonymously and without affecting any personal data, allow the data controller and/or the companies with which it collaborates, better interaction with the participant.

Likewise, if you check any of the options detailed below, you may stop receiving information and advertising from other related companies or entities about the following sectors that may NOT be of your interest through any of the means described:

You may also receive commercial offers from other companies or entities along with the prizes obtained.

Participants may revoke totally or partially and at any time, the consent given to the processing of their data and to the reception of advertising communications through a notification to the email (bajas@aby.group).

In addition to what is provided by the legislation applicable to the data controller of the commercial promotion, all those persons whose personal data is subject to processing may exercise free of charge the actions derived from the rights of opposition, access, rectification, cancellation, information, portability, restriction of processing and any others that they may have in the same form and manner as, where appropriate, would correspond by virtue of their own national regulations.

This data protection information was last reviewed and updated in October 2025