Privacy Policy

1. Our principles and the purpose of this Privacy Policy

Telefónica Group companies are committed to respecting the privacy of users and the secrecy and security of personal data, in accordance with the provisions of applicable data protection legislation.

Your privacy and the security of your data is our priority. It is part of our DNA and is reflected in the principles that govern our Privacy Policy:

1.1. Transparency

We are 100% transparent with you about the data we collect and/or process about you and explain why we use it and for what purposes. We will not treat your data in an unexpected, obscure or abusive way.

1.2. Control

You are the only one who can control how your data is used. We provide you with the tools to decide at any time how you want us to handle your data, how long you can access and update your personal information, and how you can access and update your personal information.

1.3. Security

We take care to ensure the security, secrecy and confidentiality of your personal data and information. We adopt the most demanding and robust security measures to prevent their loss, alteration, misuse or unauthorised access.

In compliance with these principles, below you will find the sections that make up our Privacy Policy, where we inform you about everything necessary for you to maintain control over your data.

2.  Who is the data controller?

Telefónica, S.A. (“Telefónica“), company with ID number A28015865 and registered office at Gran Vía 28, 28013, Madrid, Spain, will be the data controller for the processing of your data in accordance with what we inform you in this Privacy Policy.

We also have appointed a Data Protection Officer who ensures compliance with applicable data protection legislation at Telefónica, and who can be contacted for any questions, doubts and/or complaints you may have when we process your data, by writing to [email protected].

3. What data is processed, for what purpose and why do we process the data?

Depending on the data collection channel or the means by which you interact with Telefónica, your data may be processed for the following purposes:

3.1   Response to queries

  • What for? – Purposes of processing: the purpose of the processing we are pursuing pursue is to deal with and respond to enquiries made by users of the website.
  • Why? – Applicable legal basis: the legal basis on which we rely to carry out that purpose is the consent given when you voluntarily contact us.
  • What data? – Type of data: the data we process for this purpose are your identification and professional data, as well as the information contained in the query submitted, the processing of which is necessary to provide you with a response.
  • Where is it obtained from? – Source: the data we process for this purpose is obtained from you when you complete the contact forms included on the website or send us an email at the contact address we make available to users.
  • Who does it belong to? – Categories of data subjects: the data we process for this purpose relates to website users who submit enquiries.
  • For how long is it processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in the following section of this Policy.

3.2   Management of the Responsible Business Channel of Telefónica

  • What for? – Purposes of the processing: the purpose of the processing that we are pursuing is to manage the Telefónica Responsible Business Channel, which is made available to any interested party for the reception and, where appropriate, subsequent monitoring and response, of queries on any aspect related to Telefónica’s Responsible Business Principles, such as, for example, ethics, human rights, the environment, privacy, health and safety, etc. Depending on the query submitted to Telefónica’s Responsible Business Channel, it will be processed with the area responsible for that topic and, where appropriate, provided that it is strictly necessary or the query cannot be resolved in any other way, your data may be shared with the Telefónica Group companies responsible for resolving it, all in accordance with the provisions of the Regulation about the Management of the Business Principles Channel approved by Telefónica.
  • Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the consent given by voluntarily submitting an enquiry through the Responsible Business Channel and completing the available and voluntary fields in the Channel form.
  • What data? – Type of data: the data we process for this purpose are those required to be filled in the Channel form, such as the country where you are located, the subject and content of the query submitted, your relationship with Telefónica as the data subject, and, where appropriate, also those that you voluntarily decide to share when you do not make the query anonymously, such as your identification or contact details, or the specific place to which the query submitted refers.
  • Where is it obtained from? – Source: the data we process for this purpose is obtained from the Telefónica Responsible Business Channel form.
  • Who does it belong to? – Categories of data subjects: the data we process for this purpose relates to data subjects who submit enquiries through the Responsible Business Channel and any other data subjects whose details have been included on the form by the sender of the enquiry.
  • How long is it processed for? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in the following section of this Policy.

3.3. Sending of newsletters

  • What for? – Purposes of the processing: the purpose of the processing we are pursuing is to send periodic newsletters by e-mail, upon request by the interested party, on the activities carried out by the Telefónica Group and the content generated by the Group through its different areas. Depending on the newsletter you have asked to subscribe to, your data may be shared with the Telefónica Group companies responsible for it in order to process your subscription request.
  • Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the consent given when you subscribe to the periodic newsletters.
  • What data? – Type of data: the data we process for this purpose are your identification, professional and contact details necessary to send you the newsletter.
  • Where is it obtained from? – Source: the data we process for this purpose is obtained from the newsletter subscription forms included on the website.
  • Who does it belong to? – Categories of data subjects: the data we process for this purpose relates to the users of the website who subscribe to the newsletters.
  • How long is it processed for? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in the following section of this Policy.

3.4. Management of the relationship with users through the different social networks used by the Telefónica Group

  • What for? – Purposes of the processing: the purpose of the processing that we are pursuing is to interact and maintain contact with users who interact with Telefónica through the different social networks in which the Telefónica Group has created an official account. This includes the public response to messages or public comments made by said users, appointments, attention and response to private messages through said networks, processing of the request to the Telefónica area or to the Telefónica Group company competent to deal with it, etc. If strictly necessary, your data may be shared with the relevant Telefónica Group companies in order to process and respond to your request.
  • Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the consent you give when you interact with Telefónica through the social network on which Telefónica has an official account.
  • What data? – Type of data: the data we process for this purpose are your public data in your profile on the social network, identification data, contact data and other data voluntarily shared during contact through the social network or data necessary to resolve the request made.
  • Where is it obtained from? – Source: the data we process for this purpose is obtained from the social network through which you contact us and those that we obtain directly from you in that contact.
  • Who does it belong to? – Categories of data subjects: the data we process for this purpose relates to users who contact Telefónica through the social network and any other data subjects whose data the user of the social network has been informed of when contacting Telefónica.
  • How long is it processed for? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in the following section of this Policy.

3.5. Data Management for Telefónica Brand Analysis and Assessment

  • What for? – Purposes of the processing: the purpose of the processing we are pursuing is to analyse and assess the public image and brand of the Telefónica Group through the collection of data indexed on social networks and websites open to the public.
  • Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the legitimate interest of Telefónica, as the owner and manager of its brand, so that it can analyse its position in the market and carry out the necessary actions according to the results obtained.
  • What data? – Type of data: the data we process for this purpose are your public data in your profile on the social network, as well as the comments made.
  • Where is it obtained from? – Source: the data we process for this purpose is obtained from the social network in which you are registered.
  • Who does it belong to? – Categories of data subjects: the data we process for this purpose relates to o users registered on the social network who mention to the Telefónica brand.
  • How long is it processed for? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in the following section of this Policy.

3.6. Maintenance and management of the website owned by Telefónica, its security and user access

  • What for? – Purposes of the processing: the purpose of the processing that we are pursuing is to maintain active and technically manage the website owned by Telefónica that is visited by the user and to which this Policy is applicable, to protect it against security incidents and malicious attacks that it may suffer and, in general, to enable free and continuous access to it by all internet users. Users can find further information on the scope of this purpose in the Cookies Policy applicable to the website owned by Telefónica.
  • Why? – Applicable legal basis: the legal basis on which we base this purpose is the legitimate interest of Telefónica, as the owner, in guaranteeing the availability and security of its websites for all internet users who visit them, in accordance with the relevant legal and user conditions notices.
  • What data? – Type of data: the data we process for this purpose are those, generally pseudonymised, which are obtained directly from the devices with which the user accesses and browses the website owned by Telefónica, the processing of which is strictly necessary for the fulfilment of the aforementioned purpose.
  • Where is it obtained from? – Source: the data we process for this purpose is obtained from the devices with which the user accesses and browses the website owned by Telefónica.
  • Who does it belong to? – Categories of data subjects: the data we process for this purpose relates to users who access and browse the website owned by Telefónica.
  • How long is it processed for? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in the following section of this Policy.

4. How long is the data retained?

In general, we will keep your data for the period necessary to comply with each of the purposes described in each processing activity and to determine the possible liabilities that may arise from that purpose.

In any case, your data will be kept in accordance with the retention criteria or specific periods described in each processing activity and, where appropriate, until you withdraw your consent and/or object to the processing of your data. In this regard, we will make our best efforts to provide you with an automatic and simple mechanism so that you can withdraw the consent granted and/or object to the processing and, in any case, we are at your disposal at the e-mail address for exercising your rights as indicated in section 6 of this Privacy Policy.

5. Who is the recipient of the data? are there any international transfers of data?

In order to carry out the processing purposes described above, we may make use of authorised subcontractors acting on behalf of Telefónica, as data processors (e.g. internet service providers, data hosting and technical support providers, e-mail providers, general service providers and physical security service providers, etc.) and contractually subject to our instructions, only for the lawful purposes described above and only for the period of time strictly necessary for that purpose.

We also inform you that, to the extent strictly necessary to comply with the purposes stated, your data may be shared with other companies or entities belonging to or linked to the Telefónica Group, for processing under their responsibility and always for the same purposes stated in this Policy. The companies or entities belonging to or linked to the Telefónica Group to which your data may be shared can be consulted in the section “about Telefónica”, “about the Company” or the equivalent section that replaces it available on the website www.telefonica.com.

In addition, in the event that there is a legal obligation or requirement to do so, we may communicate your data to the competent public authorities in accordance with such obligation or legal requirement.

Where authorised subcontractors acting on behalf of Telefónica or such recipients are located or process your data outside the European Economic Area, we will be making an international transfer of your data in accordance with applicable data protection legislation. In general, we will avoid international transfers of data and your data will be processed within the European Economic Area. However, in the event that such international transfers are necessary, we will take the necessary organisational, technical and contractual measures to ensure the protection and security of your data, such as, for example, signing the European Commission’s Standard Contractual Clauses with the authorised subcontractor or third party recipient, carrying out impact assessments on the relevant international transfer to assess the risk and adopt measures to mitigate it, encryption of data in transit or at rest, pseudonymisation of the data transferred, the possibility for the data subject to claim damages directly against the authorised subcontractor or third party recipient, etc.

6. What rights do you have as a data subject?

As a data subject, applicable data protection legislation grants you certain rights over your data which, depending on how they apply, you may exercise against Telefónica. Below you will find details of these rights and how you can exercise them. We also inform you that on the website of the Spanish supervisory authority (www.aepd.es) you can find further information on the characteristics of these rights and download templates for exercising each of them.

It is your right to withdraw your consent to the processing of your data for the purposes that are legitimate on that basis, at any time and in an easy way.

6.2. Right of access

This is your right to ask us for details of the data we hold about you and how we process it, and to obtain a copy of it.

6.3. Right to rectification

This is your right to obtain the rectification of your inaccurate or erroneous data, as well as to complete incomplete data.

6.4. Right to erasure

This is your right to request deletion or suppression of your data and information in certain circumstances. However, please note that there are certain occasions when we are legally entitled to continue to retain and process your data, for example, to comply with a legal obligation to retain data.

6.5. Right to restriction of the processing

This is your right to restrict or limit the processing of your data in certain circumstances. For example, if you apply to have your data erased, but, instead of erasing it, you would prefer that we block it and process it only for record- keeping purposes because you will need it later to file a complaint. Again, please note that there may be times when we are legally entitled to refuse your request for restriction.

6.6. Right to object

This is your right to object to our processing of your data for a specific purpose, in certain circumstances provided for by law and related to your personal situation.

6.7. Right to data portability

This is your right to ask us to receive your personal data in a structured, commonly used, machine-readable and interoperable format and to transfer it to another data controller, provided that we process your data by automated means.

6.8. Right not to be subject to automated individual decisions

This is your right to ask us, in certain circumstances, not to make you subject to a decision based solely on automated processing of your data, including profiling, that produces legal effects on you or similarly significantly affects you.

In general, you may exercise these rights at any time and free of charge by contacting Telefónica at [email protected]. Likewise, in general, mechanisms for the automated unsubscribe of communications and other options for the withdrawal of consent and opposition shall be made available to the user

It is important to bear in mind that when you exercise a right, in most cases, you must clearly specify which right you are exercising and provide a copy of a document proving your identity.

Any exercise of rights shall be answered within a maximum period of one month, which may be extended by two months if necessary, taking into account the complexity of the request and the number of requests.

Finally, in the event that you do not agree with the way in which your data is handled by Telefónica, you have the right to lodge a complaint with the national supervisory authority by contacting the Agencia Española de Protección de Datos, whose contact details are as follows:

Agencia Española de Protección de Datos
C/ Jorge Juan, 6 – 28001 Madrid

www.aepd.es

7. Further processing of data and changes to the Privacy Policy

Telefónica reserves the right to update this Privacy Policy at any time. Such update will be made public by Telefónica, in any case, with the legally required notice prior to its entry into force. In addition, it will be communicated directly to the data subject in the event that it affects their rights or freedoms or when, for example, the inclusion of a new processing activity requires the consent of the data subject or modifies the scope of the legitimate interest that enables the processing.

Privacy Policy updated as of September 2021.