The following Privacy Policy describes the treatment of personal data that Hidralia, Gestión Integral de Aguas de Andalucía, SA (hereinafter, “Hidralia”) carries out of its clients.

1. What is the purpose of this Personal Data Protection Policy?

The purpose of this Privacy Policy is to publicize the way in which we obtain, treat and protect the personal data of our clients and those who contact the company in relation to them, and in this sense, this Policy is applicable to: 

• People who maintain a contract or policy in force with Hidralia for the provision of a service. Customer or subscriber of the service.

• People who contact Hidralia to carry out pre-contractual arrangements (request a registration, request a change of ownership, or a subrogation or a new connection to a new supply point).

• People who contact Hidralia to report service incidents, make inquiries, make complaints or claims of any kind without maintaining a contractual relationship with this entity (for example, make a query about general conditions of service, report a leak on public roads, report a fault, report fraud of which they are aware, etc.).

• Finally, it also refers to those people, third parties other than the client, whose data appear in a contract file because they have been informed by the client himself or by the interested party, such as, for example, authorized by the owner to carry out procedures in the contract, as contact for notifications, such as tenants of the property, or those whose payment details are indicated in the contract for the payment of bills.

2. Who is responsible for the data you provide?

The person responsible for the processing of your personal data is Hidralia, Gestión integral de Aguas de Andalucía, SA, (hereinafter, “Hidralia”) with address Calle Alisios nº 1, 41012, Seville and NIF number A-41461856, a company dedicated to the provision of of services related to the management of drinking water. 

3. What type of data does Hidralia collect?

Depending on the management carried out, Hidralia will collect the following personal data:

• Identification and contact data (name, ID, landline or mobile phone, email, etc.), and information about the property for which a water and / or sewerage and / or treatment contract is managed or intended to be managed, (address , etc.,) economic data: bank details provided by the client or authorized person) signature (holographic, OTP or biometric in the event that your office has this signature collection system) The mobile phone number may be used, where appropriate, for the digital signature of documents (OTP (One Time Password) system. These data are necessary for the correct provision of the service.
• Consumption data and technical data of the contracted service. These data are necessary for the correct provision of the service.
• Different data provided voluntarily by you when contacting us for any reason (making a claim, to report an emergency, make inquiries, request the application of social aid or bonuses when appropriate in cases of vulnerability or others (family circumstances, etc. This information is necessary to be able to manage and respond to the request you make.
• Data of third parties that the client or the third party voluntarily provide to Hidralia and that will be integrated into the contract file. These data are used for the correct provision of the service. (ex: contact data of a third party for notifications, data of third parties that are authorized by the client to carry out various procedures on their behalf in carrying out their contract)
  In the event that the personal data provided belongs to a third party, whoever provides them guarantees that they have informed said third party of this Privacy Policy and have obtained their authorization to provide their data to Hidralia for the aforementioned purposes. It also guarantees that the data provided is accurate and up-to-date, being responsible for any damage or loss, direct or indirect, that may be caused as a result of the breach of such obligation.
• Data related to the navigation carried out on the Hidralia corporate website and / or the Virtual Office and data provided by the user through the website or the Virtual Office:
  • Data related to the navigation carried out through the Hidralia corporate website and / or the Virtual Office: Visiting the Hidralia website and browsing its different sections does not require any personal data to be provided. However, we will collect certain information related to the navigation that you carry out (which will not always allow us to identify the user) through cookies installed on your computer. Please, see more details about this matter in our Cookies Policy at https://www.hidralia-sa.es/politica-de-cookies.
  • Data provided by the user when carrying out procedures and procedures through the Hidralia corporate website and / or through the Virtual Office. The user of the Web can carry out different procedures and procedures for which in some cases it will not be necessary to register ("public Web procedures"). On the other hand, whoever is a customer of the service may register in the Virtual Office and carry out all the procedures and procedures enabled ("Virtual Office procedures"). To register in the Virtual Office, the client must accept its conditions of use (see the Conditions of use of the Virtual Office at https://www.hidralia-sa.es/registro.
    

    The website has its own Privacy Policy for the Hidralia-sa.es website that you can consult at the following link https://www.hidralia-sa.es/aviso-legal.

4. Procedures carried out by a third party or on behalf of a company and by Property Administrators

As a general rule, all the procedures and procedures that entail the processing of personal data will be carried out by a person in their own name and in this case they will only provide personal data of which they are the owner. However, the User will be allowed to provide data from a third party provided that (i) he has obtained the data in a lawful manner; (ii) has informed the affected party, when appropriate, of the procedure or query to be carried out, and (iii) has a legitimate interest to carry out the management it begins. In this sense, procedures may be carried out on behalf of third parties in the case of:

• Person with express authorization of the owner.
• Representatives or contact persons of legal persons acting on their behalf.
• Property Administrators duly registered, acting on behalf of communities of owners and other clients.

The personal data of the representatives, contact persons and Property Administrators will be processed, based on legitimate interest (in accordance with the provisions of article 19 of Organic Law 3/2018), with the sole purpose of managing the request made. on behalf of a third party.
 

5. What do we use your personal data for and what is the basis of legitimacy?

We use your data for the following purposes and with the following legitimizing basis as the case may be:

• Manage the water supply and / or sewerage and / or purification service that you have contracted. We carry out different procedures necessary to provide the contracted service, such as: periodic readings, issuance of invoices, information to the client about the consumption made by different means, collection of invoices, etc.The processing of this data is necessary to maintain the contractual relationship with our clients.
• Manage and solve service incidents. Hidralia carries out leak detection tasks, fraud control in the supply and hydraulic balance in order to guarantee adequate water management and the correct operation and performance of the network.
  

  Hidralia has a legitimate interest in processing the personal data of its customers to detect leaks and avoid supply fraud. On the other hand, the processing of data related to the contracted service is necessary to maintain the contractual relationship with its clients.

• Respond to requests that you voluntarily make to us (among others: claims, questions, emergency calls, application of social aid or bonuses when appropriate in cases of vulnerability or others, etc.).
  

  The treatment of this data is based on the execution of the contract. In the case of non-clients, the treatment is based on the consent granted when contacting us voluntarily to carry out any management.

• Manage the signing of documents through the OTP SMS (One Time Password) or biometric signature process in the event that your office has this signature collection technology. During the OTP SMS signing process, the signing operation is linked with the signer through the mobile phone number provided by the client and with the content through the OTP calculation algorithm. In the biometric signature process, aspects of the signature are collected (pressure, speed, stroke) which, when grouped, make it unique.The processing of these data is necessary for the execution of the contract.

• Carry out statistical studies and / or customer satisfaction surveys in relation to the contracted service, to help us improve the service or design new functionalities.
  • Statistical studies. We carry out statistical studies to improve our customer services or design new functionalities. For example, we evaluate satisfaction levels, determine periodic consumption averages, and forecast water demand in different areas or municipalities.
    This treatment is based on Hidralia's legitimate interest in treating the personal data of its clients and, in particular, their opinion about the service and information on consumption and breakdowns that they may suffer, to generate statistical or aggregate studies that allow improve our services. 
  • Satisfaction surveys. Likewise, we carry out satisfaction surveys with our clients related to the contracted service, for which we could contact clients by phone and email. In no case will measures be taken that affect you individually and your personal data will be anonymized.
    This treatment is based on legitimate interest. Hidralia considers that this purpose is compatible with the purpose of the contracted service, since there is a relationship between both purposes (we carry out satisfaction surveys in order to provide you with a better service). We understand, on the other hand, that our clients can reasonably expect their personal information to be processed for this purpose
• Manage access and use of the Virtual Office.
  The treatment of this data is based on the existence of a contractual relationship with the client and their consent. On the one hand, the Virtual Office is a means of contact made available only to clients with a current contract with Hidralia. The Virtual Office allows the client to manage their data and consult their contract data (consumption, invoices ...) and make requests related to the service ... On the other hand, registration in the Virtual Office requires a clear affirmative act that reflects the consent of the client to the processing of their personal data when requesting registration and accepting the corresponding Conditions of use of the Virtual Office. 
• Carry out surveys not related to the service to know the perception that our clients have about Hidralia or the Group to which it belongs, for the duration of their contract and provided that they give us their consent. The information thus collected will be used exclusively to obtain statistical or aggregated values.
  The treatment of the data for this purpose is based on the consent granted by the client. At any time you can revoke the consent given by contacting Hidralia through any means.
• Offer or send our clients commercial information related to the contracted services managed by Hidralia, as well as activities and events related to said sector, provided that you give us your consent. If the client authorizes us to do so, we can send these promotional communications even by electronic means.
  The treatment of the data for this purpose is based on the consent granted by the client. At any time you can revoke the consent given by contacting Hidralia through any means. 
• Preparation of a customer profile by continuously monitoring their water consumption, as well as using other data that you have provided us, to offer you personalized promotions and services related to the water sector, provided that you give us your consent. For this, its remote reading data will be used, among other things, allowing, among other things, to know in real time the water consumption that it carries out.
  The treatment of the data for this purpose is based on the consent granted by the client. At any time you can revoke the consent given by contacting Hidralia through any means.
  Elaboration of a profiling of our clients to improve the actions aimed at managing debt collection. For this, objective variables such as number of unpaid invoices, amount of customer debt or age of defaults on a contract will be used, which are considered personal data. This treatment is based on the legitimate interest of the company.

6. Who can access your personal data?

Hidralia has service providers (companies of the group to which Hidralia belongs and external providers) to carry out some tasks inherent to the contract that, where appropriate, must access your data in order to carry out the requested management. These providers will be in charge of the treatment in accordance with LO 3/2018, Protection of Personal Data and guarantee of digital rights, and will only process personal data in accordance with Hidralia's instructions. In no case will they use the User's personal data for their own purposes or other than those detailed in this Policy.

Some of our providers are located in countries outside the European Economic Area (EEA) or, being located in the EEA, share the information with other entities located outside that territory. Hidralia guarantees that:

• Transfers are made to countries for which the European Commission has declared that they provide a level of protection comparable to the European one.

• In the absence of said adequacy statement (currently, only transfers are made to the United States, among others), the Standard Contractual Clauses approved by the Commission have been signed.

You can consult this information on the AEPD page: https://www.aepd.es/es/derechos-y-deberes/cumple-tus-deberes/medidas-de-cumplimiento/transdamientos-internacionales

For more information on this matter, contact the Hidralia Data Protection Officer by any of the means indicated in this Policy.

7. Who do we communicate your data to?

HIDRALIA, has a legitimate interest in transmitting your personal data to companies of its business group in Spain for administrative purposes. (Recital 48 of the RGPD).

Apart from the previous assumption, Hidralia does not communicate your personal data to third parties, unless you expressly consent to it or to comply with a legal obligation.

When your consent is necessary to communicate your personal data to third parties, in the data collection forms we will inform you of the purpose of the treatment, of the data being communicated, as well as the identity or sectors of activity of the possible assignees of your personal information.

Hidralia itself could be obliged to communicate user data, whether or not it is clients, to the competent Administrations that are service owners or are holders of tax concepts associated with the services provided, or when communication is necessary to attend a request or consultation, or when necessary to judicially manage a fraud situation.

In particular, Hidralia is obliged by legal provision to communicate the personal data of its clients to the following entities that, among others, may use them to:

8. How long do we keep your data?

Customer data will be kept as long as the contractual relationship is maintained in order to manage it properly. Once said relationship has ended (after the deadlines for the collection of pending receipts and open conflicts in relation to the service have been resolved) we must keep your data duly blocked for the entire period in which legal responsibilities derived from services provided or from the treatments performed.

The data of non-clients provided for other procedures (consultations, fraud communications...) will be kept for the time necessary to manage your request, plus an additional period in order to attend to possible legal responsibilities derived from it.

If you have consented to the sending of commercial communications, we will keep your data until the moment you indicate that you want to stop receiving our offers, even if the contractual relationship with us has ended.

9. What are your data protection rights and how can you exercise them?

The Law recognizes the following rights regarding data protection:

To exercise the above rights, or revoke the consent given, it will be enough for you to send us your request by any of the following means:

• By post to the address: Calle Alisios nº 1, 41012 Sevilla.
• Through the contact on our website: https://www.hidralia-sa.es/contacta.
• By registering your request at any of our service offices.

The applicant shall be sufficiently identified in the application. Where the controller has reasonable doubts as to the identity of the natural person making the request, he or she may request that he or she provide the additional information necessary to confirm his or her identity. In the event that it acts through legal representation, it must also provide a DNI and a document accrediting the representation of the representative.

Hidralia will reply as soon as possible and in any case within a period of one month, to the requests received. The term may be extended up to two more months, taking into account the complexity and the number of requests received. In this case, Hidralia will inform the interested party about this circumstance indicating the reasons for the delay.

The exercise of rights is free. However, Hidralia reserves the right to charge a fee when requests are manifestly unfounded or excessive, especially due to their repetitive nature. In this case, in accordance with the RGPD, Hidralia may directly choose not to reply to the request received.

Additionally Hidralia has appointed a Data Protection Delegate with whom you can contact if you have any questions or complaints regarding data protection. You can contact the Data Protection Officer by any of the following means:

• Email: protecciondedatos@hidralia-sa.es
• Postal Mail: Calle Alisios nº 1, 41012 Sevilla. A / A of the Data Protection Delegate.

In any case, as the affected or interested party, you can file a complaint with the competent data protection authority, in this case, the Spanish Agency for Data Protection on the portal https://www.aepd.es/.

This policy describes the treatment carried out by Hidralia, Gestión Integral de Aguas de Andalucía, S.A. of personal data collected through video surveillance cameras and access control stations and devices, if any, to offices or service facilities.

I.    Who is responsible for the data collected?

The person responsible for personal data is Hidralia, Gestión Integral de Aguas de Andalucía, S.A. with registered office at calle Alisios, nº1, 41012 Seville.

In case you have any questions or queries regarding the processing of your personal data, please contact our Data Protection Delegate ("DPO") at the email protecciondedatos@hidralia-sa.es, or at the Postal address: calle Alisios, nº1, 41012 Seville.

The DPO is in charge of ensuring compliance with data protection regulations and corporate privacy policies in relation to the treatments carried out by Hidralia, Gestión Integral de Aguas de Andalucía, S.A. including those related to video surveillance and access control.

II.    What do we use your personal data for?

We collect different personal data, which you will find detailed in the following section, with the main purpose of guaranteeing the security of our facilities and, in particular:

• The data collected through the video surveillance system is processed to guarantee the security of the facilities, goods and people who are in our facilities.

• The data collected through our access control systems are processed to:

  • Facilitate access to offices, work areas and restricted areas.

  • Keep track of entries made by external personnel and visitors.

  • Guarantee the safety of goods and people who are in our facilities.

III.    What type of personal data do we process?

• Identifying data (name, ID, company to which it belongs, person it visits, etc.). We will request this information from you when you present yourself at the reception desk.

• Video recordings. By staying within the recording field of the video surveillance cameras installed in our building, your image can be recorded. There is no hidden camera. All cameras are signposted.

IV.  Legitimacy of the treatment

We process your personal data based on the public interest in guaranteeing the safety of people, property and facilities.

V. Who do we share your data with?

Your data may be accessed by the companies with which we have outsourced reception and security services, as well as technical maintenance services for our video surveillance cameras.

Currently these services are subcontracted by the following entities: Aquae Security, S.A.U. and Securitas Direct España, S.A.U.

The personnel who carry out the technical maintenance of our video surveillance cameras, a service subcontracted to companies:

Aquae Security, S.A.U.

Securitas Direct España, S.AU.

No data will be transferred to third parties, except legal obligation. In the event that we detect that a security incident has occurred or we have indications of the commission of a crime (theft, destruction of material, assault on people, etc.), the data collected by our video surveillance cameras and control systems of Access will be made available to the State Security Forces and / or competent Judges and Tribunals.

VI. How long do we keep your data?

The data collected will be deleted within a maximum period of 30 days (counting from its registration). Exceptionally, Hidralia, Gestión Integral de Aguas de Andalucía, S.A. will keep a copy of the data for a longer period when there has been a security incident or there are indications of commission of a crime (for example, a theft).

VII. Your rights

The current data protection regulations grant you different rights:

- Right of access to your data and obtain a copy of it.

- Right of deletion or rectification.

- Right to limitation of treatment.

- Right of opposition.

- Right to the portability of the data you have provided.

Please bear in mind that, although you can exercise any of the above rights, the special characteristics of the treatment regulated in this policy will not allow us to respond positively to your request in all cases. For example, we cannot rectify a video surveillance recording or a log or access log in which your time of entry to our facilities is automatically displayed.

You have the right to file a claim with the DPO if you consider that your personal data has been mishandled. Your complaint will be investigated confidentially and you will receive a response from our DPO.

To exercise your rights, you can contact us through these means:

• Addressing us a letter by post to the address: calle Alisios, nº1, 41012 Sevilla.

• Through the contact on our website: https://www.hidralia-sa.es/contacta.

Additionally, you can contact the Data Protection Delegate at the email protecciondedatos@hidralia-sa.es

In any case, as an affected or interested party, you can file the complaints that you consider appropriate before the Spanish Agency for Data Protection (www.aepd.es).