BASIC DATA PROTECTION INFORMATION

DATA CONTROLLER

    AMARA, S.A. / A28073815

    Calle Trespaderne, 29 - 1ª planta, 28042, Madrid.

    Data Protection Officer (DPO): dpo@amaranzero.com 

PURPOSES FOR THE PROCESSING OF THE DATA SUBJECT’S PERSONAL DATA

• Management and control of contact with website users
• Sending commercial communications about AMARA
• Sending commercial communications about third parties
• Generating profiles using internal information
• Generating profiles using external information
• Provision of customer services
• Management and control of the data subject's satisfaction
• Ensuring compliance with legal obligations
• Management and control of visits to facilities
• Provision of vacant posts
• Provision of potential posts in the future

RIGHTS OF DATA SUBJECTS

You are hereby informed that, insofar as applicable, you may exercise your right of access, rectification, opposition, erasure, portability and limitation of processing. Furthermore, you may revoke your consent, if you have granted it, for any specific purpose.

You can exercise your rights by writing to: dpo@amaranzero.com or to AMARA’s registered address.

You can file claims before the Spanish Data Protection Agency: www.aepd.es, Spain's control authority. Further information can be consulted at “Additional data protection information”.

ADDITIONAL DATA PROTECTION INFORMATION

You can access further information by visiting www.amaranzero.es

1. Who is the data controller?

 Pursuant to the legislation in force in relation to the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC General Data Protection Regulation (hereinafter, “RGPD”) and Organic Law 3/2018, of 5 December, on Personal Data Protection and the guarantee of digital rights (hereinafter, “LOPDGDD”), the data subject is hereby informed that their personal data shall be processed by "AMARA, S.A.” (hereinafter, “AMARA”), Tax ID No. A28073815 and registered at Calle Trespaderne, 29 - 1ª planta, 28042, Madrid, in its capacity as the data controller.

For any disputes in relation to processing personal data, you can contact our Data Protection Officer (DPO) at: dpo@amaranzero.com, attaching a copy of your Spanish ID card or any other identity document permitted under law that allows you to be identified accordingly with the subject “Protección de datos (Data protection)”.

Furthermore, the data subject is hereby informed that if you have arranged products and/or services with: “Amara Solar Renovables, S.L.”, registered at Calle Trespaderne, 29 - 1ª planta, 28042, Madrid, Tax ID No. B-84567445; “Amara Net Zero, S.R.L.”, registered at Via Vincenzo Monti, 6, 20123, Milan, Tax ID No. 06461270966; “Ergytech, Inc.”, registered at 2400 Augusta, Suite 310 Houston, Texas 77057, USA, Tax ID No. 75-0316265; “Amara Net Zero Brasil, Ltda.”, registered at Av. Profesor Magalhaes Neto 1856, Ed. TK Tower, Sala 1006, Pituba, Salvador de Bahía, Tax ID No. 02857954/0001-40; “Amergy Mexicana, S.A. de C.V.”, registered at Calzada del Valle 110 planta baja Ote. Col. Del Valle, San Pedro Garza García, 66220, Mexico, Tax ID No. AME0011046TA; “Amara Limited”, registered at Room 2601, 26/F1, Kwai Hung Holdings Centre, 89 King´s Road, North Point, Hong Kong, Tax ID No. N-7401577G (hereinafter, indistinctly referred to as “AMARA”), each of these companies shall be considered the Data Controller.

2. What data will be processed, for what purpose and what is the legitimate basis? 

The personal data provided by the data subject shall be processed by AMARA for any of the following purposes, depending on the type of data provided and the legitimate basis:

PURPOSE 1 – Management and control of contact with website users

• Description of the purpose: Managing the personal data of users that make contact with AMARA using the contact forms made available to the user. Your data will be processed with a view to managing this contact, responding to queries, questions or comments you submit via the channels set up to this end on our website.   
• Legitimate basis: Art. 6.1.b) GDPR - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Data processed to this end: identity details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.), data on personal characteristics (civil status, date of birth, nationality, gender, etc.).

PURPOSE 2 – Sending commercial communications about AMARA

• Description of the purpose: Sending of commercial communications about products and/or services similar to those taken out by the data subject to maintain a relationship with advertising or promotional purposes in relation to products and/or services marketed by AMARA using conventional and/or electronic means (email, SMS, purchase receipts, etc.).
• Legitimate basis:  Art. 6.1.f) GDPR - Processing is necessary for the purposes of the legitimate interests pursued by the controller.

AMARA has performed a detailed assessment of the priority of rights and freedoms of the data subjects, performing an in-depth assessment of the legitimate interest ensuring the least possible interference with the fundamental right to data protection of the data subjects affected by the data processing. For further information, please contact the DPO at: dpo@amaranzero.com.

• Data processed to this end: identity details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.).

PURPOSE 3 – Sending commercial communications about third parties.

• Description of the purpose: Sending commercial communications about products and/or services other than those arranged by the data subject to maintain a relationship with advertising or promotional purposes in relation to the benefits or advantages of external companies, always communicated through AMARA, which shall be based on collaboration agreements in relation to the following industries: leisure, travel, culture, payment cards and methods, automation, transport, insurance, distribution and financing, gifts, fashion, home and technology.
• Legitimate basis: Art. 6.1.a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Data processed to this end: identity details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.).

PURPOSE 4 – Generating profiles using internal information.

• Description of the purpose: creating a commercial profile of the data subject using solely internal information obtained as part of the contractual relationship for the products and services that the data subject has arranged, with a view to making automated decisions based on the information generated to make specific offers, send commercial communications adapted to their profile and to allow or reject the arrangement of products and/or services. The preparation of profiles using internal sources may include the performance of operations that make it possible to optimise the provision of services offered by AMARA and improve the quality thereof and, as a result, users receive one type of commercial communication or another based on said analysis.

Notwithstanding the foregoing, in terms of decision making, the data subject has the right to obtain human intervention by AMARA, to make any claims they deem necessary, to express their point of view, to defend their right or interest pursuant to the legislation in force and to oppose the decisions adopted. The data processed to this end shall always respond to the current situation of the data subject.

• Legitimate basis: Art. 6.1.f) GDPR - Processing is necessary for the purposes of the legitimate interests pursued by the controller.

AMARA has performed a detailed assessment of the priority of rights and freedoms of the data subjects, performing an in-depth assessment of the legitimate interest ensuring the least possible interference with the fundamental right to data protection of the data subjects affected by the data processing. For further information, please contact the DPO at: dpo@amara.com

• Data processed to this end: identity and contact details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.), data on personal characteristics (civil status, date of birth, nationality, gender, etc.), social circumstances; transactions of goods and services, other data categories and data generated as part of the service.

PURPOSE 5 – Generating profiles using external information.

• Description of the purpose: creating a commercial profile of the data subject using solely external information to send third-party commercial communications to data subjects with a view to promoting third-party products and/or services related to the following activity industries: leisure, travel, culture, payment cards and methods, automation, transport, insurance, distribution and financing, gifts, fashion, home and technology.
• Legitimate basis: Art. 6.1.a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Data processed to this end: identity details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.).

PURPOSE 6 – Provision of customer services.

• Description of the purpose: respond to requests, questions, claims or complaints from the data subject resulting from the use of products and/or services offered by AMARA.           
• Legitimate basis: Art. 6.1.b) GDPR - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Data processed to this end: identity details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.) and data generated as a result of using the service.

PURPOSE 7 – Management and control of the data subject's satisfaction.

• Description of the purpose: monitoring and controlling the satisfaction of the data subject by performing quality and satisfaction surveys about products and/or services sold by AMARA.
• Legitimate basis: Art. 6.1.f) GDPR - Processing is necessary for the purposes of the legitimate interests pursued by the controller.

AMARA has performed a detailed assessment of the priority of rights and freedoms of the data subjects, performing an in-depth assessment of the legitimate interest ensuring the least possible interference with the fundamental right to data protection of the data subjects affected by the data processing. For further information, please contact the DPO at: dpo@amara.com

• Data processed to this end: identity details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.).

PURPOSE 8 – Ensuring compliance with legal obligations.   

• Description of the purpose: compliance with any of the legal obligations imposed on AMARA, such as those in relation to financing, fraud, health or security. The foregoing may entail, depending on the case and closely related to the above purpose, responding to court and administrative orders in relation to specific data subjects (for example, communications to the “Executive Service of the Commission for the Prevention of Money Laundering and Monetary Offences” for the prevention of money laundering and terrorist financing or the National Markets and Competition Commission”).
• Legitimate basis: Art. 6.1.c) GDPR– processing is necessary for compliance with a legal obligation to which the controller is subject.

AMARA has performed a detailed assessment of the priority of rights and freedoms of the data subjects, performing an in-depth assessment of the legitimate interest ensuring the least possible interference with the fundamental right to data protection of the data subjects affected by the data processing. For further information, please contact the DPO at: dpo@amara.com

• Data processed to this end: identity and contact details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.), social circumstances, transactions of goods and services, other data categories or data generated as part of the service.

PURPOSE 9 – Management and control of visits to facilities.

• Description of the purpose: The personal data of users who have an interest in visiting our facilities shall be processed with a view to processing the request made by the user and, as appropriate, performing actions that are necessary in relation to the organisation and management of the requested visit to our facilities.  
• Legitimate basis: Art. 6.1.b) GDPR - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract and Art. 6.1.c) GDPR - processing is necessary for compliance with a legal obligation to which the controller is subject.
• Data processed to this end: identity details (name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.).

PURPOSE 10 – Provision of vacant posts.

• Description of the purpose: Receipt and analysis of all personal data (CVs, identity documents, academic certificates, etc.) provided during the process to apply for a vacancy or practical experience offered by AMARA, with this data included in a processing register retained thereby.
• Legitimate basis: Art. 6.1.b) GDPR - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Data processed to this end: identity details (name, surname, identity document) contact details (email address, telephone number, postal address, etc.), personal characteristics (date of birth, nationality, etc.), academic and professional details (academic certificates, training and professional experience), employment details (professional, position, etc.).  

PURPOSE 11 – Provision of potential posts in the future.

• Description of the purpose: Receipt and analysis of all personal data (CVs, identity documents, academic certificates, etc.) provided by the data subject to fill future vacancies or practical positions that might be offered by AMARA or AMARA Group companies.
• Legitimate basis: Art. 6.1.a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Data processed to this end: identity details (name, surname, identity document) contact details (email address, telephone number, postal address, etc.), personal characteristics (date of birth, nationality, etc.), academic and professional details (academic certificates, training and professional experience), employment details (professional, position, etc.).

In relation to purposes for which the legitimate basis has been identified as the legitimate interest of AMARA, the data subject may contact dpo@amaranzero.com in order to obtain more information about the weighting performed (between the aforementioned interest and the data protection right of the affected parties).

Furthermore, the data subject retains the right to oppose processing activities based on the legitimate interest.

The type of data processed by AMARA may include, but not be limited to:

•     Identity details, for example, name, surname, identity document, postal and/or email address, telephone number, image, voice, etc.
•     Personal characteristics, for example: civil status, family data, date of birth, nationality, gender, etc.
•     Economic, financial and insurance data, for example: their participation in pension plans, economic data in relation to the payment of salaries, bank details, details about insurance, taxes and deductions, etc.
•     Social circumstances, for example: membership of clubs or associations, licences, permits, etc.
•     Academic and professional data, for example: data on their education and academic certificates, their employment history, their identification as data subjects, etc.
•     Data on transactions involving goods and services, for example: compensation and indemnification.
•     Data on commercial information, for example: activities and businesses aside from the provision of services that could generate a conflict of interests.
•     Data on the commission of criminal or administrative offences in cases in which this is necessary based on the nature of the position to be filled.

3.     What data is processed by AMARA and what are the sources of this data?

The data that AMARA processes as a result of the interactions between the user and our website is obtained from the following sources:

• Data provided by the user when filling in the forms made available by AMARA, by sending emails or any other channel that the user employs to communicate with AMARA.
• Data generated as a result of the user browsing and using AMARA's websites.
• Data generated as a result of the development, handling and maintenance of the relationship established between the user and AMARA.
• Third-party data provided by the user.
• Data obtained from external sources (for example, social media, etc.).

4. Who is the personal data sent to? Is it transferred internationally?

The data subject is hereby informed that the personal data may be sent to the institutions listed below, for the purpose indicated in each case:

• RECIPIENT 1: when necessary, AMARA Group companies, a list of which can be consulted at www.amaranzero.es for administrative purposes and to manage the customer relationship, based on the legitimate interest of AMARA to this end. The legitimate interest for the purpose indicated in the communication shall consist of guaranteeing the best level of organisation and optimisation, as well as the standardised management of the business group’s resources in cases in which, internally, this is necessary to effectively undertake the activity in question.
• RECIPIENT 2: Public administrations and the justice system.
• RECIPIENT 3: AMARA companies and partner institutions, for the organisation, management and/or promotion of requests, competitions, events, promotions or prize draws, when the participant has decided to sign up and/or take part in these.
• RECIPIENT 4: AMARA suppliers that, as applicable, are contracted to measure online traffic and the performance of users through cookies and similar systems, pursuant to the Cookies Policy and in their capacity as data processors.

5.     How long do we store your data?

​​​​​​​AMARA will store your data for as long as necessary to provide the requested service and/or to achieve the purpose of processing pursued.

Afterwards, unless the user has exercised their right of erasure, your data shall be stored for the legally applicable terms, based on the type of data and the purpose of processing.

In any case, the user may request detailed information about the data storage terms employed by AMARA by contacting our Data Protection Officer at dpo@amaranzero.com .

6.    What personal data must be provided in each case?

​​​​​​​​​​​​​​AMARA hereby informs users that, when the personal data is provided in a form on our website, the user shall be required to provide at least the data marked with an asterisk (*). When this data, which is considered necessary, is not provided, AMARA will be unable to provide the service or respond to the query or claim filed by the user.

7. What guarantees are required when providing personal data?

​​​​​​​​​​​​​​The user guarantees that the data provided are truthful, accurate, complete and up-to-date; they shall assume responsibility for any direct or indirect damages that may be incurred as a result of failing to comply with this obligation.

If the user provides data belonging to a third party, they guarantee that they have informed said third party of all aspects contained in this Privacy Policy and obtained their consent to provide us with the data for the purposes of processing in question. The above shall be prior to the provision of a third party's data on any of our websites.

AMARA hereby informs you that to provide your personal data, in any way, via our website, you must be of legal age. Users providing data to AMARA on this website declare and guarantee that they are of legal age, assuming full responsibility for said declaration.

8.     What measures are adopted to protect your personal data?

In response to AMARA’s concern for guaranteeing the security and confidentiality of your data, we have adopted the necessary levels of security to protect your personal data and installed the necessary technical measures to prevent the loss, misuse, alteration, unauthorised access and theft of personal data provided on the website. In any case, please bear in mind that online security measures are not infallible.

9. What are your personal data rights?

​​​​​​​​​​​​​​AMARA hereby informs you that you have the right to request confirmation about whether we are processing your personal data.

Likewise, AMARA hereby informs you that you have the following rights in relation to your personal data:

• Access your data: You have the right to access your data to know which of your personal data is being processed.
• Request the rectification or erasure of your data: Under certain circumstances, you have the right to rectify any personal data that is considered inaccurate or that concern you, and that is being processed by AMARA, in addition to the right to ask for your data to be erased, when the data is no longer necessary for the purposes for which it was gathered, in addition to other reasons.
• Request to limit the processing of your data: Under certain circumstances, you have the right to ask for the processing of your data to be limited, in which case, we hereby inform you that we will only store the data for which you have asked for processing to be limited to file or defend against claims.
• Request the portability of your data: Under certain circumstances, you will have the right to receive the personal data that you have provided to us, in a structured, common-use, mechanically-read format, and to ask for them to be transferred by AMARA to another data controller.
• Oppose the processing of your data: Under certain circumstances and for reasons linked to your particular situation, you will have the right to oppose the processing of your data, in which case, we would stop processing it, unless we are required to do so for legal reasons or to file or defend against potential claims.

Furthermore, any consent that you may have granted for your data to be processed may be revoked, without this affecting the lawfulness of processing based on the consent given prior to this being withdrawn.

AMARA hereby informs you that you may exercise your rights in relation to your personal data using any of the following channels:

• Writing to AMARA, S.A., for the attention of “DPO”, using the address: Calle Trespaderne, 29, 1ª planta – 28042 Madrid.
• Writing to AMARA, S.A. at: dpo@amaranzero.com .

In both cases, you will be required to provide proof of the identity of the person exercising their rights, by attaching a copy of both sides of their Spanish ID number, Foreign National identity document, passport or equivalent document.

AMARA shall provide the requested information within a period of one month from the receipt of the request.

AMARA hereby informs you that you are entitled to file a claim before the competent data protection control authority. However, before doing so, you can file a claim before the Data Protection Officer or the person or department responsible, who shall respond to the claim in a maximum period of two months.​​​​​​​