Privacy Policy

Telefónica Tech S.L.U., Telefónica IoT & Big Data Tech, S.A.U. and Telefónica Cybersecurity & Cloud Tech S.L.U. (hereinafter and jointly, “Telefónica Tech”), as owners of this website (hereinafter, the "Website"), inform you that all the companies of the Telefónica Group to which they belong are committed to respecting the privacy of users as well as the secrecy and security of personal data, in compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), as well as the other Spanish regulations applicable to its activity such as Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, Law 34/2022, of July 11, on information society services and electronic commerce and, where applicable, Law 9/2014, of May 9, General Telecommunications.

Some of our principles are:

TRANSPARENCY

We will not process your data in an unexpected, obscure, or abusive way. When we collect your personal data through our Website you will be properly informed about: who is processing your data, the purpose of the processing, on what is based the legitimacy of the processing, the possibility of exercising your rights and other information of interest. In addition, your data will be deleted, according to the defined retention policy about which you will be informed and, in any case, when you request it by exercising your right of erasure.

CONTROL

We will request your consent whenever necessary and will provide you with the necessary tools to access and update your personal information as well as to decide how to manage your data, selecting the purposes for which we will process them.

SECURITY

We are concerned with ensuring the security, secrecy, and confidentiality of your data. Therefore, as part of our commitment and in compliance with current legislation, we have adopted the most rigorous and robust security measures and technical means to prevent their loss, misuse or unauthorized access, committing ourselves to keeping them secret and guaranteeing the duty to safeguard them by adopting all necessary and reasonable measures to prevent their alteration, loss and unauthorized processing or access, in accordance with the provisions of relevant legislation.

For all these reasons, Telefónica Tech considers your privacy a priority. That is why we protect your information pursuant to the Privacy Policy that you can read below. If you have any questions, please contact us via gdpr-comms.tech@telefonica.com and we will be pleased to help you.

1. ¿Who is the data controller of your data as a user of this Website?

   The following companies of the Telefónica Tech Group will generally be joint controllers for the processing of your personal data within the framework of this Website:

   - Telefónica Tech, S.L.U., with Tax ID No. B-78529724 and address at C/ Gran Vía 28, P.C. 28013, Madrid (Spain).

   - Telefónica IoT & Big Data, S.A.U., with Tax ID No. A-78967577 and address at Ronda de la Comunicación s/n, Distrito Telefónica, Edificio Oeste 1, planta 2ª, P.C. 28050, Madrid (Spain).

   - Telefónica Cybersecurity & Cloud Tech, S.L.U., with Tax ID No. B-01636760 and address at Ronda de la Comunicación s/n, Distrito Telefónica, Edificio Oeste 3, P.C. 28050, Madrid (Spain).

   The foregoing notwithstanding, exceptionally with regard to the provision of certain online platforms such as the “ Cyber Security Services Portal”, the “Cloud Portal”, the “Kite” managed IoT connectivity platform or the “Telefónica Tech The Brain” platfom, we inform you that the aforementioned companies may act as Data Processor or Sub-Processor for the purposes of the applicable data protection regulations. This may be especially applicable in cases where they process personal data on behalf of other Telefónica Group operators to which they belong and/or their B2B customers.

   Regarding the processing of personal data associated with B2B Customers (i.e., data of contact persons, authorized users, and/or legal representatives, among others), please note that, depending on the products and services you have contracted, you must comply with the privacy provisions of the applicable terms and conditions or contractual documents for that specific product or service.

   Telefónica Tech likewise has a Data Protection Officer who ensures compliance with data protection regulations and whom you can contact with any questions, doubts, and/or complaints you may have regarding the processing of your data by writing to DPO_telefonicasa@telefonica.com , indicating “Telefónica Tech” in the subject line.

   In addition, for any queries that are not specifically related to this Privacy Policy, please note that our Legal Notice at the bottom of the Website also contains our general contact details and, where applicable, the specific details of some of our areas for certain specific products and services.
   
   For more information, remember that you can also consult the essence of the scope of the joint controllership between the aforementioned companies of the Telefónica Tech Group.

2. ¿What data do we process about you, for what purpose and why do we process the data?

   Depending on the section of the Website, the data collection channel or the means by which you interact with Telefónica Tech, your data may be processed for the following purposes:

   1. Response to queries submitted through forms or other contact channels

      What for? – Purposes of processing: the purpose of the processing we are pursuing is to deal with and respond to enquiries made by users of the Website and/or, in general, data subjects contacting Telefónica Tech through the other channels provided for this purpose. Please note that your data may also be provided, when needed, to the Telefónica Group company that markets the products and services in your territory.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out that purpose is the consent given when you voluntarily contact us.

      What data? – Type of data: the data we process for this purpose are your identification, contact and/or professional data (e.g. name and surname, email, contact telephone number and/or company you work for), voice in the case of the telephone channel as incoming calls may be recorded, as well as the information contained in the query submitted, the processing of which is necessary to provide you with a response.

      Where are they obtained from? – Source: the data we process for this purpose are obtained from you when you complete the contact forms included on the Website, call our Customer Service channel and/or send us an email at the contact addresses we make available to users, including those mentioned in this Privacy Policy.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose relate to Website users or, in general, data subjects who submit enquiries and any other data subjects whose data have been provided by the sender of the enquiry.

      For how long are they processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in section 3 of this Policy and, in any case, will not be retained for longer than is necessary to deal with queries and, where appropriate, to meet Telefónica Tech's potential liabilities in relation thereto.

   2. Sending newsletters

      What for? – Purposes of processing: the purpose of the processing we are pursuing is to send periodic newsletters by e-mail, upon request by the data subject, on the activities carried out by the Telefónica Tech and the content generated by it through its different areas. Depending on the newsletter you have asked to subscribe to, your data may be shared with the Telefónica Group companies responsible for it in order to process your subscription request and/or management of associated mailings.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the consent given when you subscribe to the newsletters.

      What data? – Type of data: the data we process for this purpose are your identification, professional and contact details necessary to send you the newsletter.

      Where are they obtained from? – Source: the data we process for this purpose are obtained mainly from the newsletter subscription forms included on the Website, as well as the rest of the contact channels provided by Telefónica Tech for this purpose.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose relate to the users of the Website and data subjects in general who subscribe to the newsletters.

      For how long are they processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in section 3 of this Policy.

   3. Maintenance and management of the Website owned by Telefónica Tech, its security and user access

      What for? – Purposes of processing: the purpose of the processing that we are pursuing is to maintain active and technically manage the Website owned by Telefónica Tech that is visited by the user and to which this Policy is applicable and any applicable Particular Conditions, to protect it against security incidents and malicious attacks that it may suffer and, in general, to enable free and continuous access to it by all internet users. Users can find further information on the scope of this purpose in the Cookies Policy applicable to the Website owned by Telefónica Tech.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the legitimate interest of Telefónica Tech, as the owner, in guaranteeing the availability and security of its website for all internet users who visit it, in accordance with the relevant legal and user conditions notices.

      What data? – Type of data: the data we process for this purpose are those, generally pseudonymized, which are obtained directly from the devices with which the user accesses and browses the Website owned by Telefónica Tech, the processing of which is strictly necessary for the fulfilment of the aforementioned purpose.

      This Website browsing data may include the user's IP address; the date and time of connection; aggregate data on the type of audience browsing the Website, such as geographical information, the device used for browsing, technology, etc.; browsing behaviour on the Website, such as the number of pages viewed, average time on the page, bounce rate, whether content is shared via social networks, etc.; as well as aggregate data on the channels from which the audience arrives: organic search, direct search, social networks or referrals.

      Where are they obtained from? – Source: the data we process for this purpose are obtained from the devices with which the user accesses and browses the Website owned by Telefónica Tech.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose relate to users who access and browse the Website owned by Telefónica.

      For how long are they processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in section 3 of this Policy.

   4. Maintenance, management, access and security of Cybersecurity, Cloud, IoT, Big Data and/or Blockchain platforms and/or services accessible through the Website for authorized users

      What for? – Purposes of processing: the purpose of the processing that we are pursuing is to maintain active and technically manage the services, platforms and/or, in general, private areas that may be accessible from time to time through the Website owned by Telefónica Tech and to which, in addition to this Policy, the conditions expressly accepted or agreed to that effect will be applicable in the framework of collaboration contracts and/or provision of services such as those related to Cybersecurity, Cloud or cloud services, Internet of Things (IoT), Big Data, Artificial Intelligence and/or Blockchain signed with third parties (Telefónica Tech´s customer companies); as well as through the cookies generated in private areas when users authorized by said third parties browse the Website.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose of processing the data of users authorized to access certain services and/or online platforms of Telefónica Tech, in their capacity as employees of a Telefónica Tech client company, is the proper fulfilment of said contractual relationship between Telefónica Tech and the company in which the authorized user carries out its activity.

      What data? – Type of data: the data we process for this purpose are all those necessary to create, manage and maintain the authorized user´s account on the Telefónica Tech service or platform accessible through the Website, as well as those obtained directly from the devices with which the user accesses and browses the Website.

      Where are they obtained from? – Source: the data we process for this purpose are usually provided either by the users and/or, in its absence, by the B2B customers in which these users carry out their professional activity, as well as from the devices with which the user accesses and browses the Website owned by Telefónica Tech, the processing of which is strictly necessary for the fulfilment of the aforementioned purpose.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose refers to users authorized by Telefónica Tech´s customer or collaborators to access and browse the private areas of the Website.

      For how long are they processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in section 3 of this Policy.

   5. Management of the relationship with users through the social networks used by Telefónica Tech

      What for? – Purposes of processing: the purpose of the processing that we are pursuing is to interact and maintain contact with users who interact with Telefónica Tech through the different social networks in which Telefónica tech has created an official account. This includes the public response to messages or public comments made by said users, appointments, attention and response to private messages through said networks, processing of the request to the Telefónica Tech area or to the Telefónica Group company competent to deal with it, etc. If strictly necessary, your data may be shared with the relevant Telefónica Group companies in order to process and respond to your request.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the consent you give when you interact with Telefónica Tech through the social network on which Telefónica Tech has an official account(s) created.

      What data? – Type of data: the data we process for this purpose are your public data in your profile on the social network, identification data, contact data and other data voluntarily shared during contact through the social network or data necessary to resolve the request made.

      Where are they obtained from? – Source: the data we process for this purpose are obtained from the social network through which you contact us and those that we obtain directly from you in that contact.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose relate to users who contact Telefónica Tech through the social network and any other data subjects whose data have been informed by the user of the social network when contacting Telefónica Tech.

      For how long are they processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in section 3 of this Policy.

   6. Management of events organized by or in collaboration with Telefónica Tech

      What for? – Purposes of processing: the purpose of the processing we are pursuing is to manage attendance and enable access to the events premises for those data subjects who decide to register voluntarily for the event. In addition, we may send evaluation surveys of the events in which you decide to register.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out that purpose is the consent given when you voluntarily apply to attend or participate in the relevant event.

      What data? – Type of data: the data we process for this purpose are your identification, professional and contact data necessary to manage your registration for the event.

      Where are they obtained from? – Source: the data we process for this purpose are obtained from the registration forms for the events provided for this purpose, whether they belong to Telefónica Tech and/or, where appropriate, to the other co-organizers of the events, as well as your participation in the event.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose refers to interested users who contact Telefónica Tech showing interest in attending or participating in events.

      For how long are they processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in section 3 of this Policy.

   7. Sending of commercial or advertising communications for Telefónica Tech´s products and services

      What for? – Purposes of processing: the purpose of the processing we are pursuing is to send commercial information, including by electronic means, about Telefónica Tech products and services.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out that purpose is the express consent of the recipient as a general rule, all in accordance with the applicable regulations.

      What data? – Type of data: the data we process for this purpose are your identification, professional and contact data necessary to manage the mailing.

      Where are they obtained from? – Source: the data we process for this purpose are obtained from the forms and/or other means of data collection provided for this purpose by Telefónica Tech.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose refers to interested users who contact Telefónica Tech showing interest in receiving commercial information.

      For how long are they processed? – Retention period: the data we process for this purpose will be subject to the general retention criteria set out in section 3 of this Policy.

   8. Improving customer satisfaction

      What for? – Purposes of processing: the purpose of the processing we are pursuing is to improve the satisfaction of our customers, attending to and responding to suggestions related to our products, services, procedures or attention in general made by users of the Website and/or, in general, people who contact Telefónica Tech through the rest of the channels provided for this purpose. Once the suggestion has been dealt with, your data will also be processed in order to contact you and find out how satisfied you are with it.

      Why? – Applicable legal basis: the legal basis on which we rely to carry out this purpose is the consent given when you voluntarily contact us.

      What data? – Type of data: the data we process for this purpose are your identification, contact and/or professional data (e.g. name and surname, email, contact telephone number and/or company you work for), as well as the information contained in the query sent, the processing of which is necessary to provide you with a response.

      Where are they obtained from? – Source: the data we process for this purpose are obtained from you when you complete the contact forms included on the Website and/or send us an email at the contact addresses that we make available to users, including those mentioned in this Privacy Policy.

      Who do they belong to? – Categories of data subjects: the data we process for this purpose relate to users of the Website or, in general, data subjects who send suggestions or queries and any other data subjects whose data have been provided by the sender of the query.

      For how long are they processed? – Retention period: the data that we process for this purpose will be subject to the general retention criteria set out in the following section of this Policy and, in any event, will not be kept for longer than is necessary to deal with queries and, where appropriate, to meet Telefónica Tech's possible responsibilities in relation to the same. However, once the suggestion has been dealt with, the message may be anonymized, eliminating all personal data that could identify you, keeping the record of opinions in order to improve the processes, products and services provided by the organization.

3. ¿How long do we keep your data?

   In general, we will keep your data for the period necessary to comply with the purposes described in each processing activity and to determine the possible liabilities that may arise from that purpose.

   For example, Telefónica Tech has established retention periods that will be applicable depending on the purpose and the legitimate basis applicable to each processing activity, unless a different period has been specified in this Policy and/or in the particular conditions or provision of each of the products and services in question:

   • In order to carry out the processing related to the execution of the contract signed with B2B customers, the data will be kept for the time that is strictly necessary to comply with the purposes required by each product or service contracted. For example, data obtained from the B2B customer will be retained for as long as the B2B customer maintains the activated status.

   • Recordings of telephone calls received by our Customer Service department will be retained for a period of 7 calendar days from the time they are made, as a general rule, in accordance with what is indicated in the informative locutions enabled for this purpose.

   • In application of civil, commercial and tax Spanish legislation, the data related to the contracting and billing of products and services contracted from Telefónica Tech will be retained for a minimum period of 6 years from the termination of the contractual relationship with the B2B customer.

   • In compliance with Law 25/2007 applicable in Spain, traffic and location data associated with IoT mobile lines will be retained for 12 months, to be made available to authorized public agents, when necessary, upon presentation of the corresponding court order. In the case of IoT lines provided by Telefónica Group Operators in other countries, the legal retention period indicated by them based on their applicable local regulations will apply.

   In any case, your data will be kept in accordance with the retention criteria or specific periods described in each processing activity and, where appropriate, until you withdraw your consent and/or object to the processing of your data. In this regard, we will make our best efforts to provide you with an automatic and simple mechanism so that you can withdraw the consent granted and/or object to the processing and, in any case, we are at your disposal at the e-mail address for exercising your rights as indicated in section 5 of this Privacy Policy.

   Finally, please note that after the aforementioned deadlines, the data processed may be destroyed, blocked or anonymized, as appropriate, and in accordance with the provisions of the law applicable. Accordingly, we also inform you that the data processed may be subject to an irreversible anonymization process in compliance, in any case, with the Code of Good practices in data protection for Big Data projects, as well as the Guidelines and guarantees in personal data anonymization procedures published by the Spanish Data Protection Agency in order to use all the guarantees established in the legislation, as well as any other measures permitted by the market and technology. In this regard, it should be noted that the principles of personal data protection are not applicable to anonymized information.

4. Who has access to your data? Are there international data transfers?

   In order to carry out the processing purposes described above, we may make use of authorized subcontractors acting on behalf of Telefónica Tech, as data processors (e.g. internet service providers, data hosting and technical support providers, platform providers, e-mail providers, security service providers, etc.) and contractually subject to our instructions, only for the lawful purposes described above and only for the period of time strictly necessary for that purpose.

   In particular, this involves giving access to your data to:

   • Providers, as well as their subcontractors, which help to fulfil the purposes described in section 2 of this Policy and/or to communicate and be in contact with you (e.g. Microsoft as our provider of Office 365 and SharePoint tools).

   • In the event that we need to share your information with other third parties (e.g. sponsors of events for which you are voluntarily registered), we will inform you accordingly and collect the necessary authorizations to do so. Such access will only be for lawful purposes and for the period of time strictly necessary to do so.

   According to the above, we also inform you that, to the extent strictly necessary to comply with the purposes stated, your data may be shared with other companies or entities belonging to or linked to the Telefónica Group, for processing under their responsibility and always for the same purposes stated in this Policy. The companies or entities belonging to or linked to the Telefónica Group to which your data may be shared can be consulted in the section “about Telefónica”, “about the Company” or the equivalent section that replaces it available on the website www.telefonica.com.

   In addition, in the event that there is a legal obligation or requirement to do so, we may communicate your data to the competent public authorities in accordance with such obligation or legal requirement. In this regard, Telefónica Tech always guarantees the highest level of protection in the event that these third parties have access to your data and information.

   Where authorized subcontractors acting on behalf of Telefónica Tech or such recipients are located or process your data outside the European Economic Area, we will be making an international transfer of your data in accordance with applicable data protection legislation. In general, we will avoid international data transfers, and your data will be processed within the European Economic Area. However, in the event that such international data transfers are necessary, we will take the necessary organizational, technical and contractual measures to ensure the protection and security of your data, such as, for example, signing the European Commission’s Standard Contractual Clauses with the authorized subcontractor or third party recipient, carrying out impact assessments on the relevant international data transfer to assess the risk and adopt measures to mitigate it, encryption of data in transit or at rest, pseudonymization of the data transferred, the possibility for the data subject to claim damages directly against the authorized subcontractor or third party recipient, etc.

   In relation to those cases in which Telefónica Tech must communicate data to other companies of the Telefónica Group that involve an international data transfer, we must highlight that, as part of its commitments to privacy and the protection of personal data, the Telefónica Group has signed Binding Corporate Rules ("BCRs"), which constitutes an adequate guarantee in accordance with the data protection regulations of the European Union. These Telefónica Group BCRs are accessible in the Global Transparency Centre on Telefónica's corporate website at https://www.telefonica.com/en/global-transparency-center/.

5. What rights do you have as a data subject?

   As a data subject, applicable data protection legislation grants you certain rights over your data which, depending on how they apply, you may exercise against Telefónica Tech. Below you will find details of these rights and how you can exercise them. We also inform you that on the website of the Spanish supervisory authority (www.aepd.es) you can find further information on the characteristics of these rights and download templates for exercising each of them.

   • Right to withdraw the consent: It is your right to withdraw your consent to the processing of your data for the purposes that are legitimized on that basis, at any time and in an easy way.

   • Right of access: This is your right to ask us for details of the data we hold about you and how we process it, and to obtain a copy of it.

   • Right to rectification: This is your right to obtain the rectification of your inaccurate or erroneous data, as well as to complete incomplete data.

   • Right to erasure: This is your right to request deletion or suppression of your data and information in certain circumstances. However, please note that there are certain occasions when we are legally entitled to continue to retain and process your data, for example, to comply with a legal obligation to retain data.

   • Right to restriction of processing: This is your right to restrict or limit the processing of your data in certain circumstances. For example, if you apply to have your data erased, but instead of erasing it, you would prefer that we block it and process it only for record-keeping purposes because you will need it later to file a complaint. Again, please note that there may be times when we are legally entitled to refuse your request for restriction.

   • Right to object: This is your right to object to our processing of your data for a specific purpose, in certain circumstances provided for by law and related to your personal situation.

   • Right to data portability: This is your right to ask us to receive your personal data in a structured, commonly used, machine-readable and interoperable format and to transfer it to another data controller, provided that we process your data by automated means.

   • Right not to be subject to automated individual decision-making: This is your right to ask us, in certain circumstances, not to make you subject to a decision based solely on automated processing of your data, including profiling, that produces legal effects on you or similarly significantly affects you.

   In general, you may exercise these rights at any time and free of charge by contacting Telefónica Tech at gdpr-comms.tech@telefonica.com. Likewise, in general, mechanisms for the automated unsubscribe of communications and other options for the withdrawal of consent and opposition shall be made available to the user.

   It is important to bear in mind that when you exercise a right, in most cases, you must clearly specify which right you are exercising and provide a copy of a document proving your identity.

   Any exercise of rights shall be answered within a maximum period of one month, which may be extended by two months if necessary, taking into account the complexity of the request and the number of requests.

   Finally, in the event that you do not agree with the way in which your data is handled by Telefónica Tech, you have the right to lodge a complaint with the national supervisory authority by contacting the Spanish Data Protection Agency, whose contact details are as follows:

   Agencia Española de Protección de Datos C/ Jorge Juan, 6 – C.P. 28001, Madrid (Spain) www.aepd.es

6. How is your data protected?

   Telefónica Tech cares about guaranteeing the security, secrecy and confidentiality of your data and personal information. That is why, as part of our commitment and in compliance with current legislation, we have adopted the most demanding and robust security measures and technical means to prevent their loss, misuse or access without your authorization. Proof of this are our information security certifications that are available for consultation at https://telefonicatech.com/en/policies-certificates

   In addition, Telefónica Tech undertakes to act quickly and responsibly in the event that the security of your data may be compromised, and to inform you if relevant.

7. Further processing of data and changes to the Privacy Policy

   Telefónica Tech reserves the right to update this Privacy Policy at any time. Such update will be made public by Telefónica Tech, in any case, with the legally required notice prior to its entry into force. In addition, it will be communicated directly to the data subject in the event that it affects their rights or freedoms or when, for example, the inclusion of a new processing activity requires the consent of the data subject or modifies the scope of the legitimate interest that enables the processing.

   For more information, you can consult the Global Privacy Policy and the Global Security Policy of the Telefónica Group, which also apply in general to our organization in its capacity as entity belonging to said business Group.

Privacy Policy updated as of February 2025.