The Personal Data of the representatives of the Parties and those of the designated contact persons who may participate in this Agreement will be processed, respectively, by each of the Parties, who will act independently as data controllers. Such data will be processed in order to comply with the rights and obligations arising from the Agreement. The legal basis for such processing is the execution of this Agreement and compliance with the legal obligations of the Parties.
The Personal Data will be stored while the contractual relationship established herein is in force and, subsequently, said data will be duly blocked, until the expiration of the limitation period of the available legal measures. Personal Data will only be processed by the Parties and by those third parties to whom the law or contracts require to disclose such Personal Data (such is the case of third parties that are service providers to whom any service related to the management or fulfillment of the Agreement has been entrusted).
The interested party may exercise, in the terms established in the applicable legislation, the rights of access, rectification and deletion, as well as the rights of restriction of treatment, opposition and portability of the data, by means of written notification to each of the Parties to the addresses indicated in the Agreement and, in the case of the Seller, also by communicating to your data protection officer at the following email address: Dpo@iberdrola.es and, in the case of the Purchaser, at the address indicated at the beginning of this Agreement. In the event that the rights of individuals are not duly satisfied, the interested party will have the right to file a claim with the Spanish supervisory authority, that is, the Spanish Agency for Data Protection, or with any other competent control authority.
Each Party expressly agrees to inform its employees and other contact persons about the terms of this Clause, and shall release from all liability and indemnify the other Party in connection with any damages arising from the breach of this obligation.
Apart from the data of the representatives of the Parties and the Personal Data of the aforementioned contact persons, in the event that any activity to be carried out by an agent does not require, by its nature, access to Personal Data whose handling is the responsibility of the principal, the agent is expressly prohibited from such access in the event that he could accidentally access such information.
Thus, the agent confirms that he has informed his employees about the following aspects and maintains evidence of compliance with this requirement:
a) The prohibition of access to Personal Data while performing work for the client.
b) The obligation to inform the client about any security incident related to the service that could give rise to or, in fact, give rise to possible access to Personal Data.
c) The duty to maintain the confidentiality of any information about Personal Data with those who may eventually have access to it, which also it must remain confidential after the termination of the Agreement, and not use it for any purpose.
Notwithstanding the foregoing, if as a result of any security incident, or if it is unavoidable for the conclusion of the Agreement, the agent’s personnel or its subcontractors access or handle Personal Data owned by the principal, the agent undertakes to immediately inform the principal of such access or handling.
- 27 -