PRIVACY POLICY

1. Who Is The Data Controller?

The data controller responsible for the processing of your personal data is Aby Marketing Dreams SL, with VAT ESB65209801, and registered address at Hijas de la caridad 108, 48003, Bilbao, Spain.

2. For What Purposes Do We Collect Your Personal Information?

In accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Aby collects your personal data for the specific purposes detailed below:

• To adequately handle your contact and subscription requests through our Website form, as well as your information requests, suggestions and potential complaints.
• To provide you with the best possible service, manage data maintenance, and the professional, commercial and/or contractual relationship you establish with us, including corresponding invoicing and delivery.
• To carry out surveys, statistics, market research and commercial prospecting, in order to assess service quality, market trends, consumer habits, profile analysis, sales evolution analysis and business and investment decision-making.
• To send you commercial communications and keep you informed about services, products, offers, promotions, opportunities, events or news relevant to users, by email, instant messaging systems (e.g. WhatsApp, Telegram, etc.), postal mail, telephone calls (including automated calls, even with Artificial Intelligence assistance), SMS, push messages, as well as IDchek, unless you object to such processing by the means provided. ABY guarantees compliance with applicable regulations regarding electronic communications. If you wish to stop receiving these communications, you can request unsubscription by clicking the link provided in the communications themselves or by sending an email to: bajas@aby.group.
• If you have given your consent, to share your data with sponsors or Aby's clients so that you may receive commercial offers from their partners, clients or third-party companies in any sector (including, among others, the energy sector for commercial purposes) via email, telephone and/or SMS. The list of sponsors is available in this Privacy Policy. The sharing of data with third parties may include aggregation, deduplication and any other operations necessary to fulfil the purpose of the processing. We shall require third parties to comply with the UK GDPR.
• To comply with legally established obligations, as well as to verify compliance with contractual obligations, including fraud prevention.
• To cross-reference your data with other third-party databases, including specialised partners, for the purpose of verifying your identity, preventing fraudulent use and, where appropriate, improving the personalisation of communications and content.

3. What Personal Data Do We Process?

To browse our Website, you do not need to provide us with your personal data.

You will only need to provide it if you contact us through the Website form or through any communication made via email.

In that case, Aby will collect and process only the data strictly necessary for the purposes described in the previous section.

Therefore, we will only collect your personal contact data to identify you and to initially handle your communications and, subsequently, the relationship that may be established.

The data we will collect and process from the registration process are:

• Identification and contact data: name, surname, date of birth, full postal address, gender, email address, telephone number and other data that the form may request (including, where applicable, socioeconomic data).
• Commercial information data.
• Browsing, traffic and location data.

The data we will collect and process from database cross-referencing, where applicable, are:

• Economic, academic, professional and sociological profile data.

The data we will collect and process from users in the case of email marketing campaigns relate to:

• Commercial interest data.
• Browsing, traffic and location data.

Aby does not collect personal data from minors. By accepting this privacy policy, you confirm that you are over 18 years of age and that the data you provide is true, accurate, complete and up to date.

In this regard, as a user you shall be responsible for any false or inaccurate information you provide through the Website or by email and, therefore, for any direct or indirect damages caused to Aby or third parties.

If you provide us with third-party data, you guarantee that you have obtained their respective consents, so that Aby is exempt from any liability in this regard.

Notwithstanding the above, Aby may carry out any verifications it deems appropriate and necessary.

Aby guarantees that it has the necessary technical measures to protect the security of your data.

4. What Is The Legal Basis For Processing Your Data?

The legal basis or lawful ground for carrying out the processing described depends on the specific purpose and, in particular, may be based on:

• Your consent, freely given, informed and unambiguous, when requested (for example, for sharing data with sponsors or for certain commercial communications).
• Performance of a contract or the application of pre-contractual measures at the data subject's request, when processing is necessary to provide you with the requested service.
• Compliance with a legal obligation, when necessary to meet regulatory requirements (for example, fraud prevention or responding to requests from competent authorities).
• Legitimate interests of the controller or third parties, following a balancing assessment, for example: (i) fraud prevention and security, (ii) improvement of internal processes and service quality, (iii) direct marketing activities where permitted under applicable law and always with the possibility of objection, and (iv) processing of contact data of legal persons or professionals.

Consent may be withdrawn at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

Where processing is based on legitimate interests, you may object at any time on grounds relating to your particular situation, as provided under applicable law.

5. How Long Do We Process Your Data?

We will retain your data for as long as necessary for each of the above purposes. Accordingly:

• Your contact data will be retained for 30 days until your contact request, information request or any other communication has been addressed.
• Data necessary for the management and maintenance of the professional, commercial and/or pre-contractual and contractual relationship we establish will be stored and processed until such relationship ends.
• We will also retain your data thereafter for the legally established periods and for as long as they may be necessary for the establishment, exercise or defence of legal claims, to meet legal obligations and any liability that may arise from the previous relationship.
• Where the legal basis is consent, we will process your data until you withdraw it or object to the processing. In that case, your data will be retained in a duly restricted manner for the period during which claims may be brought.

During this period, your data will be duly restricted, remaining available to Courts and Tribunals, or to competent Public Authorities, and in particular to data protection authorities, to address any potential liabilities arising from the processing.

6. To Whom May We Disclose Your Data?

Aby may disclose your personal data, in accordance with the purposes described in section two of this policy, to the following categories of recipients, which include entities from the sectors of activity you can consult by clicking here.

• Consultancy, audit, administrative, financial and banking services.
• Postal, distribution and courier services.
• Archiving, custody and digitisation, storage and information processing services.
• Security, IT, hosting and cloud services.
• Information removal and destruction services.
• Advertising and communication services.
• Legal services, bodies and authorities where required by law.
• Services provided by third-party companies in the energy sector for commercial mailings.
• Content verification services.
• Data cross-referencing with other databases.

The recipients of the services indicated may be located within or outside the European Economic Area or the United Kingdom. In the latter case, Aby will carry out, where applicable, international data transfers duly legitimised and with appropriate safeguards to protect your rights, as detailed in section 8.

7. What Are Your Rights?

Rights of access, rectification, objection, erasure, restriction, portability and automated individual decision-making.

By exercising your right of access, at any time and free of charge, you may access your data, know what personal data you have provided, correct it if it is inaccurate, incomplete or incorrect, and request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

By exercising your right to object, you may object to the processing of your data, so that your personal information will cease to be processed for those purposes to which you have objected.

Right To Rectification: you may request the rectification of inaccurate or incomplete data.

Right To Erasure: you may request the erasure of personal data when the legally prescribed circumstances under Article 17 of the UK GDPR are met.

Right To Restriction: if you wish, and when the conditions provided for in data protection legislation are met, you may request the restriction of processing of your data.

Right To Portability: in certain circumstances, you may request the portability of your data to another data controller.

Right Not To Be Subject To A Decision Based Solely On Automated Processing, including profiling, if it produces legal effects on the data subject.

In the above cases, Aby may retain your data for the establishment, exercise or defence of legal claims and to meet legal obligations and any liability that may arise from the previous relationship.

You also have the right to lodge a complaint with the competent supervisory authority for data protection, in particular in the country of your habitual residence, your place of work or the place of the alleged infringement, when you consider that Aby has infringed the rights recognised by data protection legislation.

For your information, if you are in the United Kingdom, the competent authority is the Information Commissioner's Office (ICO) (www.ico.org.uk). In any case, you may also choose to first direct your complaint or enquiry to our Data Protection Officer by sending it to dpo@aby.group.

8. Where Is Data Stored And Are There International Transfers?

Your data is stored on servers located within the European Economic Area (EEA), depending on the infrastructure and technology providers used.

As Aby provides services and collaborates with clients and partners of global scope, it may be necessary in certain cases to carry out international data transfers outside the EEA or the United Kingdom. In such cases, Aby will apply appropriate safeguards and protective measures in accordance with applicable legislation.

9. Changes To This Information

We will review and update data protection information at least once a year or whenever there are changes to the legislation or to any of the procedures for processing your personal information, indicating the date of the last update.

If we have your email address, we will send you an email with information about such changes.

Where necessary, we will renew your consent so that you can confirm that you agree with these changes.

10. Commercial Communications

Participants in the various free promotions are informed that, provided they give their authorisation by ticking the corresponding box, their data may be processed for advertising purposes and consequently receive commercial messages from companies in the sectors referred to in this privacy policy to which their data has been previously shared.

This communication may be carried out through all channels provided by the participant: email, SMS, telephone, postal mail or through the use of computer applications and social networks. Such communications may, where applicable, include cookies/beacons/tags which, anonymously and without affecting personal data, allow the data controller and/or the companies with which it collaborates to better interact with the participant.

Likewise, if you tick any of the options detailed below, you may stop receiving, by any of the means described, information and advertising from other companies or entities related to the following sectors that may not be of interest to you:

You may also receive commercial offers from other companies or entities together with prizes obtained.

Participants may revoke, in whole or in part and at any time, the consent given for the processing of their data and the receipt of advertising communications by sending a notification to the email address (bajas@aby.group).

In addition to the provisions of the legislation applicable to the data controller of the commercial promotion, all persons whose personal data is processed may exercise, free of charge, the rights of objection, access, rectification, erasure, information, portability, restriction of processing and any other rights that may correspond to them, in the same form and manner as may apply under the Data Protection Act 2018 and the UK GDPR.

This data protection information was last reviewed and updated in February 2026