Personal data security and protection
1. The entity in charge of processing your personal data
The entity in charge of processing your personal data is Energía XXI Comercializadora de referencia S.L.U. ("Energía XXI") with Spanish tax identification number (CIF) B82846825. The contact details for the responsible entity are as follows:
Postal address: Calle Ribera del Loira, 60. 28042-Madrid, Spain.
Telephone: +34 800 76 03 33.
2. Purpose and Processing
Compulsory processing
Your data may be processed for the purpose of managing the provision of energy supply services. If any of these products or services involves instalment payments or provision of a periodic invoicing, prior to the contract being approved we may conduct credit and solvency checks as we deem appropriate to assess your financial solvency. The result of said check could, if applicable, condition the entering into force of the Contract. In addition, in the event of a non-payment, Energía XXI Comercializadora de referencia S.L.U. will be able to report your data to said databases, always complying with the guarantees set forth in the legislation in force.
If, after starting the online signing up process and having submitted your personal data, the process fails to finish, you will be sent up to a maximum of two email reminders containing the support or help you need to successfully complete the signing up process you previously embarked upon.
Energía XXI Comercializadora de referencia S.L.U. may also process your personal data in order to comply with any legal obligations incumbent thereupon, specifically those obligations related to the regulation of the energy market or commercial regulations, inter alia.
Web Service Management
In addition, your personal data may be processed in order to manage the web user service.
Digital bill
If you activated the “electronic billing service”, your email address will be processed for remittance thereof.
Processing of email address
If you provided your email address, it will be processed as the preferred means for sending any type of communication relating to the contractual relationship.
Retention period for personal data
Customers' personal data will be stored for as long as they are required to provide the services. As soon as it is no longer required for this purpose, the data will be blocked for the period during which they may be needed for use or defence in administrative or judicial procedures and may only be released and reprocessed for this purpose. Once this period has come to an end, the data will be permanently deleted.
3. Recipients of your Personal Data
Your personal data may be transferred to public agencies, authorities and governmental bodies, including courts and tribunals, when required by the applicable legislation.
Your personal data may also be accessed by the service providers that Energía XXI Comercializadora de referencia S.L.U. hires or contracts that have the status of Data Processing Managers. In addition, some of these data processors may be located in the United States or outside the European Economic Area. In particular, your data may be accessed by service providers located in: India, Colombia, Peru and the United States.
Energía XXI Comercializadora de referencia S.L.U. has legal authorization to carry out this type of transfer, since it has been authorized for all such transfers by the Director of the Spanish Data Protection Agency.
Your personal data may also be transmitted to credit institutions with the necessary safeguards and for the sole purpose of carrying out factoring operations (partial or total advance credits assigned to financial entities).
4. Legal Basis for Processing and Transferring Personal Data
- The legitimate grounds for the implementation of the intentions included in the previous section as “mandatory procedures” shall be the execution of the contract or application of contractual measures, as well as the fulfilment of any applicable legal obligations, except for that processing which is carried out to assess your financial solvency, the acceptance of clients, or if applicable, the communication of data or credit information systems, whose lawful basis will be Energía XXI Comercializadora de referencia S.L.U.’s legitimate interest. Therefore, the refusal to supply the requested personal data, or the delivery of inaccurate or incomplete data, could result in an inability to provide Kiosk-specific services correctly. The users are responsible for the veracity of the data provided, as well as for notifying Energía XXI Comercializadora de referencia S.L.U. of any modification of the same.
- The legal basis for processing personal data associated with web user management and, where applicable, processing your email to send you the digital invoice is the consent provided by you in each case.
- The legal basis for processing your email address as the preferred means for sending communications relating to the contractual relationship is the implementation of the contract.
5. Security measures
In order to make its data protection policy efficient and effective, Energía XXI Comercializadora de referencia S.L.U. has adopted the technical and organisational security measures necessary to avoid the alteration, loss, misuse, treatment and unauthorised access or theft of said data, taking into account the current state of technology.
6. Rights of the Persons Concerned in Relation to the Processing of their Personal Data
You will be able to exercise your rights of access, rectification, cancellation, limitation of processing and transferability of data in the cases and within the scope established by applicable legislation at any time. To exercise these rights, you may contact Energía XXI Comercializadora de referencia S.L.U. through any of the following channels:
- By sending a written request by post, attaching a photocopy of your national identity document, passport or any other identification document to Apartado Postal 1128, 41080 – Sevilla, Spain, for the attention of: Energía XXI Operations and Commercial Services.
- By sending an email to the address solicitudeslopd.exxi@energiaxxi.com with the following information: your first name and surname, address for the purposes of notifications, a photocopy of your national identity card, passport or other identity document, and your written request.
You are also informed of your right to file a complaint with the Spanish Data Protection Agency.
7. Source of data
The personal data that are subject to processing by Energía XXI Comercializadora de referencia S.L.U. are those provided by you for the provision of energy supply and/or maintenance services. Sometimes these data can be enriched with sources of specific information about the Spanish energy market.
8. Data Protection Officer
If you have any questions regarding the purposes of processing your personal data or its legal basis, you may contact the Data Protection Officer.
Endesa S.A., the parent company of the Endesa Group of which Energía XXI Comercializadora de referencia S.L.U. forms a part, has appointed a Data Protection Officer for this company, who reports to the Data Protection Officer for Spain, with whom he/she will be able to highlight any question concerning the processing of your personal data, and whose contact details are as follows: Postal address: Calle Ribera del Loira, 60. 28042-Madrid, Spain. Email: dpoc.exxi@energiaxxi.com.