Privacy Policy
Global Privacy Policy
This Privacy Policy applies to any processing of personal data carried out by Repsol, S.A. or any company within its corporate group (hereinafter collectively referred to as “Repsol”). This document is hereinafter referred to as the “Policy”. The Policy is intended to apply globally, although it may be supplemented by local provisions governing processing carried out by Repsol Group companies that are established or operate in certain countries.
This Policy is intended to answer any questions you may have about the processing of your personal data. If you require further information, you may contact us at: protecciondedatos@repsol.com
It is important that you read this Policy carefully as it will provide you with the necessary information so that you can make an informed choice when providing us with your personal data.
What definitions do I need to know in order to better understand the Policy?
To help you understand this Policy, we define below certain terms used throughout this document:
- "Activities, Products and/or Services" - refers to invitations to commercial, informative, sports, recreational or recreational events, information on promotions, competitions, raffles and commercial information on sectors such as energy solutions, mobility, automotive aid, insurance, finance, leisure, travel, home, sport, gastronomy, loyalty programmes, payment methods and services, or third-party telecommunications and through different channels
- "Anonymization" - means the use of techniques designed to prevent data from being linked to an identified or identifiable natural person using means reasonably likely to be employed. In determining whether such means are reasonably likely to be used, account shall be taken of objective factors, such as the time and technical resources required, as well as contextual factors that may vary from case to case, including the exceptional nature of the relevant phenomenon, population density, and the nature and volume of the data
- “Disclosure of Personal Data” - means making Personal Data available to a natural or legal person, public authority, agency or other body, whether that recipient is a Third Party
- “Standard Contractual Clauses” - means standard data protection clauses adopted by the European Commission that may provide appropriate safeguards for transfers of personal data to countries located outside the European Economic Area
- “Consent” - means a freely given, specific, informed and unambiguous indication of the data subject’s wishes regarding the processing of personal data
- "Cookies" - small files or devices that are installed in the user's browser for the purpose of storing, retrieving or updating information. Through them, the publisher of a website can try to know the preferences of users when browsing their website and personalize the services offered based on those preferences. You can find more information in Repsol's Cookie Policy here.
- “Personal Data” - means any information relating to an identified or identifiable natural person
- “Data Protection Officer” - means a data protection specialist who informs and advises the Repsol Group and the employees who oversee the processing on their obligations under the GDPR
- “Recipient” - means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether that recipient is a Third Party
- “Profiling” - means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects of a natural person, in particular to analyse or predict aspects relating to the professional performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of that natural person
- "Repsol group companies with commercial activity assignees of Personal Data" - means those companies of the Repsol group included in this list, to which the transfer of customers' personal data is limited
- “Data Processor” - means a natural or legal person, public authority, agency or other body that processes personal data on behalf of and under the instructions of a third party (the Data Controller). In some cases, this role is performed by Repsol, S.A. for its subsidiaries, or by third-party service providers, as a significant part of the matters related to business operations and organisational management are handled through a centralized management model
- "Geolocation" - any data processed in an electronic communications network indicating the geographical position of a Data Subject's terminal equipment of a publicly available electronic communications service
- “Repsol Group” - means a group of companies for the purposes of Article 42 of the Commercial Code. More information is available at www.repsol.info/estructura
- “Data Subject” - means the identified or identifiable natural person to whom the personal data relates
- “Binding Corporate Rules” - means personal data protection policies adhered to by a controller or processor established in the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity
- “Pseudonymisation” - means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures designed to ensure that the personal data are not attributed to an identified or identifiable natural person
- “Repsol” - is the Repsol group company acting as Data Controller for the relevant processing activity
- “Data Controller” - means the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of this Policy, the relevant Repsol group company acts as Data Controller
- “Online Services” - means any online site, environment, website, channel, application or promotion
- "Third Party" - natural or legal person, public authority, service or body other than the Data Subject, the Data Controller, the Data Processor and the persons authorised to process the personal data under the direct authority of the Data Controller and/or the Data Processor
- “International Data Transfers” - means transfers of personal data to a recipient in a third country or to an international organisation, including onward transfers, in accordance with Chapter V of the GDPR
- “Processing” - means any operation or set of operations carried out on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of access, alignment or combination, restriction, erasure or destruction
- “Repsol Single User” - means the user profile created when you register with Repsol’s Single Registry to access the Online Services offered by any Repsol Group company. The information associated with that profile is held in your Single Registry account (“Your Account”)
How will Personal Data be processed?
Your Personal Data will be processed in accordance with the provisions of current privacy regulations. In particular, and without limitation, it includes:
(i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – General Data Protection Regulation – (hereinafter, "GDPR");
(ii) Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, "LOPDGDD");
(iii) any national regulation of any country that governs the processing of personal data;
| Repsol Group companies in Spain that have appointed a Data Protection Officer | Repsol Group companies in Portugal that have appointed a Data Protection Officer | |
| Repsol, S.A. | Repsol Portuguesa, LDA | |
| Bios Avanzados Tratados del Mediterráneo, S.L. | Repsol Gás Portugal, Lda | |
| Campsa Estaciones de Servicio, S.A. | Gespost - Gestão e Administração de Postos de Abastecimento, Unipessoal, Lda | |
| Petróleos del Norte, S.A. | Repsol Directo Lda | |
| Klikin Deals Spain, S.L. | Repsol Polímeros, Lda | |
| Polidux, S.A. | ||
| Regsiti Comercializadora Regulada, SLU | ||
| Relkia distribuidora de electricidad, S.L. | ||
| Repsol Butano, S.A. | ||
| Repsol Comercializadora de Electricidad y Gas, SL | ||
| Repsol Soluciones Energéticas, S.A. | ||
| Repsol Directo, S.A. | ||
| Repsol Electricidad y Gas, SA | ||
| Repsol Exploración, S.A. | ||
| Repsol Generación Eléctrica, SL | ||
| Repsol Investigaciones Petrolíferas, S.A. | ||
| Repsol Lubricantes y Especialidades, S.A. | ||
| Repsol Petróleo, S.A. | ||
| Repsol Materials, S.A. | ||
| Repsol Renovables, S.L | ||
| Repsol Trading, S.A. | ||
| Servicios de Seguridad Mancomunados, S.A. | ||
| Solred, S.A. | ||
| Solgas Distribuidora de Gas, S.L. | ||
| Valdesolar Hive, S.L. |
(iv) or any regulation that modifies, develops or replaces the previous ones.
Who is the Data Controller?
In general, the Repsol Group company with which you have a relationship will be the Data Controller. However, for certain processing activities, another Repsol Group company may act as the Data Controller, as indicated in the relevant privacy notice.
Whenever we collect your Personal Data, we will identify the Repsol Group company acting as Data Controller and provide its contact details.
Is there a Data Protection Officer?
The Data Protection Officer assists and advises the Data Controller on data protection matters and monitors compliance with applicable data protection laws.
To contact the Data Protection Officer of the companies listed above, you may email proteccióndedatos@repsol.com, except in the case of Klikin Deals Spain, whose contact email address is dpd@waylet.es, and the Portuguese companies, whose contact email address is privacidade@repsol.com.
The remaining Repsol Group companies are not required to appoint a Data Protection Officer.
What is Repsol's Single Registry (Your Account)?
Repsol has established a Single Registry system to make it easier for you to access all the Online Services we offer. Through the Single Registry, you may access our Online Services by providing only the information that you have not previously supplied and that is required for the relevant service. This means that, when registering for a new Online Service, you will not need to provide your Personal Data again, except for any information that we do not already hold and that is necessary to provide or improve the service.
Remember that Your Account is unique for all Repsol Online Services, which implies that Repsol, S.A., the owner of this processing, is aware of all the Online Services in which you have registered.
What personal data is subject to processing and where does it come from?
The Data Controller will access and process the data provided directly by the Data Subject through the Single Registry, generated throughout the relationship with Repsol Group companies or provided by third parties, if there is a valid lawful basis for such disclosure. This data may fall within one of the following categories:
|
Data collected directly from the Data Subject |
Data generated during the relationship with Repsol Group companies or provided by third parties |
|
Identification and contact details full name, national identity or foreign national identity number (DNI/NIE), address, telephone number, email address, signature, image and voice |
Commercial information risk level and likelihood of payment default |
|
Personal characteristics age, sex, nationality, marital status, profession. |
Transaction data for goods and services goods and services purchased or received, and promotions organised by the Data Controller in which the Data Subject participates |
|
Social circumstances property ownership or possession, licences, qualifications, permits and other rights held by the Data Subject |
Location data location at a specific point in time
|
|
Economic, financial and insurance data |
Browsing data IP address, information derived from cookies or similar technologies, and information associated with social media profiles where they are used to interact with us |
|
Special categories of personal data |
Geolocation data |
|
Third-party data |
Solvency data information obtained from credit information systems regarding payment defaults with other entities, including the instalment amount, age of the debt and the sector of the reporting entity |
|
|
Data from other companies in the Repsol group contracts or other relationships with Repsol Group companies, and transactions carried out under those relationships |
For what purposes are personal data processed and on what lawful bases?
When personal data are collected, the Data Controller will inform the Data Subject of the purposes of the processing, the applicable lawful bases and the rights available to them. The general purposes for which the Data Controller may process personal data are described below, together with the lawful basis applicable to each purpose:
Certain processing activities are necessary to enter, perform and manage the contractual relationship. Without processing your Personal Data for these purposes, Repsol would be unable to enter or perform that relationship.
|
Purpose |
|
Management of the contractual relationship Enter into, manage and maintain the contractual relationship; arrange signatures, including through electronic signature platforms, and issue electronic signature certificates; perform and manage contracted transactions; communicate with customers; issue invoices; manage payments, collections and outstanding debts; provide customer service, including the recording of telephone calls where applicable; send non-marketing information relating to the contract; and manage complaints, requests, suggestions and incidents |
|
Management of the Single Registry For Online Services, we process your data to create and manage your access credentials and Your Account, and to provide the Online Services for which you register. Your Account is common to all Repsol Online Services. Repsol, S.A., as Data Controller for this processing, therefore knows which Online Services you have registered for An Online Service is any electronic service available to customers and users of the Repsol Group that requires access to credentials (including services accessible through websites, mobile applications or similar channels that require registration). |
|
Verification of the group to which you belong If you belong to a group that may be eligible for specific conditions or benefits, we will request this information to verify your membership and apply the corresponding benefits. |
|
Customer service and support in digital channels Respond to enquiries, requests and incidents relating to products, services, accounts or features contracted for or used by customers, including through virtual assistants or automated tools where necessary to provide the service |
Certain processing activities are necessary for the Data Controller to comply with its legal obligations. These obligations arise under various national and international laws. Failure to carry out these processing activities could result in the Data Controller failing to comply with its legal obligations.
|
Purpose |
|
Compliance with accounting, legal, tax and administrative obligations Comply with the Data Controller’s legal obligations, including responding to requests to exercise data protection rights |
These processing activities are necessary for the performance of a task carried out in the public interest, in accordance with Union or Member State law. In particular, they include processing activities aimed at ensuring security, safeguarding individuals and assets, and preventing, detecting and investigating unlawful acts.
|
Purpose |
Legal basis |
|
Video surveillance and security Capture images through security cameras for security purposes of the premises and other security actions (smoke detection) |
Public interest provided for in the LOPDGDD. |
|
Internal investigations Manage reports and conduct internal investigations into possible breaches by the Data Subject of internal rules or the Code of Ethics and Conduct, including managing the case file and consulting the departments whose involvement is necessary |
Public interest provided for in the LOPDGDD. |
Certain processing activities are necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party. For these activities, the Data Controller has carried out a balancing test, assessed their impact on the Data Subject’s privacy and concluded that the processing is necessary and proportionate for the purposes pursued and that those interests are not overridden by the Data Subjects’ rights and freedoms. The Data Subject may object to these processing activities at any time and request information about the balancing test carried out by the Data Controller.
|
Purpose |
Lawful basis |
|
Conducting surveys Assess the quality of communications, Data Controller procedures, customer service and Repsol Group products and services |
Legitimate interest of the Data Controller. This processing arises from the Data Controller's interest in improving user service procedures and updating the catalog of products and services, understanding the way in which the user interacts with the Repsol Group, as well as detecting their degree of satisfaction. |
|
Historical archive Maintain a historical archive of the Data Controller’s activities |
Legitimate interest of the Data Controller in keeping an archive of its activities in view of possible liabilities or as historical memory |
|
Anonymization/pseudonymization processes for statistical purposes Apply anonymisation or pseudonymisation techniques to data so that they can be analysed for statistical purposes and used to draw conclusions about behaviour |
Legitimate interest of the Data Controller in carrying out internal analyses and preparing studies for statistical purposes that allow the Repsol group to adapt its activity, products and services to user demands. |
|
Processing data relating to representatives and contact people Identify individuals who represent a corporate customer or act as their contact person for contracting purposes. This processing applies only where the customer is a legal entity |
Legitimate interest of the Data Controller in accordance with Article 19 of the LOPDGDD. |
|
Third-party due diligence process Carry out the due diligence procedures implemented by the Repsol Group in its relationships with third parties |
Legitimate interest of the Data Controller in avoiding fraudulent actions and risks in contracting |
|
Consultation of and reporting to credit information systems To the extent necessary to assess the user's financial solvency and carry out credit risk assessments (prior to and during the contract), the Data Controller may consult and process the information obtained from common solvency files. The Data Controller may process, where appropriate, data obtained from different reporting entities regarding their financial solvency. Based on these consultations, they may make profiles of their credit capacity. The Data Controller will always grant the user the possibility of alleging everything they deem relevant to defend their right or interest. In the same way and subject to current regulations, the user is informed that non-compliance with the monetary obligations assumed by virtue of this contract may lead to the inclusion of their personal data in a file relating to the fulfilment or non-fulfilment of monetary obligations |
Legitimate interest of the Data Controller in accordance with Article 20 of the LOPDGDD. Without being able to carry out these profiles, the Data Controller will not be able to assess the user's credit capacity and avoid fraudulent conduct that affects the fulfilment of the contract |
|
Creation of profiles for the management of the conditions of the contract and the offer applicable to the customer based on their consumption To create simple profiles of the customer based on the consumption made to send them offers of products and services and conditions more adapted to their profile |
Legitimate interest of the Data Controller in improving the strategy and commercial offer of the products and services offered by the Repsol group. This profiling is carried out based on the analysis and association in aggregate form of the information obtained through the media or our different points of sale, our own knowledge of the market and its evolution, as well as the sales process of the Repsol group's products or services. This information is only obtained from the Data Controller and not from other entities of the Repsol Group |
|
Marketing communications about Repsol Group products and/or services To send commercial information on products and services of Repsol group companies with commercial activity that are assignees of Personal Data given their status as a multi-energy group, as they are like those contracted by the customer |
Legitimate interest of the Data Controller in maintaining the relationship with the customer by registering new products, improving the conditions of the products and/or services that have been contracted and offering information on similar products and/or services that may be of interest to the customer, which allows the Data Controller to continue with its economic activity and grow within its sector. When we contact you via e-mail, SMS or similar electronic means, we rely on the exception provided for in Article 21.2 of Law 34/2002 ("LSSI") |
|
Fraud management and control File complaints and take legal action in cases of non-payment or drive-offs from service stations |
Legitimate interest of the Data Controller in preventing fraudulent acts at our service stations. |
|
Measuring campaigns with pseudonymized data Evaluate the performance of campaigns, using user-provided data (e.g., email, phone) transformed using pseudonymisation (hashing) techniques before transmission to providers such as Google. This processing is carried out solely for aggregate measurement purposes, without individual identification or profiling. |
The Data Controller’s legitimate interest in evaluating and optimising campaign performance using pseudonymised data and aggregate analysis without identifying users |
|
Customer support through an AI-powered virtual assistant Respond to enquiries and improve service quality, efficiency and customer experience through an AI-powered virtual assistant available across various Repsol channels and applications, including the customer area and Waylet. |
The Data Controller’s legitimate interest in improving the quality, efficiency and availability of its customer service channels |
|
Security and prevention of fraudulent or abusive uses of digital assets Protect our forms, online services and digital assets against automated access, spam, fraud, abusive use or security incidents, through technical mechanisms for verification and analysis of browsing behaviour. |
Legitimate interest of the Controller in preventing automated access, spam, fraud and abusive use of its online services. |
We may also process Personal Data for other purposes that require the Data Subject’s Consent. The Data Subject may withdraw their Consent at any time, as explained in the section What rights does the Data Subject have?
|
Purpose |
Data subject to processing |
|
Disclosure of personal data to Repsol Group companies engaged in commercial activities To disclose the Data Subject’s personal data to Repsol group companies engaged in commercial activities that are authorised recipients of such personal data, so that they may combine this information with other online or offline data relating to the Data Subject that they may already hold, for the purpose of enriching the Data Subject’s profile and, where they have a valid legal basis to do so, sending advertising and marketing communications, by any means including electronic means, relating to Activities, Products and/or Services. |
Identification and contact details. Commercial information data. Transaction data for goods and services. Location and/or geolocation data, respecting, in all cases, current regulations. |
|
Marketing communications about third-party products and/or services To send commercial information, by any means, including electronic, about the activities, products and services of third parties. |
Identification and contact details
|
|
Competitions, prize draws, promotions and events Manage the relevant activity from registration through to completion |
Data is provided in the forms that the Data Controller provides for this purpose. |
|
Management of visits and events at our facilities To manage visits from educational centres and organisations that wish to attend our facilities. |
Identification and contact details. Image. |
|
Management and archiving of social media data Process information that you share with us through your social media profile and retain a record of those interactions |
Your profile details Information you share with us to fulfil the requested purpose For more information, see the section "How does Repsol treat your social media profiles? |
|
Recording calls received by the Data Controller through the toll-free customer service number Record customer service calls for quality assurance purposes after informing callers that the call may be recorded and obtaining their Consent through their decision to continue the call |
Identification and contact details. Voice. |
|
Customer identification using voice biometrics during customer service calls To verify your identity using biometric voice-recognition technology, without requiring you to answer security questions. |
Voice. Biometric voice data. |
|
Measurement, analysis and personalisation of content and online advertising Measure and analyse the use of our digital assets, evaluate the performance of our campaigns, gain an aggregate understanding of user interaction with our content and improve the browsing experience, including, where the user has consented, advanced measurements that may take into account use from different devices, as well as aggregated information on interests, behaviour and campaign performance. These purposes may be supported by analytics technologies, advertising measurement, tag management and web interaction analysis. In the context of digital advertising, certain technology providers may process online identifiers and technical information, including IP addresses for advertising measurement, advertising personalization and device identification purposes, in accordance with the user's consent preferences. |
Online identifiers. Interactions and websites visited. Technical information of the device. Aggregated data on interests and behaviour. Location data, respecting, in any case, the regulations in force. |
Such Processing is necessary when it is necessary to protect an interest essential to the life of the Data Subject. In particular, it is Processing that may respond both to important reasons of public interest and to the vital interests of the Data Subject, such as when the Processing is necessary for humanitarian purposes, including the control of epidemics and their spread, or in situations of humanitarian emergency, especially in the event of natural or man-made disasters.
|
Purpose |
|
Essential Supplies To maintain an essential supply even in the event of non-payment, the Data Controller may request special categories of personal data where necessary to demonstrate a medical need for uninterrupted supply, for example where oxygen equipment or similar medical devices must remain operational |
In addition, throughout the relationship with the Data Subject, the Data Controller may request the Data Subject's consent for new processing and purposes, which will be informed in each case.
Who will we share personal data with?
As a rule, the Data Controller will not disclose Data Subjects’ Personal Data except in the following circumstances:
i. to competent authorities and agencies, courts, tribunals or any other third party entitled to in accordance with the applicable regulations;
ii. to third party owners of common files for the fulfilment of monetary obligations, when the client incurs in non-payment, and the legitimating requirements established in Article 20 of the LOPDGDD are met;
iii. to third-party owners of services or products that the user voluntarily requests (e.g., when the user wants to benefit from an offer from another company of the Repsol group or a partner or to request financing);
iv. to certain companies of the Repsol group for Profiling, and/or sending commercial communications, provided that the Data Subject has consented to this or there is a legitimate interest as described in the section. As indicated, such profiling is carried out based on the analysis and association in aggregate form of the information obtained through our own means or through our points of sale, our own knowledge of the market and its evolution, as well as the sales process of products or services of the Repsol group.
The Data Subject can consult the companies of the Repsol group to which we will transfer the data for the Creation of Profiling and commercial offer in Companies of the Repsol group Assignees of Personal Data.
Likewise, it is also possible that third-party providers may have access to the Data Subject's personal data to provide services to the Data Controller, related to the purposes about which they are being informed (including but not limited to, companies operating in the following sectors: technology, legal advice, marketing, multidisciplinary professional services, IT services, etc.). These providers will only access Personal Data to carry out their services in the name and on behalf of the Data Controller, under an obligation of confidentiality and always following its instructions and without at any time being able to use said data for their own purposes and/or unauthorised purposes.
Finally, and during an internal investigation, the data may be communicated to the Ethics and Conduct Committee of the Repsol Group.
Will the data be transferred internationally?
Personal Data may be transferred to recipients outside the European Economic Area in connection with the Data Controller’s use of service providers, particularly providers of technology support services, or with transfers within the Repsol Group for the purposes described in this Policy. Any International Data Transfer will be carried out in accordance with Chapter V of the GDPR and subject to the safeguards described below.
Your Personal Data will not be transferred outside the European Economic Area unless the destination country benefits from an adequacy decision adopted by the European Commission or another valid transfer mechanism is used and the required safeguards are in place.
An adequacy decision is a determination by the European Commission that a country outside the European Union provides an adequate level of data protection equivalent to that afforded under European data protection law. As a result, Personal Data may be transferred to a recipient established in that country without Repsol, as data exporter, being required to implement additional safeguards or comply with further transfer conditions.
In other words, transfers of Personal Data to a country benefiting from an adequacy decision are treated in a manner comparable to transfers carried out within the European Union.
In the absence of an adequacy decision, a transfer may take place where appropriate safeguards are provided, and enforceable Data Subject rights and effective legal remedies are available. Such safeguards include, among others:
- Binding Corporate Rules (“BCRs”) approved in accordance with the GDPR for transfers within a group of undertakings or group of enterprises engaged in a joint economic activity.
- Standard Contractual Clauses (“SCCs”) adopted by the European Commission and entered between the relevant data exporter and data importer, together with any supplementary measures required by applicable data protection law.
- Adherence to a code of conduct or a certification mechanism together with binding and enforceable commitments made by the recipient in relation to the implementation of appropriate safeguards for the protection of the transferred data.
- In the absence of an adequacy decision or the appropriate safeguards detailed above, your Personal Data may exceptionally be transferred to a third country or international organisation under any mechanism recognised for this purpose by applicable law.
In order of preference, Repsol will carry out International Data Transfers under the following safeguards:
|
Transfer mechanism |
Criteria used by Repsol |
|
Adequacy decision adopted by the European Commission |
Repsol’s preferred transfer mechanism. The list of countries covered by an adequacy decision is available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en |
|
Binding Corporate Rules | In the absence of an adequacy decision, Repsol will give preference to Binding Corporate Rules where the data importer has adopted them. The list of entities with approved BCRs is available at https://edpb.europa.eu/our-work-tools/accountability-tools/bcr_en?page=1 |
|
Standard Contractual Clauses |
Where none of the above mechanisms applies, Repsol will enter the applicable Standard Contractual Clauses adopted by the European Commission and, where relevant, implement supplementary measures. Where the clauses have already been entered into by the data importer, Repsol may request and review a copy of the executed clauses. |
How long will the Data Controller process personal data?
As a rule, the Data Controller will process the Data Subject’s Personal Data while the commercial and/or contractual relationship remains in force. When collecting your Personal Data, we will inform you of the applicable retention period or the criteria used to determine it, including any period established by law, such as those relating to video surveillance activities or internal reports.
Once the applicable retention period has expired, the Personal Data will remain blocked for the duration of any applicable criminal, civil, commercial or administrative limitation periods.
What rights does the Data Subject have?
You may exercise the following rights in relation to the processing of your Personal Data at any time. These rights are personal to each Data Subject and may be exercised as described below:
|
Right of access The right to obtain confirmation as to whether the Data Controller processes personal data concerning the Data Subject and, where it does, to access those data in accordance with Article 15 of the GDPR |
|
Right to rectification The right to have inaccurate personal data rectified and incomplete personal data completed in accordance with Article 16 of the GDPR |
|
Right to object The Data Subject may withdraw Consent at any time and may object to processing based on legitimate interest, including processing for direct marketing purposes, in accordance with Articles 7(3) and 21(2) of the GDPR. Where processing is based on legitimate interest, the Data Subject may request information about the balancing test carried out by the Data Controller. Where processing is intended to send marketing communications from the Data Controller or third parties, the Data Subject may also choose to register, free of charge, with an advertising preference service (further information is available here: https://www.listarobinson.es/). |
|
Right to erasure The right to request the erasure of all or part of the Data Subject’s Personal Data in accordance with Article 17 of the GDPR Remember that while the commercial and/or contractual relationship we have with you continues to be in force, there is a series of Personal Data that it is necessary for us to process in order to comply with the contract, so while it lasts, we will not be able to delete, block or cancel them, because otherwise we would prevent them from complying with the contract. |
|
Right to restriction of processing The right to obtain restriction of the processing of Personal Data where one of the conditions set out in Article 18 of the GDPR applies |
|
Right to portability of personal data The right to receive personal data provided to the Data Controller in a structured, commonly used and machine-readable format and to transmit those data to another controller, or have them transmitted directly where technically feasible, in accordance with Article 20 of the GDPR |
|
Right to withdraw Consent at any time, without affecting the lawfulness of processing based on Consent before its withdrawal, in accordance with Article 7(3) of the GDPR |
|
Right not to be subject to a decision based solely on automated processing The Data Controller informs the Data Subject that, without prejudice to the fact that it carries out decisions that are based on automated systems, these decisions (i) either do not produce legal effects or significant effects on the Data Subject; (ii) or are not adopted exclusively in an automated manner. |
These rights may be exercised by sending a communication to the address of the Data Controller or by sending a request to the following email address: rgpd.crc@repsol.com, where you can obtain additional information on the processing of your personal data.
In the event that you consider that we have processed your Personal Data inappropriately not in accordance with the regulations on the processing of personal data or you are not satisfied with how we have dealt with the exercise of your rights, you can contact, if the Data Controller has it, its respective Data Protection Officer, or failing that, to: rgpd.crc@repsol.com. Likewise, a complaint may be lodged at any time with the corresponding Supervisory Authority (in the case of Spain, the Spanish Data Protection Agency).
What is our policy regarding personal data of minors?
In most cases, the Data Controller processes only the Personal Data of individuals aged 18 or over. In specific circumstances, particularly in connection with promotional activities, the Data Controller may process minors’ Personal Data. In such cases, Consent and authorisation will be requested from the parents or legal guardians if the minor is under 14 years of age. If you are a minor and do not fully understand any part of this Policy, please ask your parent or legal guardian for assistance.
Regarding the use of social networks, we recommend that parents or guardians regularly check and monitor their children’s internet activity. Please ensure that your children do not provide us with Personal Data without first asking for your authorisation and Consent.
At any time, you can exercise the rights of minors under 14 years of age in your care by proving your legitimacy.
What happens if you provide us with data from Third Parties?
If, in the course of your relationship with us, you provide Personal Data relating to Third Parties, you are responsible for ensuring that you are authorised to disclose their Personal Data to the Data Controller for the purpose communicated to you in each case and for informing them of the contents of this Policy.
You agree to indemnify and hold harmless all companies in the Repsol group from any liability arising from the lack of information and/or consent to the Third Party.
What happens to my personal data when I forward/share some content from an Online Service with another person?
Some of our Online Services may give you the option of forwarding/sharing some content with another person, although you should be aware that you will be the one who performs this action through your own means. Repsol does not send or use any information or data from those Third-Party recipients to whom you want to forward or share any information.
How can you close/delete Your Account in Repsol's Single Registry and/or in an Online Service?
You can close/delete Your Account by requesting it via email sacportal@repsol.com.
Please note that, if you cancel Your Account, you will cease to be a Repsol Unique User, so you will no longer be able to access all the Online Services in which you have registered. Remember that to use any of the Online Services, you must have previously registered an account as a Repsol Unique User.
You may unsubscribe from any Online Service by following the instructions provided to you in each case and/or specified in the relevant terms and conditions. If you unsubscribe from a particular Online Service, you will simply cease to be able to access that service in accordance with the terms and conditions of that Online Service. Your Account will remain valid for as long as there is an active Online Service.
What happens when I decide to create my Repsol Account through my social media accounts with Social Login?
In certain cases, when you decide to create Your Repsol Account, you will be able to do so without having to fill in all the fields of the registration form through the so-called "Social Login" using your registration on social networks, simply by clicking on the corresponding logo, which means that you will allow the social network to provide your Personal Data linked to your profile (your name, surname, profile picture, email) to Repsol to create Your Repsol Account. In other words, during the registration process you will be redirected to a federated authentication service that checks the credentials and, if they are correct, returns the information to the requested service, in this case, the Your Repsol Account space. You can find more information about how the different federated identity systems work at the following links:
This Personal Data will be processed together with the data generated from the use of Your Repsol Account for the purposes provided by Repsol when registering for our Online Services. In any case, the social network allows you to select your privacy preferences to prevent certain exchanges of personal data. We recommend that, for more information, you consult the privacy policy of each social network using the links above.
How do we process your data on social networks?
We recommend that you avoid including Personal Data – yours or those of Third Parties – when you interact with us on social networks. However, if you nevertheless decide to include personal information, you should know that your Personal Data will be processed by us in accordance with this Policy.
Specifically, the data you provide us through any social network will be processed by Repsol, S.A., with registered office at Madrid Calle Méndez Álvaro 44, 28045, for the purpose of relating to us and interacting with you on the different social networks so that you can get to know us better, as well as our activities or values. This channel is not ideal for you to make complaints or suggestions, however, in the event that you send us through social networks any type of request, claim, suggestion or complaint related to another of the companies of the Repsol Group, we will proceed to request your Consent to transfer your minimum Personal Data so that they can attend to you and process your request properly in our customer services.
The lawful basis for this Processing is the Consent you give through the authorisation message provided via the interaction tools available on the social network. The Processing will be limited in scope and duration to what is necessary to respond to you. When you interact with us through social networks, the terms of use established by the owner of the social network are beyond our control and are therefore not covered by this Policy. We recommend that you ensure that you understand and accept the relevant legal terms and privacy rules before continuing to use the social network or providing any personal information.
In this regard, remember that this Policy does not apply to Processing that may be carried out from Third-Party websites to which you may have access through a web link from our environment.
Can we change the terms of the Policy?
We may amend this Policy at any time, but we will notify you of any material changes. Whenever we make minor changes to our Privacy Policy, we will update it and include a new effective date in the document. Our processing of your Personal Data will be governed by the new version of the Privacy Policy from its effective date. We encourage you to review the Policy periodically.
What are your responsibilities?
You are responsible for each of the Personal Data you provide to us, as well as for its veracity, accuracy, updating, validity and authenticity, including your consent for it to be used and/or processed. Likewise, you are responsible for the data of Third Parties that you provide us with and for which you are obliged to obtain their Consent once you have sent them the privacy information provided in that specific case by Repsol, given that we do not have direct contact with said third party. And do not forget that you are responsible for periodically consulting this Policy and its updates.
Last update: 30/09/2026
Updated as of September 2026