This privacy policy applies to the processing of personal data by COMPAÑÍA LUMISA ENERGÍAS S.L. (hereinafter referred to as LUMISA ENERGÍAS) on its website and any other digital platform or electronic medium where personal data is processed. This policy also applies to any processing of social media user data carried out by LUMISA ENERGÍAS.
1. Data Controller
The data controller responsible for the processing of personal data is LUMISA ENERGÍAS, located at C/ de Ausias March, 67, 08010 Barcelona, Spain. For any inquiries regarding the processing of your personal data, you may contact us by email at [email protected] or by calling 900 811 473.
LUMISA ENERGÍAS has appointed a Data Protection Officer (DPO). If you have any questions regarding the processing of your personal data, you may contact the DPO at the email address above.
2. Purposes of Data Processing
LUMISA ENERGÍAS processes personal data for the following purposes:
| Purpose | Description |
|---|---|
| Commercial relationship management | Managing contractual relationships with customers and suppliers, including customer service, billing, and after-sales services. |
| Provision of electricity supply service | Consumption monitoring, issue detection, and management of non-payments. |
| Creditworthiness checks | Consulting credit information systems (ASNEF, Experian, Equifax). |
| Debt collection management | Communicating data to creditworthiness files in the event of non-payment. |
| Legal obligations compliance | Fulfilling legal, tax, and accounting obligations. |
| Commercial communications | Sending information about our products and services via electronic means, provided that consent has been given. You may revoke your consent at any time. |
3. Types of Data Collected
Depending on the service you use, we may collect the following types of personal data:
- Contact details: name, email address, postal address, and phone number.
- Financial data: payment information such as bank account numbers or credit card data (only for billing purposes).
- Usage data: information about how you interact with our services, such as IP address, browser information, visited pages, etc.
4. Legal Basis for Data Processing
Your personal data is processed on the following legal grounds:
| Legal Basis | Description |
|---|---|
| Performance of a contract | Processing is necessary for the performance of a contract in which you are a party. |
| Compliance with legal obligations | In some cases, we process your data to comply with applicable laws and regulations. |
| Legitimate interest | Processing is necessary for our legitimate interests, such as improving our services or fraud prevention. |
| Consent | Where required, we will request your consent, for example, to send marketing communications. |
5. Recipients of Personal Data
In the course of our activities and to properly deliver our services, LUMISA ENERGÍAS may share your personal data with the following entities, always in compliance with applicable regulations:
- Public administrations and regulatory authorities: such as the Spanish Tax Agency or the National Commission for Markets and Competition (CNMC).
- Energy distribution companies: for managing network access, billing, and energy supply maintenance.
- Financial institutions: for managing payments and direct debits.
- Fraud prevention entities and credit files: in the event of non-payment, we may communicate your data to relevant databases.
- Service providers and partners of LUMISA ENERGÍAS: third parties who provide services on our behalf.
LUMISA ENERGÍAS does not carry out international data transfers outside the European Union or the European Economic Area.
6. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Inquiry or request data: retained as long as necessary to respond.
- Marketing communications: retained for 2 years from the last communication.
- Job applications: retained for 2 years from the date of application.
- Contracted services: retained during the provision of the service and for 5 years after the end of the contractual relationship.
7. Rights of Data Subjects
As a data subject, you have the following rights:
- Access: Request information about the data we hold about you.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion of your data when it is no longer necessary.
- Objection: Object to the processing of your data in certain circumstances.
- Restriction: Request restriction of processing in specific situations.
- Portability: Receive your data in a structured, commonly used, machine-readable format and transmit it to another data controller.
To exercise your rights, you can send a written request to LUMISA, C/ de Ausias March, 67, 08010 Barcelona, Spain, or by email to [email protected], attaching a copy of your ID. You may also use the following form: Data Subject Rights Request.
If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD) at C/ Jorge Juan, 6, 28001 Madrid or online at www.aepd.es.
8. Data Security
LUMISA ENERGÍAS implements appropriate technical and organizational measures to protect personal data against destruction, loss, alteration, unauthorized disclosure, or access.
9. International Data Transfers
If at any time we need to transfer your data outside the European Union, we will ensure such transfers are made under conditions that guarantee adequate protection, in accordance with applicable laws.
10. Use of Cookies
LUMISA ENERGÍAS uses cookies and similar technologies to enhance the user experience on its website. Cookies help personalize services and remember your preferences. For more information, please consult our Cookies Policy.
11. Changes to the Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices. Any significant changes will be communicated via our website or by email.
Last updated: March 2025
