POLESTAR ENERGY S.L., holder of the web page www.polestarenergy.esinforms users of the portal that is responsible for the processing of personal data collected through the same, unless otherwise indicated in a specific treatment.

     

    POLESTAR ENERGY S.L. respects the current legislation on the protection of personal data, the privacy of users and the secrecy and security of personal data, in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and with the applicable Spanish legislation on data protection. Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights.

     

    To ensure the security of the information, the necessary technical and organizational measures have been implemented to prevent the loss, misuse, alteration, unauthorized access and theft of the personal data provided, taking into account the state of technology, the nature of the data and the risks to which they are exposed.

     

    The personal data collected will be processed only when they are adequate, relevant and not excessive in relation to the specific, explicit and legitimate purposes for which they were collected.

     

     

    Information on the processing of personal data

     

    When personal data is collected through the portal, the user will be previously informed of the following aspects:

     

    The identity of the data controller is POLESTAR ENERGY S.L., with CIF B56614068, address at C/Alcalá 87 3º IZQ and contact email administracion@romaenergygroup.com. In the event that the company has a Data Protection Delegate, it will also be informed about their contact details for any questions related to privacy.

     

    Personal data will be processed for various purposes, including the management of inquiries and requests for information received through the portal, the execution of contractual relationships with customers and suppliers, the sending of commercial communications about products or services, the management of personnel selection processes and the fulfillment of legal, tax and accounting obligations.

     

    Data processing will be based on different legal bases depending on the purpose. In some cases, the user consentas occurs in the sending of commercial communications. In others, it will be done in compliance with a contractwhen the data is necessary for the provision of a service or the purchase of products. Also, some processing will be based on the compliance with legal obligations or in the legitimate interestespecially in the case of B2B business contacts, where professionals of companies in the sector may be contacted on the basis of an existing professional relationship or a justified business interest.

     

    Personal data may be communicated to third parties when necessary for the fulfillment of legal obligations. In this sense, the data may be shared with public bodies, tax administrations, banks for the management of payments and logistics companies in case of purchases. No transfers to third parties will be made without the prior consent of the user, except in cases where there is a legal obligation that requires it.

     

    As regards international data transfers, in principle, the transfer of data to countries outside the European Economic Area (EEA) is not foreseen. However, should it be necessary, it will be ensured that such transfers are carried out with appropriate mechanisms, such as standard contractual clauses approved by the European Commission, thus ensuring an adequate level of protection.

     

    Personal data will be kept for the time necessary to fulfill the purpose for which they were collected and as long as legal liabilities may arise from the processing. In general, contact data used for commercial communications will be kept until the user withdraws his consent or exercises his right to object. Customer and supplier data will be kept for as long as the contractual relationship is in force and for the additional years established by tax and accounting regulations.

     

    Data related to personnel selection processes will be stored for a maximum period of one year, and data with legal or tax implications will be retained in accordance with the periods required by current legislation.

    2. Principles applicable to the processing of personal data

     

    POLESTAR ENERGY S.L. guarantees that the processing of personal data will be carried out in accordance with the following principles set out in Article 5 of the GDPR and Article 4 and following of the Organic Law 3/2018, on the Protection of Personal Data and guarantee of digital rights:

     

    • Principle of legality, loyalty and transparency: It shall be ensured at all times that the user receives clear and transparent information about the purpose of the processing of their personal data and that they give their consent in an informed manner.
    • Principle of purpose limitation: Personal data will be collected only for specified, explicit and legitimate purposes.
    • Principle of data minimization: Only data strictly necessary in relation to the purposes for which they are processed will be collected.
    • Principle of accuracy: Necessary measures will be taken to ensure that personal data is accurate and up to date.
    • Principle of limitation of the storage period: Personal data will be kept only for the time necessary to fulfill the purpose for which they were collected.
    • Principle of integrity and confidentiality: Appropriate security measures shall be implemented to protect personal data against unauthorized access, loss or alteration.
    • Principle of proactive responsibility: POLESTAR ENERGY S.L. undertakes to ensure compliance with these principles and to take the necessary measures to protect the privacy of personal data processed.

    3. User’s rights

     

    The user has the right to access their personal data and to obtain confirmation as to whether POLESTAR ENERGY S.L. is processing such data. You may also request the rectification of those that are inaccurate or incomplete and request their deletion when they are no longer necessary for the purposes for which they were collected or when the treatment is unlawful.

     

    In addition, the user has the right to request the limitation of the processing of his/her data when he/she contests its accuracy, when the processing is not necessary but he/she wishes it to be kept for the formulation or defense of claims, or when he/she has objected to the processing and it is being verified whether the legitimate reasons of the data controller prevail over those of the user.

     

    You may also object to the processing of your data when this is based on the legitimate interest of the controller, especially with regard to sending commercial communications. In these cases, POLESTAR ENERGY S.L. will stop processing the data, except for compelling legitimate reasons or for the exercise or defense of possible claims.

     

    The user has the right to data portability when the processing is carried out by automated means and is based on consent or the performance of a contract. In these cases, you may receive your data in a structured, commonly used and machine-readable format and request its transmission to another data controller.

     

    If the processing is based on the user’s consent, the user has the right to withdraw it at any time without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

     

    In the event that the user considers that his rights have not been respected, he has the right to file a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory body in Spain. For more information on how to file a complaint, you can visit the AEPD website at www.aepd.es.

     

    To exercise any of these rights, the user must send a written request to POLESTAR ENERGY S.L., with the reference “RGPD-[…]”, including:

     

    • Name, surname and copy of the applicant’s ID card.
    • In case of representation, identification of the representative and proof of representation.
    • Specific request with the reasons for the request.
    • Address for notification purposes.
    • Date and signature of the applicant.
    • Documents supporting the application if necessary.

    4. Exercise of rights

     

    To exercise their rights, the user can send a written request addressed to POLESTAR ENERGY S.L., with reference “Data Protection”, to the following e-mail address juridico@romaenergygroup.com or by post to the following address C/Alcalá 87 3ºIZQ. In the request, the user must specify the right he/she wishes to exercise and provide a copy of his/her identity document or an equivalent means to verify his/her identity.

    5. Data security

    POLESTAR ENERGY S.L. has implemented appropriate technical and organizational measures to ensure the security of personal data and prevent unauthorized access, loss, alteration or improper processing. However, due to the nature of the Internet, it is not possible to guarantee its absolute impregnability or the total absence of risks related to fraudulent access to personal data.

     

    In the event that a security breach is detected that may involve a high risk to the rights and freedoms of natural persons, POLESTAR ENERGY S.L. undertakes to inform the user without undue delay, following the provisions of Article 4 of the GDPR. This communication will be made when the security breach may cause the destruction, loss, alteration or unauthorized access to personal data transmitted, stored or processed in any way.

     

    Personal data will be treated with the utmost confidentiality by the Data Controller, who will ensure, through legal or contractual obligations, that such confidentiality is respected by its employees, associates and any person having access to this information.

     

    6. Processing of children’s data

     

    Respecting the provisions of Articles 8 of the RGPD and 7 of the Organic Law 3/2018of December 5, Protection of Personal Data and guarantee of digital rights, personal data of minors will only be processed when consent has been granted by the holder of parental authority or guardianship. POLESTAR ENERGY S.L. does not deliberately collect data from minors without proper authorization and, if it detects that it has received data without the corresponding consent, it will proceed to its immediate elimination.

     

    7. Use of cookies and tracking technologies

    This site uses cookies and tracking technologies to enhance the user experience and deliver personalized content. For more information on the use of cookies, please see our Cookie Policy available at https://polestarenergy.es/politica-de-cookies/.

     

    8. Privacy Policy Update

     

    POLESTAR ENERGY S.L. reserves the right to modify this privacy policy to adapt it to regulatory changes or changes in the operation of the company. In the event that significant changes are made to the policy, users will be informed through the usual channels of communication. You are encouraged to periodically review this policy to stay informed about how we protect your personal information.

     

    It is necessary for the user to read and accept the conditions set out in this Privacy and Cookies Policy so that POLESTAR ENERGY S.L. can proceed to the processing of your personal data in accordance with the provisions, during the periods and for the purposes indicated. The use of the website implies acceptance of this Privacy Policy and Cookies.

     

    POLESTAR ENERGY S.L. reserves the right to modify its Privacy and Cookies Policy at any time, either by its own decision or due to legislative, jurisprudential or doctrinal changes issued by the Spanish Data Protection Agency. In case of modifications, the changes will be explicitly notified to the user.

    This Privacy and Cookie Policy was last updated on March 20, 2025in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)., and the Organic Law 3/2018 of December 5, 2018, on the Protection of Personal Data and guarantee of digital rights.