Through this Privacy Policy, the Enagás Group (hereinafter, the "Enagás Group" or "the Company") wishes to inform you of how we collect and process your personal data through the Company's Whistleblowing Channel (hereinafter, the "Whistleblowing Channel" or the “Channel”). In this way, we comply with the principle of transparency declared by the current regulations on the protection of personal data.
We inform you that your data will be processed in accordance with Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights (hereinafter, LOPDGDD), and with Regulation (EU) 2016 /679, of the European Parliament and of the Council, of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and the free circulation of these data (hereinafter, GDPR).
Data Controller
Enagás, SA (hereinafter, “Enagás”) assumes the management of the Whistleblowing Channel for the entire Enagás Group and, as such, is the Data Controller.
The locations and functions of the companies that form part of the Enagás Group can be found at www.enagas.es and www.enagas.com.
We inform you that, within the functions legally assigned to it, the Executive Board is responsible for the implementation of the Whistleblowing Channel and its different means of contact, as well as the appointment, and dismissal of the Secretary of the Ethical Compliance Committee.
The Secretary of the Ethical Compliance Committee will act independently and autonomously with respect to the Executive Board and other management bodies of the Company.
Likewise, we inform you that, for any matter related to the processing of your data by Enagás, you can file your request to the email protecciondedatos@enagas.es or to the mailing address Paseo de los Olmos 19, 28005 Madrid, where our headquarters are located.
Personal data that we process and the ways we obtain them
We inform you that, among others, we may process the following personal data through the following means:
Purpose and legitimacy of the Processing
We inform you that Enagás will only process the data necessary for the receipt of reports and investigation to be conducted, in the following cases:
Within the scope of the Whistleblowing Channel, we will process data of any nature, to comply with our Code of Ethics and all applicable regulations, with special attention to laws on regulatory infringements and the fight against corruption. The legal basis of the Processing is our legitimate interest as Data Controller, as well as compliance with legal obligations, according to the provisions of:
(Hereinafter, the "law").
Data retention
We will keep your personal data for no longer than is necessary to decide on the appropriateness of initiating an investigation into the reported facts.
After three months from its submission, if the investigation of the reported facts has not been initiated, your data will be deleted.
At that time, the data can only be kept anonymous and unblocked, to leave evidence of the operation of the Channel itself.
Data recipients
In accordance with the provisions of Law 2/2023, the following categories of recipients and departments with access to data are foreseen. The legal basis of the Processing is the legitimate interest of the data controller, as well as compliance with legal obligations:
The Executive Board or other management bodies will not manage the Whistleblowing Channel and, therefore, will not have access to the data processed within, outside of the cases provided by law.
The identities of the reporting person and of third persons connected to him or her will only be communicated to the Public Prosecutor's Office and to the competent administrative and judicial bodies in the framework of a criminal, disciplinary or sanctioning proceeding.
On the other hand, we maintain relationships with providers who provide us with certain services as data processors. Enagás requires those processors to guarantee the legality and security of the processing that they conduct on its behalf. In the event of external management of the Whistleblowing Channel, Enagás will transfer to the providers of said service the obligations of confidentiality and protection of the reporting person in the terms provided in this Policy, without prejudice to other legal obligations that may correspond to them.
If said access is conducted by companies from countries outside the European Economic Area (EEA) that do not offer an adequate level of protection like that of the EEA, we will rely on one of the appropriate safeguards established by the GDPR.
Security of your data
Enagás declares that, if you are the reporting person, your identity will be confidential in any case, and will not be revealed to the people to whom the facts refer. The identities of third parties other than the reporting person are also anonymous, such as workers’ representatives, facilitators, natural persons related to him or her or third companies and their workers and members.
Likewise, Enagás informs you that, if you are one of the persons concerned, you will not be able to access the identities of the reporting person or related third companies.
The appointment of the Secretary of the Ethics Compliance Committee will be communicated to the Independent Authority for the Protection of Reporting persons, AAI (competent authority), in the manner and within the period established by law.
We inform you that Enagás is adopting all the necessary technical and organizational measures to guarantee the security, integrity and confidentiality of the personal data provided, to prevent its alteration, loss, and/or unauthorized processing or access.
To keep your personal data updated in our files, you must inform us of any changes that occur in them. Otherwise, we are not responsible for data that is not accurate or truthful, nor for the consequences that this may cause to Enagás or third parties.
Data subject rights
At any time, you may exercise the rights of access, rectification, deletion, portability, limitation, opposition to the processing of your data and not be subject to automated decisions, when appropriate, by sending a request to protecciondedatos@enagas.es or to our mailing Address: Paseo de los Olmos 19, 28005 Madrid, providing a copy of your ID or equivalent document and specifying which of these rights you wish to exercise.
If you act through a legal or voluntary representative, you must also provide a document proving the representation and the identification document of said representative.
Likewise, if you have given us your consent for any specific Processing, you may withdraw it at any time, by sending a request to the address protecciondedatos@enagas.es or to the postal address referenced above.
You can consult the models, forms and more information on the rights referred to on the official website of the Spanish Supervisory Authority.
If you consider that your data is not being correctly processed by Enagás, you can direct a claim to the mailbox protecciondedatos@enagas.es or to the Authority with competence in matters of data protection, which in the national territory of Spain is the Spanish Agency for the Protection of Data.
As a reporter of facts that could constitute a violation of current law, you can also communicate with the external channel provided by the Independent Authority for the Protection of Reporters, AAI
Responsibility of the data subject
We are not responsible for the lack of veracity, accuracy, updating and/or authenticity of the data you provide us. Likewise, Enagás is not responsible for the data of third parties that it has provided us without having provided them with the information contained in this Policy.
Modification of this Privacy Policy
At any time, we can modify this Privacy Policy, informing you of any significant changes that may occur in it. The Processing of your data will be done in accordance with the provisions of the latest version, so we recommend that you consult it periodically.
