Privacy Policy

1. Introduction

Holaluz works to offer the user the best possible experience through its products and services. In some cases, it is necessary to process personal data to achieve this.

HOLALUZ-CLIDOM, S.A., as data controller, informs you of how it processes your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”); Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”); Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (“LSSI”); and Law 11/2022 of 28 June, the General Telecommunications Law (“LGTel”).

2. Data controller

HOLALUZ-CLIDOM, S.A. (“Holaluz” or the “Company”) is the controller of the personal data you share with us:

• Identity: HOLALUZ-CLIDOM, S.A.
• Address: Passeig Joan de Borbó 99-101, 4th floor, 08039 Barcelona
• Tax ID (NIF): A65445033
• Email: lopd@clidom.es

Holaluz has appointed a Data Protection Officer (DPO). For any question related to the processing of your data or to the duties of the DPO, you can write to dpd@holaluz.com.

3. What data we process and why

• Contracting: to manage any contracting option offered through the website or by telephone, we will process, depending on the channel:

  a) by telephone: your telephone number and the data needed to formalise the contract;

  b) via web form: your name, email address, telephone number and your latest utility bill, which contains personal data.

• Information requests and personalised offers: when you ask us to call you through the forms on the website (for example, “Shall we call you?”), we will process your name, email address, telephone number, postcode and the approximate amount of your electricity bill in order to contact you, advise you on the product you are interested in and, where applicable, prepare a personalised offer for you.

• Follow-up of your offer: the first call will be made from a number with the 400 prefix, identified as a commercial call. If you expressly authorise us, the follow-up of that offer may be carried out:

  a) by telephone, from the direct number of the person assisting you, which we will give you in advance; and/or

  b) by WhatsApp, via WhatsApp Business or from the direct number of the person assisting you, which we will give you in advance. In that case we will process your telephone number, your name and the content of the conversations.

  This authorisation is limited to the follow-up of the specific offer, ends when you sign up, reject it or the stated period expires, and you can withdraw it at any time.

• Call recording: commercial and follow-up calls may be recorded, with notice given at the start, to provide evidence of your request, the authorisations you give us and, where applicable, the contract.

• Customer Zone: to manage your access to and use of the Customer Zone we will process your identification, consumption, contractual and billing data.

• Producer Zone: to manage your access to the Producer Zone we will process your identification, contractual and billing data and production metrics.

• Collaborations: to manage your collaboration form with Holaluz we will process your name and surname, email address, telephone number, province, type of professional (legal entity or individual) and tax ID (NIF/CIF).

• Commercial communications: to send you commercial communications and/or newsletters about Holaluz products and services we will process your name and surname, email address and/or telephone number, and any other data needed for this purpose. Commercial calls are made from numbers with the 400 prefix, except for the follow-up of an offer that you have expressly authorised under “Follow-up of your offer”.

• Customer Service: to manage enquiries, complaints, claims, incidents and faults we will process your telephone number and any other information you provide. Calls may be recorded, with prior notice, for quality purposes. When you submit an enquiry, complaint, claim or incident by telephone, recording it as evidence will require your express consent.

• “Work with us” form: to manage job applications we will process your name and surname, email address, telephone number, CV and, optionally, your photograph. You can apply through LinkedIn; in that case you must accept its privacy policy for your data to be communicated to Holaluz.

• Prize draws, promotions and campaigns: to manage prize draws, promotions or campaigns on our website or on social media we may process the data needed for each activity. We will inform you specifically in each case.

4. Legal basis for processing

The legal basis for each processing activity is as follows:

5. Retention of your personal data

We only keep personal data for as long as necessary for the purposes for which it was collected. We use the following criteria:

• Data obtained when contacting Holaluz with an enquiry or request: for as long as necessary to resolve it.
• Data from call requests and personalised offers that do not result in a contract: 12 months from the last contact.
• Recordings and records of the authorisations you give us (including those for follow-up and WhatsApp): for as long as the authorised processing lasts and, thereafter, for 3 years, the limitation period for any liabilities that may arise.
• WhatsApp conversations: 12 months from the end of the offer follow-up, unless they are added to the contract file.
• Data obtained when giving consent to commercial communications: 2 years from the last communication, unless you exercise your right to object or withdraw your consent.
• Job application data: 2 years from the application, unless you exercise your right to object.
• Data provided for contracting services: for the duration of the contractual relationship and 5 years after it ends, to comply with tax and sector regulations.

We may keep some data to comply with legal or regulatory obligations, or for the establishment, exercise or defence of legal claims. Once the periods have elapsed, the data will be deleted or anonymised.

Holaluz has a Data Retention Policy. For more information, write to lopd@clidom.es.

6. Recipients of your data

Your data will never be sold to third parties.

To provide our services we rely on providers who may access your data on behalf of Holaluz, following our instructions and under a data processing agreement in accordance with Article 28 GDPR. They fall into these categories:

• telephone support and management providers and call centres;
• CRM, information systems and hosting providers;
• messaging service providers, including WhatsApp Business;
• self-consumption installation companies.

For information about the specific providers you can write to lopd@clidom.es.

Where required by law, we will disclose to public bodies or other parties the data strictly necessary to comply with such obligations.

Holaluz may disclose your data to other companies of the Holaluz Group for the overall management of the contracted service. In particular, when you contract the electricity supply together with the financing and supply of a self-consumption installation, for issuing invoices and managing the other contracts you have with Group companies. We will only disclose your data to other Group companies for sending commercial information if you have given us your consent to do so.

For the mobile app, Holaluz will only disclose personal data to the company’s own domains.

7. International transfers

As a general rule, your data is stored within the European Economic Area (EEA). Some providers may process data outside the EEA. In particular, the use of WhatsApp may involve transfers to the United States.

In such cases, Holaluz ensures an adequate level of protection through one of these mechanisms: adequacy decisions of the European Commission, including the EU-US Data Privacy Framework for participating entities; standard contractual clauses approved by the European Commission; or binding corporate rules. You can request information about these safeguards at lopd@clidom.es.

8. Your rights and how to exercise them

You can exercise your rights by writing to lopd@clidom.es or to the DPO at dpd@holaluz.com. Under the GDPR you can request:

• Access: to know whether we process your data and obtain a copy.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: that we delete your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Restriction of processing: that we restrict the processing of your data in the cases provided for by law.
• Portability: to receive your data in a structured, commonly used and machine-readable format, or have us transmit it to another controller.
• Objection: to object to processing based on legitimate interest and, in any case, to processing for direct marketing purposes.
• Not to be subject to automated decisions, including profiling, that produce legal effects or significantly affect you.

Withdrawal of consent: you can withdraw the consent you have given us at any time, without affecting the lawfulness of prior processing. To stop receiving follow-up calls or WhatsApp messages, just say so during any call, reply “BAJA” on WhatsApp or write to lopd@clidom.es. The withdrawal will apply to all channels.

The request may be refused when the data is necessary to comply with legal obligations. If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Responsibility for the accuracy and truthfulness of the data provided

The user is solely responsible for the truthfulness and correctness of the data provided, releasing Holaluz from any liability in this regard. Users guarantee and are responsible, in any case, for the accuracy, validity and authenticity of the personal data provided, and undertake to keep it duly updated. The user undertakes to provide complete and correct information in the registration or subscription form. Holaluz reserves the right to terminate the services contracted with users if the data provided is false, incomplete, inaccurate or out of date.

Holaluz is not responsible for the truthfulness of information that it has not produced itself and for which another source is indicated, and therefore assumes no liability for any hypothetical damages that may arise from the use of such information.

Holaluz reserves the right to update, modify or remove the information contained on its web pages, and may even limit or deny access to such information.

10. Security measures applied to protect your personal data

Holaluz has adopted the legally required levels of personal data protection security, and endeavours to install any other additional technical means and measures within its reach to prevent the loss, misuse, alteration, unauthorised access and theft of the personal data provided to Holaluz.

Holaluz is not responsible for any hypothetical damages that may arise from interference, omissions, interruptions, computer viruses, telephone faults or disconnections in the operation of this electronic system for reasons beyond the control of Holaluz; from delays or blockages in the use of this electronic system caused by deficiencies or overloads of telephone lines or overloads in the Data Processing Centre, the Internet system or other electronic systems; or from damage that may be caused by third parties through unlawful interference beyond the control of Holaluz. However, the user should be aware that Internet security measures are not impregnable.

In particular, the website is secured with a TLS certificate with RSA encryption, which means that all information sent to the website is encrypted using the HTTPS protocol.

11. Contact and changes to the Privacy Policy

This privacy policy may be modified. We recommend that you review it periodically.

Last revision: October 2026