Privacy Policy


Fundación Repsol wishes to inform all stakeholders of the policy regarding the processing and protection of personal information. We want to maintain transparent communication with you, informing you about how we collect and securely process any data you provide us with. To this end, we have prepared this Privacy Policy (hereinafter the ‘`Policy’), which will allow you to find the information you need and clear up any questions you may have.

Furthermore, we hereby inform you that your data will be processed in accordance with current personal data protection legislation, in particular Regulation (EU) 2016/679 of 27th April, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Please read this policy carefully, because it provides information that you will need to make an informed decision about providing us with your personal information.

The policy is applicable to all processing of personal information with any of the programmes or activities developed by Fundación Repsol.

In the event that the country where you are located requires it, this policy may be complemented by additional local regulations. This policy is not applicable to third-party websites, including those which you may access through a web link from our website.

We trust that this information will prove useful to you. Nevertheless, if you need further information about any issue, you may contact us.

What terms must I know to better understand the Policy?

First of all, we want to define some of the terms that you will find in this document:

Personal data’ – this refers to any information that identifies natural persons or makes them identifiable (i.e. that makes it possible to identify them in some way).

User’ or ‘stakeholder’ – unless you provide us with third party data, you, as the the holder of the data, are understood to be the user or data subject.

Data controller’ – the natural or legal person, public authority, service, or organisation that, alone or jointly, determines the purpose and means of processing.

Data processor’ – the natural or legal person, public authority, service, or organisation that processes the data on behalf of the data controller.

Third party’ – any other natural or legal person, public authority, service or organisation; apart from the data subject, data controller, data processor, or other person authorized to process personal data under the direct authority of the controller or processor.

Recipient’ – the natural or legal person, public authority, service, or other organisation that receives the personal data, regardless of whether they are a third party.

Consent’ – any demonstration of free, unequivocal, specific, and informed consent to the processing of your data; whether through a statement or a clear affirmative action.

‘Personal data processing ’ – any operation or series of operations carried out on personal data or personal data sets — whether with automatised procedures or not — such as collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, disclosure by transfer, dissemination or any other means of enabling access, collation or interconnection, limitation, deletion, or destruction.

Data transfer’ or ‘data communication’ – any disclosure of data to a natural or legal person, public authority, service or another organization, regardless of whether they are a third party.

“Fundación” – an abbreviation of "Fundación Repsol", who is the data controller in all cases.

1. Does the Fundación have a data protection officer?

The Fundación does not have a data protection officer because it is not a legal requirement; given that data processing for commercial purposes is outside the scope of its core activities and limited that which is strictly necessary for the pursuit of the purposes and objectives laid down in its own statutes.

2. Who is your data controller?

Every time we collect your personal data, we will provide you all necessary information about the reason for, and purpose of collecting your data, and the legal basis for their processing; as well as your rights, and contact details.

3. Which personal data do we process and how do we obtain it?

The personal data we that process includes, but is not limited to:

  • Data you provide voluntarily,
  • Data resulting from access to or use of a service, or your relationship with Fundación Repsol. This may include your image when you have been informed that you may be photographed,
  • Data derived from any communication you maintain with us,
  • Your image when processing video surveillance footage, or if you are involved in an event that has a high public impact. In this case, you will be informed that you may be recorded,
  • Information we can lawfully infer from the data we process,
  • Data corresponding to your browsing of our website, including your IP address or information derived from cookies or similar devices (you can find out more about this in our website’s Cookies Policy),
  • Data corresponding to your Social Media profiles,
  • Data that we could lawfully access as it is available from a publicly accessible source,
  • Third-party data that you provide, with their prior consent,
  • Data provided by third parties with your prior consent, or when there is a lawful basis for the data processing.

4. Why, and with what legitimacy do we process your personal data?

1. Managing your sign-up request for any Fundación Repsol programme

Participation in our programmes requires prior sign-up, for which we will request the data strictly required by the programme; and which will be processed in accordance with the information we provide you at the time of the sign-up. If you would like to be reminded of this information, please consult our Policy or get into contact with us.

Your request and the consent provided by registering is the lawful basis for processing.

2. Managing your relationship with us

The main purpose for which we process your personal data is to manage your relationship with us as an intern, volunteer, project participant (including the Entrepreneurs Fund), user, or data subject with a link to Fundación Repsol. It may also be processed to respond to any complaints, questions, or suggestions that you submit.

The actions required to manage our relationship constitute the lawful basis which enables us to process data.

3. Managing the volunteering programme

If you want to register for one of our volunteering programs, we will process your data to manage your participation, provide you with the training you need, and allow you to participate in volunteering activities. As an entity that organises volunteering activities, we are legally obliged to perform a criminal record check. Therefore, we may ask you for documents regarding this matter. We will process this information for the sole purpose of fulfilling our legal obligations.

Furthermore, you may sometimes be allowed to bring a guest to the volunteering activities. Remember that before providing third-party data, you must obtain their consent.

The lawful basis for the data processing is the execution of the volunteering activities that you sign up for.

4. Compliance with accounting, legal, tax, and administrative obligations

Fundación Repsol is obligated to comply with applicable accounting, legal, tax, and administrative obligations. We will process your data to the extent necessary to fulfil our legal obligations.

The lawful basis for the data processing is compliance with legal obligations.

5. Management of user support services

You will have access to our contact details regardless of the nature of your relationship with us; this includes our postal address, telephone, and/or email address should you wish to address any suggestions, complaints, or questions to us.

If you get in touch with our user/volunteer/etc. service through any of the available means and channels, your data will be processed to deal with your enquiry.

6. Analysing your browsing habits

We will process the data derived from your browsing of our online environments in accordance with our Cookies Policy, and with the purpose of analysing your use of our website, customizing your offers, and improving our online services and content.

The lawful basis for this data processing is your consent.

7. Learning more from your Social Media profiles

Fundación Repsol processes the information you share with us through your Social Media profiles. For further information, read the chapter on ‘How does Fundación Repsol process your Social Media profiles?’

8. Organising and managing draws, competitions, and events

In these cases, any data subject who wishes to participate will voluntarily register by filling out the forms Fundación Repsol provides for this purpose. The data subject’s personal data will be processed to manage their participation, delivery of the prize, and, where applicable, any advertising that is related to these activities.

Data will only be processed if the data subject has consented, demonstrated through their participation; for the management of their participation.

9. Managing contact information within the framework of contractual relations or for the purpose of sending non-commercial information and event invitations

Fundación Repsol can process third-party contact information or that of representatives with whom we maintain a contractual relationship with, for the sole purpose of managing the aforementioned contractual relationship.

The lawful basis for the data processing, in this case, is the implementation of the contract.

In addition to this, Fundación Repsol can process the contact details of potential clients, legal entities, institutional representatives, government body representatives, journalists, analysts, or investors who willingly transfer their data to us, with the purpose of providing said persons with non-commercial information and to invite them to Fundación Repsol events.

In this case, the data subject’s consent, which is expressed upon providing the contact details, serves as the lawful basis for processing.

10. Avoiding liability with the Spanish General Social Security Treasury and ensure the quality of the services rendered by providers.

Fundación Repsol may process personal data of suppliers’ employees, either provided by the supplier or directly by the employees. The purpose of this processing is to ensure the quality of service provided by the supplier, provide access to Fundación facilities, and avoid possible liability with regard to the Spanish General Social Security Treasury as a result of a provider's failure to meet their obligations in this regard within the context of articles 42 and 43 of the Spanish Worker’s Statute..

Our legitimate interest in controlling our relationships with our providers and all associated liabilities is the lawful basis for processing in this case.

11. Fundación Repsol Compliance Channel

Fundación Repsol has a compliance channel that can be accessed by any member of the public. It is used to deal with and manage enquiries and/or messages to guarantee compliance with our Code of Good Governance. It also allows Fundación Repsol to analyse and adopt the necessary actions to investigate and prosecute any crimes that take place within the framework of a relationship with Fundación Repsol. This channel ensures that the data provided by the person reporting the incident is kept confidential.

The subject data’s consent, provided upon reporting the incident, together with Repsol’s legitimate interest in prosecuting criminal offences which may affect it, is the lawful basis for processing data.

12. Security at Fundación Repsol facilities

Fundación Repsol is equipped with video surveillance cameras, the purpose of which is to ensure the security of our facilities.

The lawful basis for processing is Fundación Repsol's lawful interest in preventing or investigating, where appropriate, incidents that occur at their facilities.

13. Events

Fundación Repsol may also process personal data of people who are invited or sign up to an event that is organized or sponsored by Repsol. Fundación Repsol may take photos to publicize events that take place. Subjects will be informed of this fact, as the case may be, so that they may decline the opportunity to attend the event or exercise their rights.

The lawful basis for the data processing, in this case, is the consent of the stakeholder.

14. Applicants

In the event that you contact us to show your interest in joining the Fundación Repsol team, we will process your data and all documentation you submit to assess your profile and take you into consideration to fill job vacancies in a possible hiring process.

5. How do we process your personal data?

We commit to processing your data in accordance with the applicable regulations and, in particular, using the appropriate organizational and technical measures to guarantee an appropriate level of security, ensuring the confidentiality., integrity, availability, and resilience of processing services and systems at all times.

6. Who will your data be shared with?

If we intend to lawfully transfer or disclose your personal data, we will inform you of the identity or category of recipient when collecting the data. These may include:

- Third parties to whom we are legally obligated to disclose your data, including administrative tax authorities, and Social Security;

- Third parties with whom we must share your data to confirm your affiliation with a certain group, to enable you to participate (for example, the ‘More than Words’ Programme).

- Third parties to whom we are obliged to disclose your data, to fulfil the core purpose of your relationship with Fundación Repsol.

Lastly, we inform you that we maintain relationships with suppliers of certain services. When providing these services, the suppliers may access your data. They will handle this data as data processors, with the same guarantees that we apply when processing your data.

Fundación Repsol only processes personal data within the European Union, and if it were to be taken outside the European Union to be accessed by our data processors, we would inform you of this through this Policy.

7. How long do we store your personal data for?

In each case, we will inform you of the period of time necessary to meet our obligations, both to you and the corresponding authorities. In any case, the personal data you provide us will be stored for the duration of your relationship with Fundación Repsol, unless you request the erasure of that data. Subsequently, when appropriate we may store your data until the statute of limitations for criminal, civil, commercial, and/or administrative liability has passed.

8. What are your rights when you provide us your data?

You may execute a series of rights concerning the processing of your personal data at any time. Every person has these rights and, consequently, they are unwaivable. We will describe and explain each one of them below:

  • Right to access. By exercising this right, you may obtain information about how we process your personal data.
  • Right to rectification. You may correct or modify your data if they are inexact or incomplete, in order to ensure that we have the correct details.
  • Right to erasure (or right to be forgotten). You may request that your data be deleted in one of the established cases. For example, unlawful data processing, or when the initial purpose for processing or collection no longer exists. However, there are also series of exceptions to which this right does not apply. For example, in cases when the right to freedom of expression and information should take precedence.
  • Right to object. By exercising this right, you may object to the processing of your personal data: (i) when, for reasons related to your personal circumstances, your data must no longer be processed, except for when there is an accredited legitimate interest or it is necessary for the exercise or defence of legal claims, or (ii) when processing is carried out for direct marketing purposes.
  • Right to restriction of processing. You may request that we restrict the processing of your personal data (i) while we are investigating the accuracy of data, when this accuracy has been contested (ii) when this processing is unlawful but you are opposed to your data being erased and, instead, request this limitation (iii) when you need your data for the exercise or defence of a legal claim (iv) and even when you have opposed the processing of your personal data to fulfil a mission of public interest or to satisfy a lawful interest, which must be checked. In these cases, we will only conserve data for the exercise or defence of legal claims.
  • Right to data portability. You are entitled to request the portability of your personal data in electronic format, as well as the right to transmit those data to another entity.
  • To exercise these rights, you can contact Fundación Repsol at the address indicated when your data was collected, attaching a copy of your National ID card or similar document and indicating the corresponding processing.

    You also have to right to withdraw consent at any time, without any effect on the lawfulness of the processing already carried out, by submitting your request to the same address indicated in the previous paragraph. Your request must again be accompanied by a copy of your National ID card or similar document.

    Should you believe that your data has been processed improperly and not in compliance with personal data protection regulations, or should you believe that we have not acted accordingly when exercising your rights, you may contact the control authority. In Spain, this is the AGPD, or Spanish Data Protection Agency (www.agpd.es).

    9. What is our policy concerning the personal information of minors?

    In most cases, Fundación Repsol will only process the data of persons over the age of 18. Nevertheless, there may be isolated cases, especially in the course of a promotional activity, programme or event where the data of children are used. In these cases, consent and authorisation of parents or legal guardians will be requested if the child is under the age of 14. If you are a minor and unsure whether you fully understand this explanation, you should ask for assistance from your parents or guardians.

    Regarding Social Media, we recommend that parents and guardians regularly check and supervise their children\'s activity on the internet. Please ensure that your children do not provide us personal with data without your authorisation and consent.

    You can exercise the rights of persons under 14 years of age at any time by certifying your legitimate right to do so.

    10. What happens if you provide us with data belonging to third parties?

    Should at any time, as part of your relationship with us, you facilitate third party data, we remind you that you are solely responsible for having obtained their prior consent to communicate their data to Fundación Repsol for the objective which you may be made aware of in each case, in addition to having informed said party of the existence and content of this Policy.

    You are responsible for holding Fundación Repsol harmless from any liability derived from a lack of information and/or consent from the third party.

    11. How do we process your data on Social Media?

    We recommend that you avoid including personal data — be it yours or that of third parties — when interacting with our Social Media accounts. However, you must be aware that, should you decide to include any personal information, it will be processed in accordance with this Policy.

    Specifically, the data provided though any Social Network will be processed to engage and interact with you on various Social Media sites, in order to give you a better understanding of us, our activities, and our values. This is not the proper channel for communicating your complaints or suggestions, but should you use Social Networks to send us any kind of request, claim, suggestion, or complaint related to any of our programmes or activities, we will analyse the communication and send you a response.

    Your status as a friend or follower of our Social Network profiles is the lawful basis for processing.. We continue to process your data for a period of two (2) years after you stop following our Social Network profile. It is important to note that, when you interact with us through Social Media, the terms and conditions of use established by the owner of the Social Media site are outside our control. Therefore, they are not covered by the contents of this Policy. We recommend that you ensure you know and agree with the legal terms and conditions and privacy policy before continuing to use it or providing any kind of personal data.

    12. Can we change the terms of the policy?

    We can modify this Policy at any time, and we will always inform you of any significant changes by sending the corresponding notification. In any event, those changes will not be applied retroactively and will enter into force from the date of their publication. We recommend that you regularly review the Policy.

    13. What are your responsibilities?

    You are responsible for ensuring, for all the data you provide, the veracity, accuracy, timeliness, validity and authenticity of those data, as well as of the consent you give for them to be used and/or processed. You are likewise responsible for third-party data you provide us, for which you are obliged to obtain consent. Do not forget that you are responsible for regularly consulting this Policy, as well as any future updates thereto.