• Identity: FUNDACIÓN PRIVADA ABERTIS 

• CIF/Tax ID: G62053293 

• Adress: C/ Castell, 08729, Castellet I La Gornal, Barcelona, Spain 

• Postal Address: Avenida Pedralbes, 17, 08034 Barcelona, Spain  

• Telephone: 977671667 

• E-mail: lopd@abertis.com  

Abertis Foundation will process your personal data for the following purposes:  

1. If you are interested in the Challenge, in order to correctly manage your application and contact in relation to the Challenge; 

2. To manage your participation, once you have completed your registration form for the Challenge using the link available at http://www.f6s.com/abertis-drone-challenge. The registration will entail an international personal data transfer to United Kingdom to “F6S Network Limited”; 

3. If necessary, to share your personal data with other companies in the Abertis Group for internal group administration purposes; 

4. In order to comply with internal administrative purposes derived from the organization of the Challenge, excluding commercial purposes; 

5. Where applicable, obtain your images during the course of the Event for later use, in accordance with the information provided to you in this policy; 

6. Where applicable, inform to Abertis Infraestructuras, S.A. of your image or voice rights relating to the pictures or videos taken of you in the framework of the Challenge to allow Abertis Infraestructuras, S.A. to publish news about the Challenge in online and offline external media and communication campaigns, relating to the posting on their respective web pages. 

The legal basis for processing your personal data based on the purposes described above is as follows: 

1. In the case of your interest in the Challenge, the adoption of pre-contractual measures. 

2. If you complete your registration form for the Challenge using the link available at http://www.f6s.com/abertis-drone-challenge, the execution of the contractual relationship with you; 

3. Where appropriate, we will rely on our legitimate interest in disclosing your data to other companies within the Abertis Group, excluding commercial purposes; 

4. Where appropriate, consent to use image according to this document; 

1. Where appropriate, consent to communicate to Abertis Infraestructuras, S.A. the image or voice rights relating to the images taken of you in the framework of the Challenge according to this document. 

Generally, Abertis Foundation will not disclose your personal data, except in the following cases: 

1. to competent authorities and bodies, courts, tribunals or any other third parties authorized in accordance with the applicable regulations; 

2. to “F6S Network Limited”, as data controller, for the correct management of the Challenge registration process using the link available at http://www.f6s.com/abertis-drone-challenge. This data is disclosed when you complete the registration process and involves an international personal data transfer to United Kingdom that will be covered by an adequacy decision according to the provisions set out in Article 45 of the GDPR. 

3. to “Innovation House, S.L.”, as data processor to provide consulting services to support the development and implementation of the Challenge; 

4. to other companies within the Abertis Group, for internal administrative purposes, including the processing of personal data, excluding commercial purposes; 

5. if applicable, to “Abertis Infraestructuras, S.A.” the image or voice rights relating to the images taken of you in the framework of the Challenge to allow Abertis Infraestructuras, S.A. to publicize the Challenge in online and offline external communication media and campaigns, through its web pages. 

However, Abertis Foundation has outsourced the provision of certain services (e.g., virtual infrastructure services, cloud computing, etc.) to suppliers who may have access to and/or process personal data in their capacity as processors. Such suppliers may process and store personal data on servers located outside your country of residence. 

Therefore, depending on the location of the participant, data may be transferred to other countries. In this case, your personal data may be transferred internationally to third parties located outside the European Economic Area ("EEA"), provided that Abertis Foundation is authorizsed to do so and subject to compliance with the appropriate safeguards set out in Articles 44 to 50 of the GDPR. Such third parties will only access the data to carry out their services on behalf of and for the account of Abertis Foundation, under an obligation of confidentiality and always following its instructions and will not at any time use such data for their own purposes and/or unauthorizsed purposes. 

In any case, the appropriate safeguards include, but are not limited to: 

• Adequacy Decision: a declaration by the European Commission that a non-EU country provides an adequate level of data protection equivalent to that required by European data protection law, so that an international transfer of data to a third party established in that country outside the EU is possible; 

• Binding Corporate Rules: these apply to groups of companies or associations of companies engaged in a common economic activity that allow the flow of personal data on the basis of self-regulation accepted and adopted by each of the signatories; 

• Standard Corporate Rules: this is a mechanism signed between the exporter of personal data from one of the EEA countries and a third country. It is a contractual agreement, the model of which has been approved and published by the European Commission and is in line with the provisions of the GDPR; 

• Code of Conduct or a certification mechanism, together with binding and enforceable commitments by the recipient to implement adequate safeguards for the protection of the transferred data. 

• In the absence of the above, your personal data may exceptionally be transferred to a third country or international organization, in accordance with the mechanisms that may be recognized in this respect by data protection legislation.   

Abertis Foundation will conduct international transfers of personal data, in order of preference, under the following safeguards: 

Abertis Foundation will keep your personal data for the purpose of participating and/or carrying out the Challenge (unless you ask us to erase them or object to them via the channels indicated in the "YOUR RIGHTS" section) and for the time necessary to fulfil any future obligations. Your personal data will be deleted at the end of the statutory periods. 

However, for each processing activity, we will inform you of the applicable data retention period for each processing activity in the information that we provide to you when your personal data is collected. We also inform you that we will take all reasonable steps to ensure that your data is rectified or deleted when it is inaccurate.  

Abertis Foundation adopts appropriate security measures to prevent unauthorized access, disclosure, alteration or destruction of your personal data. 

Data will be processed using computers and/or IT tools, in accordance with procedures and organizational methods strictly related to the stated purposes. 

In cases where we transfer your information to suppliers by e-mail, our accounts are covered by additional security measures. All information stored on third party back-up systems requires an encrypted login. 

You are entitled to exercise your rights to access, rectify, erase, object to or restrict the processing of your personal data at any time, as well as your right to data portability. You must do so by sending an e-mail to the following address: lopd@abertis.com or a letter to the address of Abertis Foundation, located at Avenida Pedralbes, 17, 08034 Barcelona. These rights are inherent to each data subject and therefore cannot be waived and are as follows: 

• Right of access: the right to access the personal data that are processed by Abertis Foundation in accordance with Article 15 GDPR; 

• Right of rectification: the right to request that Abertis Foundation rectify certain personal data of the data subject in accordance with Article 16 GDPR; 

• Right to object: the right to object to those processing operations that are based on consent or on the existence of a legitimate interest (including, but not limited to, the sending of commercial communications) in accordance with Article 21 GDPR. In cases where the processing is based on the existence of a legitimate interest, the data subject shall have the right to request the balancing test carried out by Abertis Foundation. In addition, in cases where the purpose of the processing is to send marketing communications from Abertis Foundation or third parties, the data subject may choose, free of charge and on a voluntary basis, to opt-out (more information can be found here https://www.listarobinson.es/).  

• Right to erasure: the right to request Abertis Foundation to erase all or part of the data subject's personal data in accordance with Article 17 GDPR. Please note that while the commercial and/or contractual relationship that we have with you is still in force, there is a set of personal data that we need to process in order to fulfill the contract, so while it remains in force we cannot delete, block or cancel it, because otherwise it would prevent us from fulfilling the contract; 

• Right to restrict processing: the right to obtain from Abertis Foundation the restriction of the processing of your personal data if some of the conditions set out in Article 18 GDPR are met; 

• Right to portability of personal data: the right to receive your data in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted without hindrance to another controller, in accordance with Article 20 GDPR; 

• Right to withdraw consent: given for the performance of the processing identified in the "Processing" section based on the data subject's consent, without such withdrawal having retroactive effect, in accordance with Article 7.3 of the GDPR; 

• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects him or her. Abertis Foundation informs the data subject that, although it carries out processing decisions based on automated systems, these decisions (i) either do not produce legal effects or significantly affect the data subject; (ii) or are not adopted solely by automated means. 

Please note that, due to different local regulations, there may be some of the rights described above that are not recognized by the local regulations of the country and therefore may not apply to you. This is the case, for example, with the most recent additions to the GDPR, such as portability or the right not to be subject to a decision based solely on automated processing.  

We will comply with your request as soon as possible and, in any event, within the statutory time limit. If we fail to comply with our data protection obligations or if you are not satisfied with how we have handled the exercise of your rights, you may contact us at the following e-mail address: lopd@abertis.com. You may also lodge a complaint at any time with the Supervisory authority (in the case of Spain, the Spanish Data Protection Agency).  

You are responsible for all the data you provide to us, for the truthfulness, accuracy, validity, updating, and authenticity of said data, as well as for the consent that you give us so that your data may be used/processed. You are also responsible for the data of third parties that you provide to us and for which you undertake to obtain their consent and to make available the information that we usually provide to our users for any data processing as well as our policy.  

We may modify this policy at any time, but we will always notify you of any material changes by sending you a notice. If we make minor changes to our policy, we will update it with a new effective date that will be included in the document. The changes are not retroactive and will be effective from the date of publication. We encourage you to regularly review the policy, which can be found on our website.  

Last update: [20/11/2023].