Privacy policy

2. Additional information on Data Protection

This Privacy Policy regulates the processing of the data collected by FERROVIAL SE (hereinafter, the Company) through this Website (from now on, the Website). This Policy forms an integral part of the Legal Notice.

The User guarantees that the information provided is true, accurate, complete and up-to-date, and is responsible for any direct or indirect damage that may arise from the breach of such obligation. When the User provides personal data relating to third parties, he/she guarantees that he/she has informed them of the content of this Privacy Policy and that he/she has obtained their prior consent to provide us with their personal data.

Regarding the personal data requested through the enabled forms, it will be necessary for the User to provide, at least, those data marked with an asterisk or otherwise determined as mandatory, or necessary, in the form or channel of data collection in question, since, if these data deemed necessary are not supplied, the Company will not be able to accept and manage the User’s request.

The Company may modify this Privacy Policy when necessary. If the Privacy Policy is changed, we will notify the User through the App, through our website or through any other means of communication to ensure that the User is informed of the new privacy terms applicable to the Company’s Services. The continued use of the Services by the User after we have informed him/her of the changes to our Privacy Policy, will mean that the User agrees with the new terms, except in relation to possible data processing purposes where your consent is required.

This privacy policy was lastly updated June, 16 2023.

For personal data requested through forms on the Website, Users must provide at least all details marked with an asterisk. If such mandatory information is not provided, the Company will not be able to accept and process their request.

Who is the controller for the processing of your personal data?

Company’s name: FERROVIAL SE

Address: Gustav Mahlerplein 61-63 (Symphony Towers, 14^th floor), 1082 MS Amsterdam, The Netherlands

Phone: +31 207 98 37 02

Email:  digital@ferrovial.com

Data Protection Officer:  dpo@ferrovial.com

What is the origin of the personal data we process?

The personal data that we process are those that the User has provided to us directly or through their interactions and forms enabled on the Website or on the Company’s social networks. Consequently, it is always the User who is the source of the data we process.

For what purpose do we process your personal data and with what lawful basis?

The personal data provided by the User may be processed by the Company for any of the purposes listed below, depending on the type of data provided by the User and the interactions that the User carries out through the Website (name, e-mail address, mobile phone number and attention requested) will be processed by the Company for the purpose of registering Users from the Website, administering the user database and responding to requests or questions;

In more detail, the Company may process your data for the following purposes

1. User management:
   • Purpose: Management and assistance with registration and activity as user.
   • Data processed for this purpose: Identifying data, contact data and web navigation data.
   • Lawful basis for processing: Consent of data subject.
2. Blog Management:
   • Purpose: Registration of blog users, which allows them to: save particular articles and read them again; publish comments, together with the details provided for this purpose; and receive notifications of i) new publications, according to the categories selected by the User for this purpose, and ii) new comments on publications that the User has previously commented on.
   • Data processed for this purpose: Identifying data, contact data and web navigation data.
   • Lawful basis for processing: Consent of data subject.
3. Sending of newsletters and alerts:
   • Purpose: Sending of this information, through any channel, including electronic means (such as e-mail, web communications or communications through the application) on news and articles, activities, events, competitions, etc. of the Company or third parties, which may contain commercial information on products, services, offers or promotions in relation to the activities carried out by the Company and/or the Ferrovial Group, as well as the information requested by the User through the forms in the Company’s website. The companies of the Ferrovial Group are all the companies or entities that have FERROVIAL SE as their parent company for the purposes of Article 42 of the Commercial Code and, specifically, the companies listed in our most recent annual report and consolidated annual accounts published on ferrovial.com website.
   • Data processed for this purpose: Identifying, contact data and preference data.
   • Lawful basis for processing: Consent of data subject.
4. User Service:
   • Purpose: Management and resolution of User queries and communications.
   • Data processed for this purpose: Identifying and contact data.
   • Lawful basis for processing: Maintenance and execution of the contract or the established legal relationship.
5. Compliance with the Company’s legal obligations in relation to the website:
   • Purpose: Fulfilment of the Company’s legal obligations in relation to the Website, whenever it is necessary to process the data of the Users.
   • Data processed for this purpose: Identifying data, contact data and web navigation data.
   • Lawful basis for processing: Compliance of legal obligations.
6. Fraud prevention:
   • Purpose: Management and development of fraud prevention and control activities.
   • Data processed for this purpose: Identifying data, contact data, professional data and web navigation data.
   • Lawful basis for processing: The Company`s legitimate interest in not being a victim of fraud.
7. Contact with the User to participate in specific projects:
   • Purpose: The Company may contact the User to propose collaboration or participation in any of the projects in which the Company is involved, within the framework of the Ferrovial Foresight innovation platform.
   • Data processed for this purpose: Identifying data, contact data, web navigation data, professional data, preference data.
   • Lawful basis for processing: Consent of data subject.
8. Elaboration of surveys and analysis of user behavior.
   • Purpose: The Company may process the data of the Users for statistical purposes, in order to analyze the behavior of the Users, Users’ activity and their interactions on the Website. Satisfaction surveys may also be carried out to assess the User experience. In order to carry out this purpose, specific cookies will be used, which will only be applied if the User gives his/her express consent.
   • Data processed for this purpose: Identifying data, contact data, preference data, professional data and web navigation data.
   • Lawful basis for processing: Consent of data subject.

For the purposes of user and blog management (1 and 2), sending newsletters and alerts (3), contacting the User for participation in projects (7) and data processing for statistical purposes (8), based on consent, the Company informs its Users that it will only process the User’s personal data in cases where the User has consented to the data processing activity through the means of obtaining consent made available to him/her by the Company. In the event of revocation of consent, this shall not affect the lawfulness of the processing previously carried out, as long as the consent was valid.

We also inform you about the processing of the information collected from the Users of the social networks accessed through the corporate profiles of the Company for the purposes specified by each of these social networks, including analysis purposes. Any competition and/or promotion organized on such networks will be specifically regulated.

What personal data do we process?

The personal data processed by the Company as a consequence of the interactions carried out by the Users, through the Website, come from the personal data provided by the Users through the forms made available by the Company, as well as provided through any other User’s interaction with the website.

Specifically, the Company may process the following categories of data:

• Identifying data: name and surname, ID, user’s IP.
• Contact data: postal address, email, telephone number, zip code, city.
• Professional data: company data, position held, professional sector.
• Navigation data: domain and host from which you access the Internet, Internet address of the website from which you access the Web (for example, through a link), date and time you access the Web and time spent on it, IP address (Internet protocol), operating system of your computer and browser software.
• Preference data: interests in Ferrovial’s activity, data on the receipt of e-mails at the address provided, in particular, whether or not the e-mail has been received, whether or not the e-mail has been opened, and the date and time of receipt. 

To whom your data is disclosed?

The Company informs you that your data may be shared with the following:

• Group companies, as specified in the previous section, in order to respond to requests and queries from Users. This may involve international transfers of data to countries outside the European Economic Area (EEA), some of which may not be considered by the European Commission to have a level of data protection equivalent to the level of protection in the EEA.
• Public administrations, for the fulfilment of legal obligations of the Company.

Your username and comments may be visible to third parties in cases where you interact through comments on the Blog.

Likewise, the Company informs Users that their personal data may be communicated to service providers of the Company, who act as data processors, some of which are located outside the European Economic Area, in countries that do not have a level equivalent to the European one in relation to data protection guarantees.

In the event that the Company carries out such data communications, it guarantees that, beforehand, it has put in place the appropriate means to ensure the application of adequate legal guarantees in relation to such data communications.

The appropriate legal guarantees to be applied by the Company may consist in the formalisation with the recipient of the data of Standard Contract Clauses approved by the European Commission to legitimise the international transfer of data to third countries or in any other legal mechanism providing an adequate level of protection equivalent to the EEA.

If the User wishes to obtain more information about the data transfers carried out by the Company and the legal guarantees that protect them, he can contact us through the contact channels indicated in this Privacy Policy.

How long do we retain your personal data?

With regard to the rest of the purposes of data processing and transfer described in this Privacy Policy, they will be kept for as long as the legal relationship established between the Company and the User remains in force and for the period of time necessary to comply with the Company’s legal obligations.

In relation to the rest of the processing purposes, the data will be kept as long as the Company has the legitimacy to do so and, as long as the User does not request the erasure of the data.

What are your rights as data subject?

The User has the right to access his/her personal data and to obtain confirmation of how we are processing them, as well as to request the rectification of inaccurate data or, where appropriate, to request their deletion when, among other reasons, the data are no longer necessary for the purposes of the processing which they were collected.

Under certain circumstances, data subjects may request that the processing of their data be limited, in which case we will only keep them for the exercise or defense of claims. Users may also (oppose to the processing of their data on the basis of reasons related to their particular situation, in which case we will stop processing the data, except for compelling legitimate reasons or for the exercise or defense of claims.

The User may request the right to the portability of the data and obtain for himself or herself or for another service provider certain information derived from the formalised relationship with the Company. To exercise the rights in the matter of data protection, or to revoke the consents given, the User can write to FERROVIAL SE, Gustav Mahlerplein 61-63 (Symphony Towers, 14^th floor), 1082 MS Amsterdam, The Netherlands or to the e-mail address dpo@ferrovial.com indicating as reference “Data Protection”.

The Company informs the User that, in order to make the right exercised effective, it may be necessary for the User to provide additional documentation to prove his/her identity.

For any additional information on the processing of personal data, the User may contact the Company’s Data Protection Officer (dpo@ferrovial.com). Likewise, the User may file a complaint with the Dutch Data Protection Agency (https://autoriteitpersoonsgegevens.nl/en), especially when the User has not obtained satisfaction in the exercise of his or her rights.