EDP is committed to respect in the privacy of data subjects, the protection and security of their personal data. The purpose of this document is to inform users on how EDP's various antities process personal data provided through the edp.com website. Before using the edp.com website, the user must read this Privacy Policy carefully and decide if he/she wishes to provide his/her personal data to EDP.

The user warrants that he/she is of legal age and that the information he/she provides is true, accurate, complete and up-to-date; the user is solely responsible for any inconsistencies in this regard. If such data belongs to a third party, the user warrants that he/she has informed said third party about the provisions set forth in this document and that he/she has obtained permission to provide such data to EDP for the purposes stated below.

1. Scope of application and entity responsible for the processing of personal data

This Privacy Policy applies to all personal data collected through the forms available on the edp.com website.

In most forms and contact points, the data controller is:

EDP, S.A., with the single Commercial Registry and legal person number 500697256, headquartered at Avenida 24 de Julho no. 12, 1249-300 Lisbon, with a share capital of €4.184.021.624;

You may contact EDP SA on any matter related to this Privacy Policy by using the following channels and indicating the subject "EDP, S.A. - Personal Data Privacy".

• Postal Address: Avenida 24 de Julho, 12 1249-300 Lisbon
• Online form on edp.com, here

The data controller which processes personal data collected through Labelec’s contact form is:

Labelec - Estudos, Desenvolvimento e Atividades Laboratoriais, S.A. (“Labelec”) with the single Commercial Registry and legal person number 503 326 755, headquartered at Rua Cidade de Goa, no.4, 2685-038 Sacavém, with share capital of €2.200.000,00;
You may contact Labelec on any matter related to this Privacy policy by using the following channels and indicating the subject "Labelec - Personal Data Privacy".

• Postal Address: Rua Particular à Rua Cidade de Goa, 2, 2685-038 Sacavém
• Email Address: dn.geral@edp.com

The data controller which processes personal data collected through EDP Starter’s contact form is:

EDP Inovação, S.A. (“EDP Inovação”) with the single Commercial Registry and legal person number 507 988 760, headquartered at Avenida 24 de Julho no. 12, 1249-300 Lisbon, with share capital of €50.000,00;
You may contact EDP Inovação on any matter related to this Privacy policy by using the following channels and indicating the subject "EDP Inovação - Personal Data Privacy".

• Postal Address: Avenida 24 de Julho, 12 1249-300 Lisbon
• Email Address: edpinovacao@edp.com 

2. Personal data processing purposes and legal basis

Personal data collected through the forms available on the edp.com website (such as name, e-mail, phone number, and company) will be used in the following operations:

• Analysing and responding to messages/requests proactively sent by users through the forms available on the website;
• Mailing of newsletter on financial information relating to EDP, which may be requested using the form on the web page "Investors". 

The processing of these personal data is necessary for the purposes of the legitimate interests pursued by the data controller to carry out the aforementioned operations, meaning, to analyse and respond to your contact requests or inquiries and send you the newsletter to which you subscribed, this being the legal basis for the processing of your personal data.

The processing of these personal data is necessary for the purposes of the legitimate interests pursued by the data controller to carry out the aforementioned operations, meaning, to analyse and respond to your contact requests or inquiries and send you the newsletter to which you subscribed, this being the legal basis for the processing of your personal data.

Data collected about the use of the edp.com website (such as the IP of the device you use, the date and time of the start and end of your visit to the site, your browser history or other information collected through cookies) is used for:

• The website’s security management and maintenance;
• Providing and analysing the website’s usage in order to understand your interaction with the site, if you consent to the placement of certain cookies (notably analytical cookies).

These data will be collected on the basis that processing is necessary for the pursuit of the controller's legitimate interests or based on your consent, as applicable. For more information about these processing activities and the cookies we use, please refer to our Cookies Policy.
 

3. Recipients

The user's personal data may be transferred to a suitable service provider outsourced by EDP, S.A., Labelec or EDP Inovação, or to other companies within the EDP Group, which will process the data solely for the purposes determined by EDP's entities and under their instructions.  

4. International data transfers

Data processing for the aforementioned purposes may require that it be shared with EDP Group companies operating in countries outside the European Economic Area (“EEA”) (find more information about the regions where EDP operates at edp.com). Such transfers will occur when there is an adequacy decision by the European Commission regarding the country receiving the data or when subject to appropriate safeguards provided by law (under Article 46 of the GDPR). Where data is transferred subject to appropriate safeguards to a third country, the data controllers will use their best endeavours to adopt supplementary measures to guarantee that the personal data benefit from a level of protection essentially equivalent to that of the European Union. 

In addition, the data collected when you browse our website, namely through cookies and other similar technologies, may also be transferred outside the EEA if you consent to the placement of certain categories of cookies (e.g. analytics or advertisement cookies). These cookies are placed by third parties which may transfer your data to countries regarding which there is no adequacy decision by the European Commission and which do not offer a level of protection essentially equivalent to that of the European Union (e.g. the United States of America), such as the "Google Analytics" web analytics and optimization service provided by Google Ireland Limited. For example, sharing data with service providers outside the EEA (such as Google LLC) may result in disproportionate access to your data by the governmental and intelligence agencies of the country receiving the data, as well as the inability to effectively exercise your rights. For more information on the use of these cookies please refer to our Cookies Policy.

Should the Data subject wish to obtain further information about the processing of personal data carried out outside the EEA, including regarding the safeguards adopted for the transfer of personal data, he or she may contact the data controllers through the contact details available on this Policy.

5. Retention period

The personal data collected through EDP S.A., Labelec, EDP Inovação's contact forms will be stored by each controller for a period of 5 years, although such data may be stored for a longer period for the fulfillment of legal obligations or archiving purposes; in the latter case, appropriate technical and organizational measures will be implemented. 

The personal data collected by EDP, S.A. for sending the newsletter will be stored for as long as the newsletter continues to be sent or until the user unsubscribes from it.

Data collected regarding the website’s navigation will be stored during the cookie’s storage period and in accordance with the information available on the Cookies Policy and on the cookie management tool OneTrust.

6. User rights

Pursuant to personal data laws, the user has the right to request EDP, S.A., Labelec and EDP Inovação, as applicable, to access, rectify and delete any personal data concerning him/her. Moreover, the user may also exercise his/her data portability rights or the right to limit the processing of his/her personal data. The user has also the right to oppose, at any moment and for reasons relating to his/her particular situation, to the processing of personal data on the basis of the legitimate interests pursued by the controller.

In order to exercise the aforementioned rights, the user may contact the data controller by sending a written request to the addresses listed in paragraph 1 of this Privacy Policy. Regarding the newsletter, the user may oppose to the processing of their personal data for this purpose through the unsubscribe link available at the end of the received communication.

The user also has the right to submit a complaint to the National Data Protection Commission if he/she believes that his/her personal data rights on this Policy have been violated.

For any question related to this Privacy Policy, the user may also contact the EDP Data Protection Officer (DPO), whose contact details are:

• Email address: dpo.pt@edp.com

7.    Changes to the Privacy Policy

This Privacy Policy may be amended at any time by EDP. When these changes occur, they will be disclosed through the website and/or communicated to users through the contacts provided.

Date of last update: 31.05.2022