1. Purpose and Scope of Application
This Data Protection Policy aims to inform users of the website https://www.kiwienergia.es/ (hereinafter, the “Website”) about how KIWI ENERGÍA, S.L., with registered office at Urb. Elviria Hills - Avda. Las Cumbres, s/n, ZIP 29604, Marbella (Málaga), and tax ID CIF B-75.821.363, processes personal data that may be collected through the Website, as well as about the rights granted to users under current personal data protection regulations. This policy applies to all personal data processing carried out through the Website, including but not limited to contact forms, newsletter subscriptions, user registration, online purchases, and any other data collection mechanisms enabled on the Website.

2. Data Controller
The data controller of personal data collected through the Website is KIWI ENERGÍA, S.L. For any matters related to data protection, users may contact the Data Protection Officer (DPO) at the email address luis@kiwienergia.es, or by written communication addressed to the company’s registered office.

3. Purpose of Data Processing
Personal data provided by users through the Website will be processed for the following purposes:

• To manage information requests, inquiries, or claims made by users through forms available on the Website.
• To manage user registration and access to private areas, where applicable.
• To process orders, purchases, or services requested through the Website.
• To send commercial, promotional, or informational communications, provided that the user has given their explicit consent.
• To manage subscription to newsletters or similar.
• To comply with the company’s applicable legal and contractual obligations.
• To improve user experience and Website functionality, including navigation analysis and the use of cookies, according to the specific cookie policy.

In all cases, data will be processed fairly, lawfully, transparently, and for specific, explicit, and legitimate purposes, without further processing incompatible with those purposes.

4. Legal Basis for Processing
The legal basis for processing users’ personal data is:

• The explicit consent given by the user by ticking the corresponding box in data collection forms and accepting this privacy policy.
• The execution of a contract in which the user is a party or the application of pre-contractual measures at the user’s request.
• Compliance with legal obligations applicable to the company.
• The legitimate interest of the company, where applicable, for improving the Website and customer service, provided that the fundamental rights and freedoms of the data subject do not prevail.

Users may withdraw their consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

5. Recipients of Data and International Transfers
Users’ personal data will not be disclosed to third parties, except where required by law, judicial order, or when necessary to provide services requested by the user, in which case the data subject will be properly informed. If the provision of certain services involves data processors (e.g., technology providers, hosting, logistics, etc.), the company will enter into the corresponding data processing agreements, ensuring these third parties comply with data protection regulations. No international data transfers outside the European Economic Area are foreseen unless expressly informed to the user and adequate guarantees are adopted according to applicable law.

6. Users’ Rights
Users have the right to:

• Access their personal data and obtain confirmation whether it is being processed.
• Request rectification of inaccurate or incomplete data.
• Request deletion of their data when, among other reasons, the data is no longer necessary for the purposes collected.
• Request restriction of data processing under certain circumstances.
• Object to data processing for reasons related to their particular situation.
• Request data portability, where technically feasible.
• Not be subject to automated decisions, including profiling, except where legally allowed.

To exercise these rights, users can contact the data controller through the means indicated in this policy. Users also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they believe their rights have been violated.

7. Data Retention
Personal data will be retained for the time necessary to fulfill the purpose for which it was collected and, where applicable, for the periods required by applicable law to address possible liabilities arising from the processing. Once these periods expire, data will be securely deleted.

8. Security Measures
The company has adopted the necessary technical and organizational measures to guarantee the security and integrity of personal data and to prevent alteration, loss, unauthorized processing, or access, according to the state of technology, nature of the stored data, and the risks involved.

9. Confidentiality
All company personnel and any third parties who may access personal data during service provision are subject to confidentiality and professional secrecy obligations regarding the processed information. This obligation persists even after the contractual relationship ends.

10. Use of Cookies and Similar Technologies
The Website uses cookies and similar technologies to improve user experience, analyze navigation, and offer personalized content. Users may consult the company’s Cookie Policy, which details the types of cookies used, their purposes, and how to manage or disable them. Cookie use requires the user’s express consent, except for those strictly necessary for the Website’s operation.

11. Changes to the Data Protection Policy
The company reserves the right to modify this Data Protection Policy at any time, in accordance with legislative or jurisprudential requirements, as well as industry practices. In case of changes, the new policy will be published on the Website, and user consent will be requested if required by applicable law.