PRIVACY POLICY
TELEFÓNICA OPEN INNOVATION S.L.U.

At Telefónica we are committed to respecting the privacy, secrecy and security of the personal data of our employees, customers and suppliers. Our approach to respecting and protecting the privacy of the personal data we process extends beyond legal compliance requirements. It is our priority, it is part of our DNA and we reflect it in the principles that govern our privacy and security policies. 
This Privacy Policy establishes the guiding principles and the way in which the Personal Data of the users of the web pages of Telefónica Open Innovation, S.L.U. For more information on the procedures underpinning this Policy, please contact privacidad@wayra.com.

You are the only one who can control how your data is used. We provide you with the tools so that you can decide at any time how you want us to handle your data, up to when and how you can access and update.

We take care to ensure the security, secrecy and confidentiality of your data and personal information. We have carried out the necessary analysis and risk assessments in accordance with the best security and privacy standards in order to implement the most stringent and robust security.

‍‍ It is a company of the Telefonica Group, located in Spain, responsible for promoting innovation and local entrepreneurship of disruptive technological projects, through different projects that are developed in Spain, Latin America and Europe Our corporate name is Telefónica Open Innovation, S.L.U, company with identification number B86230562 and registered office at Ronda de la Comunicación, SN, (28050), Madrid, España. Then we will define Telefónica Open Innovation as "Telefónica" or "we".

‍‍ Telefónica Open Innovation, S.L.U. (hereinafter "Telefónica" or “we”), company with ID number B86230562 and registered office at Ronda de la Comunicación, SN, (28050), Madrid, will be the data controller for the processing of your data in accordance with what we inform you in this Privacy Policy. If you have any queries, requests or complaints regarding the content of this Privacy Policy and our processing of your data, you can contact us at privacidad@wayra.com.
 We also inform you that we have a Data Protection Officer who ensures compliance with data protection regulations at Telefónica, and who can be contacted for any questions, queries and/or complaints you may have when we process your data, by writing to DPO_telefonicasa@telefonica.com.

Data we process about you
As a User, we process different data about you and for different purposes on appropriate legal bases, either because these purposes are necessary based on the execution of the General Conditions and/or Legal Bases, accepted by the User at the time of registration, which constitute a legal relationship between the User and us, and in respect of which this Privacy Policy forms an integral part; because we pursue legitimate interests that are duly balanced so that they do not affect your rights and freedoms, and in accordance with these; or because certain legal obligations apply to us that require us to process data about you as a result of your use of the Webpages. In any other case, we will request your consent to the processing of your data for a specific duly informed purpose.
These are the data that we process about you:

• Basic, identifying, contact and/or professional data: full name, birthday date, email address, telephone number, place of residence, curriculum vitae, workplace, academic education, social networking profile, and any other basic or identifying information, filled in the User profile or in the contact forms.
• Access credentials and identifiers assigned to the User.
• Data relating to queries, support, complaints and/or suggestions.
• Statistical data of use and interactions of the User with the webpages.
• Data relating to the device and/or connection with which the webpages are accessed: connection metadata, as well as information that we may have obtained through the use of cookies and similar technologies (SDKs, pixels, tags, beacons, etc.).

Origin and source of your data
In general, we obtain the data either directly from you, when you fill in the registration and contact forms, make an enquiry, complaint or suggestion, or contact us by any means and provide us with the required or voluntary data; or we may generate or capture them automatically during registration, during the process of creation of User or during the use of the Webpages, in accordance with the operational functioning and/or functionalities existing at any given time. All information you provide as a User must be truthful and accurate. To this end, the User warrants the authenticity of all data provided as a result of filling in the corresponding forms. The User shall be solely responsible for any false or inaccurate statements made, and for any damage caused to Telefónica, or to third parties, in relation with the information provided. In the event of the provision of false data or data that do not correspond to the account holder, Telefónica reserves the right to cancel the User’s account and/or to take measures as it deems appropriate for the best defence of its interests and rights, or those of affected third parties who may be affected as a result of the foregoing. Telefónica reserves the right to verify the information provided by the User by any means that may be appropriate for the purposes of control and/or verification, depending on the state of the art at any given time and what is most appropriate for the protection of the interests and rights of the parties involved.

Purposes we pursue and reasons we have for processing your data
The purposes for which we process your data as a User are as follows:

i. Provision of the service and all the functionalities available, the operation, administration, support and maintenance of the Webpages: based on the performance of the General Conditions of the services and the Legal Bases of the programmes and calls, we will process your data for the purpose of providing you with the services, allowing you to enjoy all the functionalities available at all times, operate and maintain it so that the webpages function correctly and securely, or, where appropriate, withdraw or block your access to the service, which includes allowing us to check the requirements demanded of the User, User’s compliance with the General Conditions and/or Legal Bases, proceed with or facilitate the registration of the User and, where appropriate, the updating of their data, their access and use of the webpages at any time, among other similar purposes in execution and compliance with all the points incorporated in the General Conditions or Legal Bases, all while keeping the condition of User and not requesting cancellation.

ii. Commercial communications – Newsletter: based on your consent provided through your request, we may send you commercial communications including information on our programmes, field and other topics related, as well as activities, ours or from third parties, all while keeping your consent and not requesting cancellation.

iii. Internal management and response to claims, demands, complaints and litigation related to Webpages : based on our legitimate interest associated with the right to effective judicial protection that protects us, we may process your data to manage, respond and act as an interested party or similar in administrative or legal proceedings, when these, in any way, are related to you or refer to you in the corresponding capacity.

iv. Compliance with applicable regulations and response to requirements and official requests made by the authorities: in general, as any actor providing information society services and data controller, various legal obligations apply to us, including consumer obligations, data protection and security, digital services and markets, as well as mandatory collaboration with the competent authorities, including law enforcement agencies. Based on the foregoing, we may need to process your data in order to fulfil such obligations, for example, to respond to data protection rights exercises we receive, or to respond to legitimate subpoenas or requests made to us that require, for example, that we provide information about you.

v. Attention and response to contracting requests, queries, enquiries, suggestions and any other type of contact received: based on our legitimate interest in managing and providing an effective response to the request or other type of contact made by a User of the Webpages, as well as to the extent necessary for the performance of pre-contractual measures at the request of the User aimed at the acceptance of the General Conditions or the Legal Bases, we may process the data of the person who contacts us in order to provide an effective response in accordance with the contact made, to respond to the suggestion to correct or improve the Webpages service in the manner proposed or, where appropriate, to inform about the commercial conditions of the programmes and calls and to enter into a contractual relationship for this purpose.

vi. Management of investment, stakeholders, suppliers, clients and other partners: based on our legitimate interest in managing the relation with Telefónica’s partners, we will process your data in order to promote and improve their investments.

vii. Statistical analysis of the Webpages: based on our legitimate interest to measure the quality of service of the Webpages, as well as to know how it is used by the Users, we may perform appropriate statistical analyses with Webpages usage data in order to: (1) measure the quality of service and, in the event of degradation, take the necessary measures to prevent and/or remedy such degradation; and (2) make better business decisions regarding the future evolution of the Webpages, as well as improvements or evolutionary corrections that, if necessary, must be made to offer a suitable experience.

viii. Maintenance of the activity and security of the Webpages, prevention of information security breaches and eventual breaches: based on our legitimate interest, as owner and responsible for the Webpages, in ensuring their availability and security for all Users, and in accordance with the General Conditions, the legal notices and other relevant notices of use, as well as with the provisions of our cookie policy and the cybersecurity regulations applicable to Telefónica (Royal Legislative Decree 12/2018, Royal Legislative Decree 7/2022 on 5G security, etc.), we will process your data in order to maintain active and manage the security of the Webpages, and enable an ongoing and free access in a secure manner by all Users.

In general, we will keep your data for the period necessary to comply with each of the purposes described in each processing activity and to determine the possible liabilities that may arise from that purpose.

The data will be kept for the essential and necessary time to enable you to correctly browse and use our Webpages and the content available through them, to which you access as a User and, where appropriate, as long as you do not unsubscribe as a User.

The data will be kept for the essential and necessary time to provide you with the requested commercial communications and as long as you do not unsubscribe.

Internal management and response to complaints, claims, reports and litigation related to the Webpages.

For the time necessary for the possible identification of the parties responsible arising during the processing of the data, always in accordance with the applicable regulations and not being used for purposes other than these.
Compliance with applicable regulations and response to subpoenas and official letters from the authorities.

Attention and response to contracting requests, queries, enquiries, suggestions and any other type of contact received.

For the time necessary to correctly deal with your requests and/or specific requests on a case-by-case basis. If they consist of the performance, at your request, of pre-contractual measures or the signing of a contract with Telefónica, your data will be kept for as long as necessary to give due satisfaction to such pre-contractual measures or contractual relationship between the parties.
Management of investment, stakeholders, suppliers, clients and other partners.

We will process your personal data for this purpose for as long as you have not objected to the processing based on Telefónica’s legitimate interest and provided that such objection is considered in the circumstances that you communicate. However, even if you have not objected to this processing, we will only keep your data for this purpose for a maximum period of 48 months after collection.

Statistical analysis of the Webpages.

We will process your personal data for this purpose for as long as you have not objected to the processing based on Telefónica’s legitimate interest and provided that such objection is considered in the circumstances that you communicate. However, even if you have not objected to this processing, we will only keep your data for this purpose for a maximum period of 48 months after collection.

Maintaining the activity and security of the Webpages, preventing information security failures and eventual breaches.

We will process your personal data for this purpose for as long as you have not objected to the processing based on Telefónica’s legitimate interest and provided that such objection is considered in the circumstances that you communicate. However, even if you have not objected to this processing, we will only keep your data for this purpose for a maximum period of 48 months after collection.

Once the aforementioned retention periods have expired, we will block your personal data during the period of limitation of legal actions and, once this period has expired, we will proceed with its definitive erasure in accordance with the applicable regulations, and/or to its secure anonymisation by Telefónica.

‍ Third parties who may access, receive and process your data

On a general basis, for the provision of the service and to carry out the processing purposes described above, we may make use of authorised subcontractors acting on behalf of Telefónica, as data processors (e.g. internet service providers, data hosting and technical support providers, platform providers, e-mail providers, security service providers, etc.) and contractually subject to our instructions, only insofar as they are strictly necessary for the provision of the contracted services and only for the period of time strictly necessary for that purpose.

We may also disclose your data with third parties who have a contractual relation with Telefónica and who will process your data for the purposes of dissemination, provided that you have given your consent through any of the forms provided and for as long as you do not withdraw such consent.

In addition, in the event that there is a legal obligation or requirement to do so, we may disclose your data to the competent public administrations in accordance with said legal obligation or requirement and, where appropriate, also to other bodies such as the State Security Forces and Corps and the justice system.

Finally, you need to be aware that, when the authorised subcontractors acting on behalf of Telefónica or the above-mentioned recipients are located or process your data outside the European Economic Area, we will be making an international transfer of your data in accordance with the provisions of data protection law. In general, we avoid making international transfers and your data are processed within the European Economic Area, but sometimes we cannot avoid it or it is strictly necessary for you to benefit from the use of the MarketPlace and all its functionalities described in the General Conditions. Furthermore, in the event that we do in fact conduct an international transfer of your data, we assure you that we will take such organisational, technical and contractual measures as may be necessary to ensure the protection and security of your data, such as, for example, signing the European Commission’s Standard Contractual Clauses with the authorised subcontractor or third-party transferee, carrying out impact assessments on the international transfer in question to assess the risk and take measures to mitigate it, encryption of data in transit or at rest, pseudonymisation of the data subject to the international transfer, our best endeavours to ensure you have the possibility to claim damages directly against the authorised subcontractor or recipient of your data located in a third country, etc. In any case, we are at your disposal at the mailing address for exercising your rights as indicated in section 6 of this Privacy Policy, and through which you can obtain more information on the guarantees and measures applied and provided for in the applicable regulations.

Your rights

As a User, data protection regulations grant you certain rights over your data which, depending on how they apply, you may exercise against Telefónica. Here’s what they are and how you can exercise them. We also inform you that on the website of the Spanish Data Protection Agency (www.aepd.es) you can find more information on the characteristics of these rights and download templates for exercising each of them.

• Right to withdraw consent. This is your right to withdraw your consent to the processing of your data for the purposes that are legitimate on that basis, at any time and in an easy way.

• Right of access. It is your right to ask us for details of the data we hold about you and how we process it, and to obtain a copy of it.  
• Right of rectification. It is your right to obtain the rectification of your inaccurate or erroneous data, as well as to complete incomplete data.
• Right of erasure. It is your right to request deletion or suppression of your data and information in certain circumstances. However, please note that there are certain occasions when we are legally entitled to continue to store and process your data, for example, in order to comply with a legal obligation to retain data.
• Right of restriction. It is your right to restrict or limit the processing of your data in certain circumstances. For example, if you apply for deletion of data, but instead of deleting it, you would prefer that we block it and process it only for retention purposes because you will need it later to make a complaint. Again, please note that there may be times when we are legally entitled to refuse your request for a restriction.
• Right to object. It is your right to object to our processing of your data for a specific purpose, in certain circumstances provided for by law and related to your personal situation.
• Right to portability. It is your right to ask us to receive your personal data in a structured, commonly used, machine-readable and interoperable format and to transfer it to another data controller, provided that we process your data by automated means.
• The right to not be subject to automated individual decisions. This is your right to ask us not to subject you, in certain circumstances, to a decision based solely on automated processing of your data, including profiling, that produces legal effects concerning you or similarly significantly affects you.

In general, you may exercise these rights at any time and free of charge by contacting Telefónica at privacidad@wayra.com. Likewise, in general, mechanisms for the automated unsubscription of communications and other options for withdrawal of consent and opposition will be made available to the User.

It is important to bear in mind that when you exercise a right, in some cases, you must clearly specify which right you are exercising and provide a copy of a document proving your identity. It should also be noted that some of the data processing is carried out by Telefónica in a way that does not require the direct identification of the Users, without Telefónica being obliged to obtain and/or process additional information to verify the User for the purposes of enabling the data subject to exercise his/her data protection rights.

In the event that a User exercises a data protection right and, due to the reasons indicated, Telefónica is not in a position to identify him or her in order to deal with the request, it will inform him or her to that effect if possible. Such a request shall be suspended until such time as the User provides additional information enabling him or her to be identified.

Any exercise of rights shall be answered within a maximum period of one month, which may be extended by two months if we need to do on a reasoned basis, taking into account the complexity of the request and the number of requests.

Finally, in the event that you do not agree with the way in which your data is handled by Telefónica, you have the right to lodge a complaint with the national supervisory authority by contacting the Spanish Data Protection Agency (AEPD, by its initials in Spanish), whose contact details are as follows:

‍ Telefónica reserves the right to update this Privacy Policy at any time. Any such update will be made public by Telefónica, in any event, with such notice prior to its entry into force as is legally required. In addition, it shall be communicated directly to the User where it affects his or her rights or freedoms or where, for example, the inclusion of a new processing activity would require the User’s consent or changes the scope of the legitimate interest that enables the processing to be carried out. 

Date of publication: December 2022