Privacy Policy

Iridium Concesiones de infraestructuras, S.A., located at Avda. Camino de Santiago, 50 | 28050 Madrid – Spain, Tax ID No. A82452087, and telephone number 91 703 84 58 (hereinafter IRIDIUM), as the data controller responsible for processing your personal data, informs you about the processing of your personal data so that, among other things, you understand:

  • Why we need to process your data.
  • What data we may have about you and how we obtain it.
  • How long we retain it.
  • With whom we share it.
  • What your rights are in this regard and how you can exercise them.


IRIDIUM will process your data in full compliance with current data protection regulations, without subjecting it to fully automated decisions or profiling that could significantly affect you, and without using it for any purposes other than those outlined in this document.

BUSINESS PARTNERS

a) Purposes and legal basis for processing: Your data will be processed for the following purposes:

  • To execute, fulfill, and enforce compliance with the obligations and responsibilities arising from this contract (including accounting and tax obligations), and to manage the relationship between the parties, as this is necessary for the performance of the contract, as well as based on our legal tax and accounting obligations.
  • To send you communications related to special events, such as Christmas or birthday greetings, or, where applicable, messages of condolence, based on our legitimate interest in maintaining the most cordial relationship possible with our business partners in accordance with established social customs.
  • Exceptionally, should it be necessary, to defend the interests of each party, provide legal advice, and ensure compliance with applicable regulations (including internal policies), based on the legitimate interest both parties have in defending their rights and complying with the regulations (including internal policies) applicable to each of them.


b) Source and retention period of your data: The data has been provided to us by you or your legal representative. We retain it for as long as the contractual relationship with us continues and thereafter, duly blocked, for the period legally required for the defense or filing of potential claims.

c) Types of data: The types of data we use regarding you are of an identifying nature, corporate, personal characteristics, employment, activities, and business. Exceptionally, this may also include other types of information relevant to a potential incident, investigation, or claim (including, only if strictly necessary, data regarding criminal convictions and offenses).

d) Disclosure of your data: We may share your personal data with the following entities and/or individuals:

  • Public administrations, other public bodies, and entities authorized by law, when required or necessary.
  • Entities related to IRIDIUM (suppliers, partners, and advisors) for the performance of the contracted service.

In addition, with the following suppliers of ours, although exclusively to the extent required for them to provide their services to us:

  • Our cloud storage and office software providers.
  • Other providers that may supplement or replace the aforementioned.


e) International data transfers: In connection with projects outside the European Economic Area (EEA) that require it, we will transfer your personal data to companies and organizations outside the EEA, as this is necessary for the performance of the contract with you. Additionally, on an exceptional basis, we transfer personal data to courts, tribunals, arbitration courts, and mediators outside the EEA, exclusively if this is necessary for the establishment, exercise, or defense of legal claims, as the case may be.

POTENTIAL BUSINESS PARTNERS

a) Purposes and legal basis for processing: Your data will be processed for the following purposes:

  • To send you proposals or communications aimed at establishing a business relationship, based on the pre-contractual relationship we have with you.
  • To send you communications related to special events, such as Christmas or birthday greetings, or, where applicable, messages of condolence, based on our legitimate interest in maintaining the most cordial relationship possible with our contacts in accordance with established social customs.
  • To fulfill our obligations regarding regulatory compliance (data protection, criminal law, etc.) based on our legitimate interest in doing so and in securing the appropriate means of evidence, as well as because it is required by legal obligations applicable to us.

b) Source and retention period of your data: The data has been provided to us by you or your legal representative, and we retain it as long as you do not object to its processing and the relationship with you continues; subsequently, it is duly blocked for the period legally required for the defense against or filing of potential claims.

c) Types of data: The types of data we use from you include identifying information, contact details, academic and professional information, and employment information. Very rarely, we may also process other types of information that are relevant to a potential incident, investigation, or claim.

d) Disclosure of your data: We may share your personal data with:

  • Public administrations, other public bodies, and entities authorized by law, when required or necessary.
  • Entities related to IRIDIUM (suppliers, collaborators, and advisors) for the performance of the contracted service.
    In addition, with the following suppliers of ours, although exclusively to the extent required for them to provide their services to us:
  • Our cloud storage and office software providers.
  • Other providers that may supplement or replace the aforementioned.


e) International data transfers: None are planned.

SUPPLIERS

a) Purposes and legal basis for processing: Your data will be processed for the following purposes:

  • The management and supervision of our relationship with our suppliers and partners, including accounting and tax management, based on the performance of the contract and the legal obligations applicable to us.
  • To send you communications related to special events, such as Christmas or birthday greetings, based on our legitimate interest in maintaining the most cordial relationship possible with our clients in accordance with established social customs.
  • To comply with our obligations regarding regulatory compliance (data protection, criminal regulations, etc.) based on our legitimate interest in doing so and in securing the appropriate means of evidence, as well as due to legal obligations applicable to us.


b) Source and retention period of your data: The data has been provided to us by you or your legal representative or by other sources (third-party recommendations, advertising spaces, or through your corporate website). We retain it for as long as you maintain a contractual relationship with us and thereafter, duly blocked, for the period legally established for the defense or filing of potential claims.

c) Types of data: The types of data we use regarding you include identifying information, corporate data, personal characteristics, employment details, and information about your activities and business. Very rarely, we may also process other types of information that are relevant to a potential incident, investigation, or claim.

d) Disclosure of your data: We may share your personal data with the following entities and/or individuals:

  • Public administrations, other public bodies, and entities authorized by law, when required or necessary.
  • Entities related to Iridium (suppliers, business partners, consultants, etc.) for the performance of the contracted service.
    In addition, with the following suppliers of ours, although exclusively to the extent required for them to provide their services to us:
  • Our cloud storage and office software providers.
  • Other suppliers that may supplement or replace the aforementioned ones.


e) International data transfers: In connection with projects outside the European Economic Area (EEA) that require it, we will transfer your personal data to companies and organizations outside the EEA, as this is necessary for the performance of the contract with you. Also, on an exceptional basis, we transfer personal data to courts, tribunals, arbitration courts, and mediators outside the EEA, exclusively if this is necessary for the establishment, exercise, or defense of claims, as the case may be.

LEGAL REPRESENTATIVES AND THIRD-PARTY CONTACT PERSONS

a) Purposes and legal basis for processing: Your data will be processed for the following purposes:

  • The management and development of the relationship we maintain with third parties, whether individuals or legal entities, through their legal representatives and, where applicable, contact persons, based on our legitimate interest in maintaining an appropriate relationship with such third parties.
  • To send you communications related to special events, such as Christmas or birthday greetings, or, where applicable, messages of condolence, based on our legitimate interest in maintaining the most cordial relationship possible with you in accordance with established social customs.
  • To fulfill our obligations regarding regulatory compliance (data protection, criminal regulations, etc.) based on our legitimate interest in doing so and in securing the appropriate means of evidence, as well as because it is required by legal obligations applicable to us.


b) Source and retention period of your data: The data has been provided to us by you or your legal representative or by other sources (the company for which you provide services). We retain it for as long as the relationship we maintain with the entity for which you provide services or work remains in effect, and subsequently, duly blocked, for the period legally established for the defense or filing of potential claims.

c) Types of data: The types of data we use include your identifying information, contact details, and, where applicable, the nature of your representation. Very rarely, we may also process other types of information that are relevant to a potential incident, investigation, or claim.

d) Disclosure of your data: We may share your personal data with government agencies, other public bodies, and entities authorized by law, when required or necessary.

In addition, we may share your data with the following service providers, but only to the extent necessary for them to provide their services to us:

  • Our cloud storage and office software providers.
  • Other providers that may supplement or replace the aforementioned ones.


e) International data transfers: In exceptional cases, we may need to transfer your personal data to courts and tribunals or other dispute resolution bodies, law enforcement agencies, attorneys, experts, notaries, and registrars outside the European Economic Area, if this is necessary for the formulation, exercise, or defense of claims.

JOB APPLICANTS

a) Purposes and legal basis for processing: Your data will be processed for the following purposes:

  • Management of recruitment processes, based on a legitimate interest in selecting personnel to fill job positions and/or on the application submitted by the candidate.
  • Additionally, and only where applicable, we will also process your data for control and security purposes, legal advice, and regulatory compliance, as this is necessary to satisfy our legitimate interest in defending our interests and rights, in preventing conduct contrary to our internal codes and regulations, and to comply with legal obligations applicable to us (auditing, compliance with criminal regulations, protection of personal data, etc.)…).


b) Source and retention period of your data: The data has been provided to us by you or your legal representative or by other sources (platforms such as LinkedIn or talent search firms). We retain it for 1 year from receipt of the application, resume, or candidate’s background, unless it is needed for a longer period to formulate or defend potential claims or to investigate possible irregularities or criminal acts.

c) Types of data: The types of data we use regarding you include identifying information, contact details, academic and/or professional information, employment history, or any other data you provide to us either directly or through your resume. Very rarely, we may also process other types of information that are relevant to a potential incident, investigation, or claim.

d) Disclosure of your data: We may share your personal data with government agencies, other public bodies, and entities authorized by law, when required or necessary, as well as with other companies within the IRIDIUM Group if you have requested or consented to such sharing.

In addition, our auxiliary service providers (data storage, office automation, IT infrastructure, and information security) may also access your personal data to the extent that they provide such services to us.

e) International data transfers: None are planned.

SOCIAL MEDIA CONTACTS

a) Purposes and legal basis for processing: Your data will be processed to interact with you on our social media platforms. This processing will always take place within the context of the relevant social media platform and in accordance with and based on its Terms and Conditions.

b) Source and retention period of your data: Your personal data will be the information you have provided to the social media platform and will only be used within that platform in connection with your interactions with IRIDIUM through the mechanisms available on the platform.

This processing will continue for as long as you interact with us through the mechanisms available on the respective social media platform, such as the “follow,” “connect,” “like,” or similar buttons.

c) Types of data: The types of data we use from you are identifying information, contact information, and any data you voluntarily choose to provide to us through the social media platform.

d) Disclosure of your data: We will not share your data with third parties. However, please note that the social networks themselves will process your personal data for their own purposes, including allowing you to use that social network or platform, and that they may disclose your personal data to third parties.

For more information, please refer to the privacy policy of the relevant social media platform.

e) International data transfers: We will not disclose your data to third parties outside the European Economic Area. However, please note that the platform through which you interact with us may do so.
For more information, please refer to the privacy notice of the relevant social media platform.

WEB USERS

a) Purposes and legal basis for processing: Your data will be processed for the following purposes: Installation of cookies in your browser for analytical purposes (performance or analytics cookies), to show you advertising based on your browsing habits, and to allow you to customize certain elements of the website (preference or personalization cookies), subject to your prior consent or request, as well as for technical purposes necessary for the proper functioning of the website based on our legitimate interest in doing so. Regarding cookies, in addition to the information provided here and below, you can find additional details in our Cookie Policy, which you can view at https://iridiumconcesiones.com/cookie-policy/.

Recording and processing of communications or requests received via the contact form and email address published on the website for this purpose (info@iridium-acs.com) based on our legitimate interest in properly serving our website users.

b) Source and retention period of your data: The data has been provided to us by you or your legal representative. Data obtained, where applicable, through cookies is retained for the period specified for each cookie or type of cookie in our Cookie Policy. Regarding the data you provide when sending us an email, it will be retained until the received communication has been definitively addressed and subsequently, duly blocked, for the period legally established for the defense and filing of potential claims.

c) Types of data: The types of data we use from you include identifying information, contact details, and any other information you provide through the communication you send us; and, in the case of cookies, identifying information (visitor ID), data regarding the device from which you access our website (such as the IP address and browser used), and browsing habits and preferences.

d) Disclosure of your data: Your data will be shared with the cookie providers listed in our Cookie Policy.

e) International data transfers: Our cookie providers may process your data in accordance with the information provided in their respective privacy policies, which you can find in the Cookie Policy and which we recommend you review.

Google, as the provider of Google Analytics and YouTube cookies, processes the information collected through these cookies in the United States; however, this company is currently a signatory to the Privacy Shield Framework, under which it is recognized as having an adequate level of data protection. You can access the European Commission’s Decision at https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj and Google’s inclusion on the list of companies adhering to this framework at https://www.dataprivacyframework.gov/list

Some of our other providers may be located and/or process your personal information in territories outside the European Economic Area that have not been recognized by the European Commission as having an adequate level of protection. In such cases, depending on the cookie provider, the jurisdiction in which it is located, and ability to control and make decisions regarding the information obtained through cookies, IRIDIUM will ensure the implementation of appropriate safeguards for international data transfers (Standard Contractual Clauses approved by the European Commission). You may request additional information about these safeguards as indicated in the “Contact” section of this policy.

You are required to provide us with the data that, as described for each category of individuals, is necessary for purposes based on the performance of a contract we have with you or for compliance with legal obligations. In these cases, if such data is not provided, we will not be able to process your request or perform the corresponding contract in whole or in part.

When selecting suppliers whose services involve the processing of personal data under our control, IRIDIUM applies strict criteria to choose only those that offer an adequate level of safeguards for this purpose. Likewise, we contractually require them to adopt the technical and organizational measures necessary to ensure the protection of the rights and freedoms of the individuals whose information is processed and to use personal data only to the extent strictly necessary based on the service they provide to us and the duration of said service.

If you would like more detailed information about our suppliers or the recipients of your data, you may contact us at the addresses listed under the heading “Contact Information.”

You have the right to obtain information about the processing of your data, to access it, to have it corrected, or, where appropriate, deleted. In certain circumstances, you also have the right to restrict the processing of your data, in which case we will only retain it for the exercise or defense of claims; to object to our processing of it; and to data portability, whereby we will transmit it to you or directly to another company you designate.

Withdrawal of consent: With regard to the processing of your data that we carry out based on the consent you have provided, you have the right to withdraw that consent at any time; however, such withdrawal will not have retroactive effect, meaning it will not affect the processing that has taken place up to that point.

You may exercise your right to object to the purposes described above that are based on the fulfillment of a legitimate or public interest. However, this right may be denied if, in light of the request made, it is determined that compelling legitimate grounds for the processing prevail or if the data is necessary for the establishment, exercise, or defense of legal claims.

To exercise any of these rights, you may contact IRIDIUM at the postal address Avda. Camino de Santiago, 50 | 28050 Madrid – Spain or via email at lopd@iridium-acs.com.

Furthermore, we inform you that if you believe there has been any violation regarding the processing of your personal data, you may file a complaint with the competent supervisory authority (in Spain, the Spanish Data Protection Agency or any body that may replace it in the future; for other European countries, please check here).

For additional information, or for any other questions regarding the processing of your data, please do not hesitate to contact our Data Protection Officer via:

Mailing Address: Avda. Camino de Santiago, 50 | 28050 Madrid – Spain

Email: lopd@iridium-acs.com

Current version dated April 17, 2026.