Privacy policy (edp.com)

Privacy policy

The EDP Group is committed to respecting users’ privacy and to protecting and safeguarding their personal data.

This text is intended to inform users of the website www.edp.com (the "User" and the "Website") about how their personal data is processed when they interact with EDP Group entities through the Website.

Users should carefully read this Privacy Policy and decide whether to provide their personal data before using the Website. Providing personal data implies that you have read and agree to the terms of this Privacy Policy.

This Privacy Policy should be read together with the Website’s Cookies Policy and Terms and Conditions (jointly, the “Contractual Documentation”). Should Users not agree to the Contractual Documentation, they must stop using the Website.

1. Scope of application and data controllers

Browsing the Website does not necessarily imply the provision of personal data (i.e., any information relating to an identified or identifiable natural person). However, the use of certain features – such as submitting contact requests or completing forms related to EDP Group activities and initiatives – will result in the collection of Users’ personal data. Therefore, depending on which EDP Group entity the User wishes to contact or which entity is providing the form, different data controllers may be involved.

With regard to entities that provide services or are based in Portugal, this Privacy Policy regulates the processing of Users' data by the following data controllers:

EDP S.A., registered with the Commercial Registry under unified registration and taxpayer ID number 500697256, with registered offices at Avenida 24 de Julho, no. 12, 1249-300 Lisbon, Portugal and with a share capital of €4,184,021.624 ("EDP");
Labelec - Estudos, Desenvolvimento e Actividades Laboratoriais S.A., registered with the Commercial Registry under unified registration and taxpayer ID number 503 326755, with registered offices at Rua Cidade de Goa, no. 4, 2685-038 Sacavém, Portugal and with a share capital of €2,200,000.00 (“Labelec”);
EDP Inovação S.A., registered with the Commercial Registry under unified registration and taxpayer ID number 507 988 760, with registered offices at Avenida 24 de Julho, no. 12, 1249-300 Lisbon, Portugal and with a share capital of €50,000.00 (“EDP Inovação”).

With regard to entities that provide services or are based in other markets, this Privacy Policy regulates the processing of Users' data by the following data controllers:

EDPR Australia Pty Ltd, registered with the Commercial Registry under unified registration and taxpayer ID number ACN 633 420 309, with registered offices at Level 4, 54 Marcus Clarke Street, Canberra, Act 2601, Australia, and with a share capital of AUD37,402,200;
EDP Renewables (Shanghai) Co., Ltd, registered with the Commercial Registry under unified registration and taxpayer ID number 91310000MA1FWDHC9B, with registered offices at Room 329, Building 3, No.161, Lane 465, Zhen Ning Road, Shanghai, and with a share capital of USD53,100,195.47;
EDPR Japan Co., Ltd., registered with the Commercial Registry under unified registration and taxpayer ID number 0104-01-113110, with registered offices at Harumi Island Triton Square Office Tower X25F, 1-8-10, Harumi Chuo-ku, Tokyo, and with a share capital of JPY204,970,000;
EDP APAC Pte. Ltd., registered with the Commercial Registry under unified registration and taxpayer ID number 201512402M, with registered office at 23 Rochester Park, #05-01, Singapore 139234 and with a share capital of SGD897,123,439.80;
Sunseap Taiwan Solar Holdings Ltd, registered with the Commercial Registry under unified registration and taxpayer ID number 50861806, with registered offices at 11F-3, No.508 Zhongxiao East Road, Section 5, Xinyi District, Taipei City, Taiwan, and with a share capital of NTD456,289,510;
Renewables Vietnam Company Limited, registered with the Commercial Registry under unified registration and taxpayer ID number 0316518567, with registered offices at 7th Floor, Pearl 5 Building, No. 5 Lê Quý Đôn Street, Võ Thị Sáu Ward, District 3, Ho Chi Minh City, Vietnam, and with a share capital of VND7,200,000,000.

Entities based in Portugal and entities based in other markets are jointly referred to as “EDP Group Entities”.

As a general rule, EDP acts as the data controller for most data collected through the contact points and forms available on the Website, except for the processing purposes set out below in Section 2. Users can verify the identity of the data controller by checking which entity is providing the relevant form.

2. Collecting and processing personal data

Any personal data collected is processed in strict compliance with the applicable legislation.

Users can find more information about the data collected, as well as the purposes and legal basis for processing, in the following table:

Purpose	Legal basis	Personal Data
Handling and responding to contact and information requests submitted via online forms	Legitimate interest of EDP Group Entities in managing and responding to contacts and information requests	Identification data, contact details, the message sent by the User, and any data provided in the form
Handling and responding to data subject rights requests submitted via online form	Compliance with legal obligation to which the data controller is subject	Identification details, contact details, the message sent by the User, and any data provided in the form
Managing and maintaining the Website	EDP's legitimate interest in managing and maintaining the Website operational and secure, or consent, as applicable	Data relating to the User’s interaction with the Website (such as the device’s IP address, the date and time the visit started and ended, browser history, or other information collected through cookies). For more information about this processing, please read our Cookies Policy
Analysing Website usage
Sending newsletters about EDP Group’s various activities	Legitimate interest of EDP Group Entities in sending the newsletter or consent, as applicable	Identification and contact details

The User represents and warrants that they are of legal age and that all information provided is true, accurate, complete, and up to date. The User acknowledges and agrees that they are solely responsible for any inaccuracies, omissions, or inconsistencies in such information. Where any data provided relates to a third party, the User represents and warrants that they have duly informed such third party of the contents of this document and have obtained all necessary authorizations to disclose their data for the purposes described above.

3. Retention Periods

Personal data will be retained in accordance with the purposes for which it is processed and with the applicable legal retention periods. Where no specific legal obligation applies, personal data will be kept only for the period that is appropriate and strictly necessary for the purposes for which it was collected, unless the User validly exercises their right to object, right to erasure or withdraws consent, as applicable. In the event of a dispute, pre-litigation or litigation, personal data may need to be retained for an extended period, until the corresponding proceedings are finally resolved. When determining the appropriate retention period, criteria such as the nature of the data, the purposes of processing and the need to comply with legal or regulatory obligations will be taken into account.

4. Recipients

The User's personal data may be disclosed to:

Other entities engaged to provide certain services that may involve access to the User's personal data. In such cases, any processor acting on behalf of the EDP Group entities will process personal data on their behalf, acting under their instructions and in accordance with the terms of the relevant data processing agreement entered into with those entities;
Third parties, when such disclosure is required or appropriate (i) under applicable law, (ii) to comply with legal obligations or court orders, (iii) to give effect to decisions or requirements of supervisory authorities, or (iv) to respond to requests from public or governmental authorities.

In all such cases, appropriate measures will be implemented to ensure the effective protection of personal data.

5. Data transfers to third countries

The processing of data for the purposes indicated in this Privacy Policy may involve its transfer to EDP Group entities established in countries outside the European Economic Area ("EEA"). These transfers are carried out: (i) when there is an adequacy decision by the European Commission for the country receiving the data; or in other cases, based on (ii) the implementation of appropriate safeguards, such as standard contractual clauses adopted by the European Commission, with additional measures to ensure that personal data enjoy a level of protection essentially equivalent to that of the European Union.

In addition, data collected while browsing the Website, namely through cookies and other similar technologies, may also be transferred outside the EEA if the User consents to the implementation of certain cookie categories (e.g., analytical or advertising cookies). These cookies are placed by third parties that may transfer personal data to countries that do not have an adequacy decision from the European Commission and that do not offer a level of personal data protection essentially equivalent to that of the European Union (e.g., the United States of America), as is the case with the web analysis and optimisation service "Google Analytics", provided by Google Ireland Limited. For example, sharing data with service providers outside the EEA (such as Google LLC) may result in disproportionate access to User data by government authorities and intelligence services in the country importing the data, or the inability to effectively exercise any applicable rights. For more information on the use of these cookies, please refer to our Cookies Policy.

If the User wishes to obtain further information on the processing of personal data outside the EEA, including the safeguards adopted for data transfers, they may contact the data controllers using the contact details provided in Section 7 of this Policy.

6. User rights

The User has the right to request from the EDP Group entity acting as a data controller access to their personal data, as well as its rectification or erasure, and the restriction of processing and data portability, pursuant to and within the limits established by law. The User also has the right to object to the processing of their data where it is based on the legitimate interests of the data controller, as well as to withdraw their consent, without affecting the lawfulness of processing carried out prior to withdrawal.

The User also has the right to lodge a complaint with the National Data Protection Commission (Comissão Nacional de Proteção de Dados) or another competent authority if they believe that their personal data has been processed unlawfully.

To exercise the above rights, the User may contact the applicable data controller at the addresses set out below in section 7. Users may further object to the processing of their personal data or withdraw their consent for the purpose of receiving newsletters, as applicable, directly through the unsubscribe link provided at the end of each communication.

Users may contact EDP's Data Protection Officer (DPO) at dpo.pt@edp.com for any questions related to this Privacy Policy or the processing of their personal data.

7. Contacts

EDP: Users may contact EDP regarding any matter related to this Privacy Policy through the following channels, indicating the subject "EDP, S.A. - Personal Data Privacy".

Postal Address: Avenida 24 de Julho, 12 1249-300 Lisbon;
Online form on edp.com, available here.

Labelec: Users may contact Labelec regarding any matter related to this Privacy Policy through the following channels, indicating the subject "Labelec - Personal Data Privacy".

Postal Address: Rua Particular à Rua Cidade de Goa, 2, 2685-038 Sacavém;
Email Address: dn.geral@edp.com.

EDP Inovação: Users may contact EDP Inovação regarding any matter related to this Privacy Policy through the following channels, indicating the subject "EDP Inovação - Personal Data Privacy".

Postal Address: Avenida 24 de Julho, 12 1249-300 Lisbon.
Email Address: edpinovacao@edp.com.

EDPR Australia Pty Ltd, Users may contact EDPR Australia regarding any matter related to this Privacy Policy through the following channels, indicating the subject "EDPR Australia - Personal Data Privacy".