Privacy Policy

You are here: / Privacy Policy

ITÍNERE INFRAESTRUCTURAS S.A. (hereinafter, ITÍNERE) hereby provides users of the website located at the URL www.grupoitinere.com (hereinafter, also referred to as the Website) with this Privacy Policy, for the purpose of providing information on how we process your personal data and protect your privacy and information.

ITÍNERE kindly requests that the user takes a few minutes to read this Privacy Policy carefully.

INTRODUCTION

This Privacy Policy applies to the ITÍNERE website, made available to the public at the URL www.grupoitinere.com, as well as to any interactions the user carries out with ITÍNERE through the said website.

ITÍNERE may modify this Privacy Policy whenever necessary. In the event that modifications are introduced, we will notify you through the website or via other means, so that you may become acquainted with the updated Privacy conditions. Continuing to use the features made available by ITÍNERE after having been notified of the aforementioned modifications shall imply your agreement to them, except in those instances where your express consent is legally required.

WHO IS THE DATA CONTROLLER FOR YOUR PERSONAL DATA?

The Data Controller is ITÍNERE INFRAESTRUCTURAS S.A., holder of Tax Identification Number (CIF) A28 200392, with its registered office at Bilbao (48013), Capuchinos de Basurto nº 6, Planta 4ª (hereinafter, ITÍNERE).

ITÍNERE has formally appointed a Data Protection Officer (DPO) and has also enabled the following dedicated communication channel: dpd@grupoitinere.com.

JOINT CONTROLLERSHIP AND LEGITIMATE INTEREST WITHIN THE CORPORATE GROUP

Please be informed that the various concession and service companies comprising the Itínere Group (hereinafter, and interchangeably, the “Group Companies”) act as Joint Data Controllers with respect to certain administrative management, commercial support, human resources, and internal operational activities. To this end, the Group Companies have entered into a Joint Controllership Agreement, pursuant to the provisions of Article 26 of the General Data Protection Regulation (GDPR), the essential content of which is detailed below:

  • Purpose of the Agreement: To regulate joint responsibility over the personal data processed in order to ensure unified, efficient, and secure management within the Group’s shared technological and operational infrastructure.
  • Allocation of Obligations: It has been determined that the corporate parent company centralises the implementation, maintenance, and supervision of technical and organisational security measures, as well as the global management of the Data Protection Officer (DPO). Conversely, each individual concession company remains directly responsible for the day-to-day processing of data directly linked to the operation of its respective road infrastructures and local contracts.
  • Lawful Basis (Legitimate Interest): The internal communication and exchange of your data between the Group Companies is based on the legitimate interest of the Controller (pursuant to Article 6(1)(f) of the GDPR and Recital 48 of the same legal text). This processing fulfills the legitimate interest held by the Itínere Group for the transmission of personal data within the business group for internal administrative purposes, resource optimisation, centralisation of IT systems, and the integrated management of customer or user services. A prior balancing test has been conducted to guarantee that this processing does not adversely affect your fundamental rights and freedoms.
  • Data Subject Requests: Irrespective of the terms of the agreement, you may exercise your rights of access, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection, and the right to object to processing based on legitimate interest before any of the Joint Controllers. However, to expedite your request, the Group has set up a single, centralised point of contact via our Data Protection Officer’s email address: dpd@grupoitinere.com.

Group Companies included in the Joint Controllership Agreement and their Registered Offices

The entities that take part in this joint processing and data exchange based on corporate legitimate interest are:

  • Itínere Infraestructuras, S.A. (Group Parent), with registered office at calle Capuchinos de Basurto, nº 6, Planta 4ª, 48013 Bilbao (Bizkaia). VAT number: A28200392.
  • Ena Infraestructuras S.A.U, with registered office at calle Poeta Joan Maragall, nº 1, Planta 11ª, 28020 Madrid. VAT number: A28920965.
  • Autopistas del Atlántico Concesionaria Española, S.A.U. (AUDASA), with registered office at calle Poeta Joan Maragall, nº 1, Planta 11ª, 28020 Madrid. VAT number: A15020522.
  • Autopista Concesionaria Astur-Leonesa, S.A.U. (AUCALSA), with registered office at calle Poeta Joan Maragall, nº 1, Planta 11ª, 28020 Madrid. VAT number: A28415784.
  • Autopistas de Navarra, S.A. (AUDENASA), with registered office at Autopista AP-15, Km 83 Sur, 31192 Tajonar (Navarra). VAT number: A31038771.
  • Autoestradas de Galicia, Autopistas de Galicia, Concesionaria de la Xunta de Galicia, S.A.U., with registered office at calle Alfredo Vicenti, nº 13, Planta 2ª, 15004 A Coruña. VAT number: A15508856.
  • Gestión de Infraestructuras Viarias de Bizkaia – Bizkaiko Bide Azpiegituren Kudeaketa, S.A. (GESBISA), with registered office at calle Capuchinos de Basurto, nº 6, Planta 4ª, 48013 Bilbao (Bizkaia). VAT number: A05354279.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

Personal data provided by users of this website will be processed by ITÍNERE to ensure user contact and website management. That is to say, the personal data of users who contact ITÍNERE through any of the communication channels made available on the website managed by ITÍNERE will be processed for the purpose of managing said contact, attending to requests received through them, rendering the required services, or providing the information requested by the user.

What data is processed by ITÍNERE and from which sources does it originate?

I. DATA ORIGIN AND COLLECTION CHANNELS

The personal data subject to processing by the companies of the ITÍNERE Group is integrated into the corporate information systems through a diversified multichannel ecosystem, classified into the following sources of origin:

1. Direct Provision Sources (Supplied directly by the data subject):

  • Integrated Digital Channels: Data provided by completing contact forms, employment portals, provider bidding/tendering portals, and customer/user service platforms hosted on the holding company’s web domains.
  • Compliance and Governance Channels: Data provided through the Internal Information System (Whistleblowing/Ethics Channel) formally designated before the Ministry of Justice, including statements, testimonies, and enclosed documentation.
  • Direct Communication Channels: Information submitted via postal communications, corporate electronic correspondence, centralised telephone calls, or any other enabled channel for institutional interaction.

2. Automated Generation and Technological Interaction Sources:

  • Browsing Metadata and Digital Audit: Data derived from browsing the Group’s web environments, including unique identifiers, activity logs, operational and analytical cookie usage, behavioural heatmaps, and visited sections.
  • Connectivity and Infrastructure Data: Public IP addresses, device telemetry data, operating systems, and estimated technical geolocation necessary for the perimeter security of digital assets.

3. Sources Derived from Legal and Contractual Relationships:

  • User/Customer Lifecycle Management: Data generated organically as a consequence of the development, processing, maintenance, billing, and auditing of the contractual, pre-contractual, or commercial relationship established between the data subject and any company of the Group.

4. Indirect and Third-Party Sources:

  • Legal Representation and Third Parties: Data collected when the user provides contact or identification information of third parties (employees of providers/suppliers, guarantors, beneficiaries, legal representatives, or corporate contact persons). The providing party assumes the legal obligation to have informed and obtained the prior consent of the said data subjects.

II. TAXONOMY AND TYPOLOGY OF PERSONAL DATA SUBJECT TO PROCESSING

Depending on the nature of the relationship (website user, customer, contractor, provider/supplier, or whistleinformer) and in accordance with the data minimisation principle, the ITÍNERE Group processes the following categories of information:

  • Identification and Contact Data: First name, surname, official identity document number (DNI/NIE/Passport), postal address (fiscal and billing address), corporate or personal telephone number, email address, handwritten or electronic signature, access credentials for corporate portals and, where applicable, photographic image or biometric/video surveillance records for security reasons within the firm’s infrastructures.
  • Personal Characteristics and Social Circumstances Data: Age, date of birth, sex, nationality, preferred language, and professional/academic data (in the case of candidates for recruitment processes or representatives of contractors and providers/suppliers).
  • Browsing, Digital Behaviour, and Preferences Data: Origin IP address, interaction history on the firm’s web platforms, consented configuration preferences (such as the use of cookies), session ID, and browser performance parameters.
  • Financial and Business Transaction Data: Banking data (account number/IBAN), billing details, payment history, linked contracts, and economic-financial data required for third-party due diligence (KYC).
  • Regulatory Compliance Data (Special Categories / High Sensitivity): Data strictly necessary associated with the investigation of reports within the framework of the Internal Information System (which in exceptional cases and in accordance with Law 2/2023, could reveal data of a criminal nature, administrative infractions, or data of special sensitivity under rigorous security measures).

What is the lawful basis for the processing of your data by ITÍNERE?

The ITÍNERE GROUP processes the personal data provided by the users of this website in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

The lawful bases that legitimize the different processing activities are applied depending on the nature of the interaction that the user establishes with the firm:

  • Performance of a legal relationship and handling of requests (Art. 6.1.b of the GDPR): The processing of personal data associated with the purpose of “Contact and management of website users” is strictly based on the management and processing of the relationship established at the request of the data subject. This includes the handling of their enquiry, the resolution of requests for information, the maintenance of direct contact between the parties and, where applicable, the provision and correct execution of the service or the pre-contractual measure that the user had formally requested.
  • Compliance with applicable legal obligations (Art. 6.1.c of the GDPR): In those cases where the user makes use of the spaces provided for regulatory compliance (such as the submission of disclosures through the Internal Information System / Whistleblowing Channel formally designated before the Ministry of Justice), the primary lawful basis will be compliance with the mandatory legal obligations imposed on the Group by Law 2/2023, regulating the protection of persons who report on regulatory infractions and the fight against corruption.
  • Explicit and informed consent (Art. 6.1.a of the GDPR): The processing of data derived from the storage and reading of non-essential cookies (analytical or personalisation cookies), as well as the voluntary submission of CVs/résumés through the employment portals made available by the Group, shall be unequivocally based on the free, specific, and affirmative expression of the user’s will when accepting such options.
  • Corporate legitimate interest (Art. 6.1.f of the GDPR): The processing of technical browsing data (such as the logging of IP addresses or connectivity metadata) is legitimised by the Group’s legitimate interest in guaranteeing the perimetric security of its digital assets, preventing fraud, correcting platform technical errors, and ensuring the correct functionality of the website.

To whom is your data communicated?

ITÍNERE hereby informs users that the processing of personal data disclosed in this Privacy Policy does not involve the communication or transfer of their data by the ENTITY to third-party entities.

For how long do we retain your data?

ITÍNERE will retain your personal data for the period necessary to render the requested service and/or to achieve the pursued processing purpose.

Subsequently, provided that the user has not exercised their right to erasure, their data will be retained for the statutory limitation periods applicable in each case, taking into account the typology of the data as well as the purpose of the processing.

What personal data must you provide us with in each case?

ITÍNERE informs users that when personal data is collected via a form made available through our website, it will be necessary for the user to provide at least those data marked with an asterisk (*). Failure to supply at least such data, which are deemed mandatory, will prevent ITÍNERE from managing the provision of the service or attending to the enquiry or claim submitted by the user.

What must you guarantee when providing your personal data?

The user guarantees that the data provided are true, accurate, complete, and up to date, and shall be held liable for any direct or indirect damage or harm that might be caused as a consequence of breaching such an obligation.

In the event that the user provides data belonging to a third party, they guarantee that they have informed the said third party of all the aspects contained within this Privacy Policy and have obtained their consent to provide us with their data for the relevant processing purpose. All of the above must be carried out prior to supplying third-party data through any of our websites.

ITÍNERE informs you that, in order to provide your personal data in any manner through our website, you must be over 16 years of age. Any user who provides data to the ENTITY via this website declares and guarantees that they are over 16 years of age, accepting full responsibility for such a declaration.

What measures do we adopt to protect your personal data?

In response to ITÍNERE’s commitment to guaranteeing the security and confidentiality of your data, the security levels required for the protection of personal data have been adopted, and the technical means within its reach have been installed to prevent the loss, misuse, alteration, unauthorised access, and theft of the personal data provided through the Website. Nonetheless, you must bear in mind that security measures on the Internet are not impregnable.

What are your rights regarding your personal data?

ITÍNERE informs you that you have the right to access your personal data and obtain confirmation as to how such data are being processed. Likewise, you have the right to request the rectification of inaccurate data or, where applicable, request its erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected by ITÍNERE.

Under certain circumstances, you may request the restriction of the processing of your data, in which case the ENTITY will only retain them for the establishment, exercise, or defence of potential claims.

Furthermore, also under certain circumstances, you may object to the processing of your personal data for the purpose informed by ITÍNERE. In that case, ITÍNERE will cease processing the personal data, unless compelling legitimate grounds concur, or to guarantee the establishment, exercise, or defence of potential claims.

Lastly, you may request the right to data portability and obtain for yourself or for another service provider certain information derived from the relationship formalised with the Entity.

Such rights may be exercised through the following channels, identifying the reference “DATA PROTECTION” in your request:

  • By post: By writing to ITÍNERE INFRAESTRUCTURAS S.A., for the attention of the Data Protection Officer, at the address Calle Poeta Joan Maragall, nº 1 Planta 11ª (28020 Madrid).
  • By email: By writing to the Data Protection Officer at the email address dpd@grupoitinere.com.

In both instances, proof of identity of the person exercising their rights is required by sending a copy of both sides of their DNI, NIE, Passport, or equivalent document.

ITÍNERE will provide the requested information within a maximum period of one month from receipt of the request. Said period may be extended by a further two months if necessary, taking into account the complexity and the number of requests.

You may lodge a complaint with the competent Supervisory Authority regarding data protection matters (the Spanish Data Protection Agency – AEPD). Nevertheless, in the first instance, you may submit a complaint to the Data Protection Officer, who will resolve the matter within a maximum period of two months.

V. 20/10/2026