Privacy policy

1. Data Controller 

The controller of personal data is the CORPORACIÓN DE RESERVAS ESTRATÉGICAS DE PRODUCTOS PETROLÍFEROS (hereinafter, “CORES”, the “Data Controller” or the “Controller”), with registered address at Paseo de la Castellana n.º 79 – Planta 7ª. Madrid (28046) and N.I.F. (Tax Code) Q-2870025-J.

2. Data Subjects’ Rights. Withdrawal of consent

In accordance with current data protection legislation, you may exercise various rights with the Data Controller:

• Demand access to your data and obtain a copy.  
• Request their rectification and/or deletion in certain cases. 
• Oppose the production of personalized profiles.  
• Request that we limit the processing of your data. 
• Request the portability of the data you have supplied when you sign an agreement with us. 

To exercise these rights, please contact us via the following: 

• By email 
• By post to Paseo de la Castellana n.º 79 – Planta 7ª. Madrid (28046).

In the case of processing conducted through the InfoCores service, you may also exercise your rights using the tool included on InfoCores. 

In regard to the processing based on your consent, you may contact CORES to withdraw this consent at any time using the methods indicated above. 

In all events, as a data subject or affected party, you may present all complaints you consider justified with the Spanish Data Protection Agency (www.aepd.es). 

1. Processed data categories

The following data may be collected from users of the Website: 

• Identification details (full name). 
• Contact details (email and telephone number).
• Other personal details contained within the user’s message. 

2. Purposes of processing and basis of legitimization

The purpose of processing in each case is to adequately attend the request received via the form: 

• Managing your enquiries made via the Contact Form. 
• Managing your application for registration with the Subscription service and supplying the service.

In both cases, the legitimate basis for the processing of your data is the consent you provide when filling in and sending us the Contact Form. We remind you that you may withdraw your consent at any time in accordance with the terms of section 2. “Data subjects’ rights. Withdrawal of consent.”. 

3. Conservation Period

The data related to the Contact Form will be kept as long as necessary to process the enquiry or request made. Once the enquiry or request has been dealt with, we will keep your personal data on file for an additional period of six years for the purposes of legal compliance on the part of CORES. At the end of this period, CORES will proceed to delete your personal data. 

The data for the Subscription service will be kept until the user requests the cancellation of the service. 

4. Recipients of the data 

Your personal data may be consulted by the various departments under the charge of the Controller which are involved in the processing of the request or the provision of the Subscription service. 

In addition, for the provision of the various services offered on the Websites, CORES contracts various suppliers who may have access to your data. These service providers, entrusted by CORES for data processing management, may change over time. In all events, the Controller guarantees that all processing managers comply with the appropriate security measures and adhere to CORES instructions. CORES does not make any international transfers of personal data. 

1. Processed data categories 

CORES will process the personal data of the Authorized Users provided by the Obligated Entity in order to process the corresponding registration and allow professional contact in the event of incidents or in the course of normal InfoCores use. This data includes the following: 

• Full name.
• Details listed on the Passport, DNI or equivalent ID document.  
• Address, email and telephone number, preferably those of the company.  
• Position held or professional relationship with the Obligated Entity.
• User name, access and login password for operations performed on InfoCores. 
• Information contained on the digital certificate used to access the area restricted to members.   

2. Purposes of processing and basis of legitimization 

The data of Authorized Users is processed, in their capacity as contact persons for the Obligated Entities, for the purpose of exchanging information between the latter and CORES in order to comply with the requirements imposed under Law 34/1998, of the 7th October, on the hydrocarbons sector and Royal Decree 1716/2004, of the 23rd July, regulating the obligation to maintain minimum security stocks, the diversification of natural gas supply and the role of the Corporation.  

The processing of the personal data of the Authorized Users is conducted on the following legal basis: 

• Compliance with the requirement for the Obligated Entities to provide information to CORES as defined under the aforementioned legislation.  
• The legitimate interest of CORES in managing and complying with aforementioned statutory obligation. CORES will not use your personal data for any purpose other than maintaining the corresponding relations with the Obligated Entity of which you are the representative or authorized person.  
• The existence of a legal relationship demonstrated by the acceptance of the InfoCores Conditions of Use on the part of the Obligated Entity.

3. Conservation period 

CORES will process the personal data of the Authorized Users as long as the latter continue to hold such a position (in other words, until either the Authorized User or the Obligated Entity cancel their registration with InfoCores via the established procedures). Once the user’s registration has been cancelled, CORES will keep their personal data on file for an additional 6 years in compliance with legal requirements. After this time, no further information on the Authorized User will be kept on structured databases. However, your personal details may be included in various documents which form part of non-structured repositories of information which need to be kept for longer periods (for example scanned copies of powers of attorney).   

4. Recipients of the data

Your personal data may be consulted by the various departments under the charge of the Controller which are involved in the processing of InfoCores. In the same manner, the Obligated Entity on whose behalf the Authorized User accesses the platform may consult the InfoCores user information at any time. 

In the course of providing the various services offered on the Websites, CORES contracts various suppliers who may have access to your data. The Controller guarantees that all processing managers comply with the appropriate security measures and adhere to CORES instructions.

Authorized User data may be passed on to the Courts, Judges and competent Public Administration departments in accordance with applicable legislation or when CORES is legally required to do so.