Privacy policy

1. Our principles

At Telefónica we are committed to respecting the privacy, secrecy and security of the personal data of our employees, customers and suppliers.Our approach to respecting and protecting the privacy of the personal data we process extends beyond legal compliance requirements. It is our priority, it is part of our DNA and we reflect it in the principles that govern our privacy and security policies.This Privacy Policy establishes the guiding principles and the way in which the Personal Data of the users of the web pages of Telefónica Open Innovation, S.L.U. For more information on the procedures underpinning this Policy, please contact privacidad@wayra.com

• We are 100% transparent with you about the data we collect and/or process about you and we explain why we use it and for what purposes. We will not process your data in an unexpected, opaque, or abusive manner.
• You are the only one who can control how your data is used. We provide you with the tools so that you can decide at any time how you want us to handle your data, up to when and how you can access and update.
• We take care to ensure the security, secrecy and confidentiality of your data and personal information. We have carried out the necessary analysis and risk assessments in accordance with the best security and privacy standards in order to implement the most stringent and robust security measures to prevent the loss, alteration, misuse or unauthorised access to your data.

These principles are set out in detail in the following sections of our Privacy Policy, which we encourage you to read carefully. In it, we inform you about everything you need to keep control over your data as a user of the Webpages of Telefónica Open Innovation S.L.U. (hereinafter, “Webpages”) or when you interact with us in any way in connection with the Webpages (hereinafter, the “User” or “Users”).

Webpages provide you with proposals and different projects which enable your access to investment opportunities, acceleration programmes and participation in calls, in accordance with the applicable general conditions (hereinafter, “General Conditions”) and the legal bases regulating the calls and programmes offered by Telefónica (hereinafter “Legal Bases”). Through the Websites, you can also contact us or register for the events and activities we organise by completing the relevant forms provided for this purpose.

‍2. Who is Telefónica Open Innovation?

It is a company of the Telefonica Group, located in Spain, responsible for promoting innovation and local entrepreneurship of disruptive technological projects, through different projects that are developed in Spain, Latin America and Europe.

Our corporate name is Telefónica Open Innovation, S.L.U, company with identification number B86230562 and registered office at Ronda de la Comunicación, SN, (28050), Madrid, España.

Then we will define Telefónica Open Innovation as "Telefónica" or "we".

3. Who is the data controller?

Telefónica Open Innovation, S.L.U. (hereinafter "Telefónica" or “we”), company with ID number B86230562 and registered office at Ronda de la Comunicación, SN, (28050), Madrid, will be the data controller for the processing of your data in accordance with what we inform you in this Privacy Policy.

If you have any queries, requests or complaints regarding the content of this Privacy Policy and our processing of your data, you can contact us at privacidad@wayra.com.

We also inform you that we have a Data Protection Officer who ensures compliance with data protection regulations at Telefónica, and who can be contacted for any questions, queries and/or complaints you may have when we process your data, by writing to DPO_telefonicasa@telefonica.com.

4. What data is processed, for what purpose and why do we process the data?

Data we process about you

As a User, we process different data about you and for different purposes on appropriate legal grounds, either because these purposes are necessary based on the execution of the General Conditions and/or Legal Bases, accepted by the User at the time of registration, which constitute a legal relationship between the User and us, and in respect of which this Privacy Policy forms an integral part; because we pursue legitimate interests that are duly balanced so that they do not affect your rights and freedoms, and in accordance with these; because certain legal obligations apply to us that require us to process data about you as a result of your use of the Webpages; or (iv) with your consent, because you have voluntarily contacted us or registered as a participant in one of our events or activities by completing and submitting the form provided for that purpose. In any other case, we will request your consent to the processing of your data for a specific duly informed purpose.

These are the data that we process about you:

• Basic, identifying, contact and/or professional data: full name, birthday date, email address, telephone number, place of residence, curriculum vitae, workplace, academic education, social networking profile, and any other basic or identifying information, filled in the User profile or in the contact forms.
• Access credentials and identifiers assigned to the User.
• Data relating to queries, support, complaints and/or suggestions.
• Statistical data of use and interactions of the User with the webpages.
• Data relating to the device and/or connection with which the webpages are accessed: connection metadata, as well as information that we may have obtained through the use of cookies and similar technologies (SDKs, pixels, tags, beacons, etc.).
• Data relating to your image and/or voice that we may capture through photographs and recordings taken at events and activities that we organise and which you attend voluntarily.

Origin and source of your data

In general, we obtain the data either directly from you, when you fill in the registration and contact forms, make an enquiry, complaint or suggestion, or contact us by any means and provide us with the required or voluntary data; or we may generate or capture them automatically during registration, during the process of creation of User or during the use of the Webpages, in accordance with the operational functioning and/or functionalities existing at any given time.

All information you provide as a User must be truthful and accurate. To this end, the User warrants the authenticity of all data provided as a result of filling in the corresponding forms. The User shall be solely responsible for any false or inaccurate statements made, and for any damage caused to Telefónica, or to third parties, in relation with the information provided.

In the event of the provision of false data or data that do not correspond to the account holder, Telefónica reserves the right to cancel the User’s account and/or to take measures as it deems appropriate for the best defence of its interests and rights, or those of affected third parties who may be affected as a result of the foregoing.

Telefónica reserves the right to verify the information provided by the User by any means that may be appropriate for the purposes of control and/or verification, depending on the state of the art at any given time and what is most appropriate for the protection of the interests and rights of the parties involved.

Purposes we pursue and reasons we have for processing your data

The purposes for which we process your data as a User are as follows:

• 1. Provision of the service and all the functionalities available, the operation, administration, support and maintenance of the Webpages: based on the performance of the General Conditions of the services and the Legal Bases of the programmes and calls, we will process your data for the purpose of providing you with the services, allowing you to enjoy all the functionalities available at all times, operate and maintain it so that the webpages function correctly and securely, or, where appropriate, withdraw or block your access to the service, which includes allowing us to check the requirements demanded of the User, User’s compliance with the General Conditions and/or Legal Bases, proceed with or facilitate the registration of the User and, where appropriate, the updating of their data, their access and use of the webpages at any time, among other similar purposes in execution and compliance with all the points incorporated in the General Conditions or Legal Bases, all while keeping the condition of User and not requesting cancellation.
• ‍
• 2. Commercial communications – Newsletter: based on your consent provided through your request, we may send you commercial communications including information on our programmes, field and other topics related, as well as activities, ours or from third parties, all while keeping your consent and not requesting cancellation.
• ‍
• 3. Internal management and response to claims, demands, complaints and litigation related to Webpages: based on our legitimate interest associated with the right to effective judicial protection that protects us, we may process your data to manage, respond and act as an interested party or similar in administrative or legal proceedings, when these, in any way, are related to you or refer to you in the corresponding capacity.
• ‍
• 4. Compliance with applicable regulations and response to requirements and official requests made by the authorities: in general, as any actor providing information society services and data controller, various legal obligations apply to us, including consumer obligations, data protection and security, digital services and markets, as well as mandatory collaboration with the competent authorities, including law enforcement agencies. Based on the foregoing, we may need to process your data in order to fulfil such obligations, for example, to respond to data protection rights exercises we receive, or to respond to legitimate subpoenas or requests made to us that require, for example, that we provide information about you.
• ‍
• 5. Attention and response to contracting requests, queries, enquiries, suggestions and any other type of contact received: based on our legitimate interest in managing and providing an effective response to the request or other type of contact made by a User of the Webpages, as well as to the extent necessary for the performance of pre-contractual measures at the request of the User aimed at the acceptance of the General Conditions or the Legal Bases, we may process the data of the person who contacts us in order to provide an effective response in accordance with the contact made, to respond to the suggestion to correct or improve the Webpages service in the manner proposed or, where appropriate, to inform about the commercial conditions of the programmes and calls and to enter into a contractual relationship for this purpose.
• ‍
• 6. Management of investment, stakeholders, suppliers, clients and other partners: based on our legitimate interest in managing the relation with Telefónica’s partners, we will process your data in order to promote and improve their investments.
• ‍
• 7. Statistical analysis of the Webpages: based on our legitimate interest to measure the quality of service of the Webpages, as well as to know how it is used by the Users, we may perform appropriate statistical analyses with Webpages usage data in order to: (1) measure the quality of service and, in the event of degradation, take the necessary measures to prevent and/or remedy such degradation; and (2) make better business decisions regarding the future evolution of the Webpages, as well as improvements or evolutionary corrections that, if necessary, must be made to offer a suitable experience.
• ‍
• 8. Maintenance of the activity and security of the Webpages, prevention of information security breaches and eventual breaches: based on our legitimate interest, as owner and responsible for the Webpages, in ensuring their availability and security for all Users, and in accordance with the General Conditions, the legal notices and other relevant notices of use, as well as with the provisions of our cookie policy and the cybersecurity regulations applicable to Telefónica, we will process your data in order to maintain active and manage the security of the Webpages, and enable an ongoing and free access in a secure manner by all Users.
• ‍
• 9. Managing events and activities: as organisers of events or activities for which you register, we will process your data to manage your registration and attendance at such events or activities, to contact you from time to time via email or other contact details you have provided, to inform you about the programme, date and content, provide instructions on how to connect and attend virtually, thank you for attending, compile aggregated statistics on the event’s progress, and conduct feedback surveys after the event or activity has taken place to help us improve in the future. This purpose is based on the consent you have given us when registering for the event or activity, as well as on our legitimate interest, as organisers, in responding to requests from data subjects, ensuring the event or activity runs smoothly and is organised with adequate safety measures, and ensuring it has sufficient relevance and visibility within its sector.
• ‍
• 10. Disseminating events and activities: as organisers of events and activities, we may make recordings and take photographs of these events whilst they are taking place and disseminate and publish them publicly via the main communication channels we use, both internal and external, such as our websites and intranets or our profiles on the main social media platforms. In this regard, with your consent, by voluntarily activating the camera and/or microphone on your device whilst the event or activity is taking place, or by voluntarily and knowingly posing in front of a photographer or camera authorised by us in the case of an in-person event or activity, we consider that you authorise us to use your image and/or exploit it for the purpose described, free of charge and without restriction to any specific time period or geographical area. Furthermore, based on our legitimate interest in ensuring that our events and activities have an impact on our sector and are made known to the public, we may also take photographs or videos showing general or wide-angle views for dissemination as described.

‍5. How long is the data retained?

In general, we will retain your data for as long as is necessary to fulfil each of the purposes described, as well as for the limitation period applicable to any legal claims that may arise from the processing carried out.

In any event, your data will be retained until you withdraw the consent you have given and/or object to its processing. In this regard, we will do our utmost to provide you with a simple, automated mechanism enabling you to withdraw your consent and/or object to the processing, and we are available to assist you at any time via the email address for exercising your rights set out in section 7 of this Policy.

6. Who is the recipient of the data? are there any international transfers of data?

Third parties who may access, receive and process your data

On a general basis, for the provision of the service and to carry out the processing purposes described above, we may make use of authorised subcontractors acting on behalf of Telefónica, as data processors (e.g. internet service providers, data hosting and technical support providers, platform providers, e-mail providers, security service providers, etc.) and contractually subject to our instructions, only insofar as they are strictly necessary for the provision of the contracted services and only for the period of time strictly necessary for that purpose.

We may also disclose your data with third parties who have a contractual relation with Telefónica and who will process your data for the purposes of dissemination, provided that you have given your consent through any of the forms provided and for as long as you do not withdraw such consent.

In addition, in the event that there is a legal obligation or requirement to do so, we may disclose your data to the competent public administrations in accordance with said legal obligation or requirement and, where appropriate, also to other bodies such as the State Security Forces and Corps and the justice system.

International data transfers

Finally, you need to be aware that, when the authorised subcontractors acting on behalf of Telefónica or the above-mentioned recipients are located or process your data outside the European Economic Area, we will be making an international transfer of your data in accordance with the provisions of data protection law.

In general, we avoid making international transfers and your data are processed within the European Economic Area. Furthermore, in the event that we do in fact conduct an international transfer of your data, we assure you that we will take such organisational, technical and contractual measures as may be necessary to ensure the protection and security of your data, such as, for example, signing the European Commission’s Standard Contractual Clauses with the authorised subcontractor or third-party transferee, carrying out impact assessments on the international transfer in question to assess the risk and take measures to mitigate it, encryption of data in transit or at rest, pseudonymisation of the data subject to the international transfer, our best endeavours to ensure you have the possibility to claim damages directly against the authorised subcontractor or recipient of your data located in a third country, etc.

In any case, we are at your disposal at the mailing address for exercising your rights as indicated in section 6 of this Privacy Policy, and through which you can obtain more information on the guarantees and measures applied and provided for in the applicable regulations.

‍7. What rights do you have as a data subject?

Your rights

As a User, data protection regulations grant you certain rights over your data which, depending on how they apply, you may exercise against Telefónica. Here’s what they are and how you can exercise them.

We also inform you that on the website of the Spanish Data Protection Agency (www.aepd.es) you can find more information on the characteristics of these rights and download templates for exercising each of them.

Rights

What means this right?

Right to withdraw consent

This is your right to withdraw your consent to the processing of your data for the purposes that are legitimate on that basis, at any time and in an easy way.

Right of access

It is your right to ask us for details of the data we hold about you and how we process it, and to obtain a copy of it.

Right of rectification

It is your right to obtain the rectification of your inaccurate or erroneous data, as well as to complete incomplete data.

Right of erasure

It is your right to request deletion or suppression of your data and information in certain circumstances. However, please note that there are certain occasions when we are legally entitled to continue to store and process your data, for example, in order to comply with a legal obligation to retain data.

Right of restriction

It is your right to restrict or limit the processing of your data in certain circumstances. For example, if you apply for deletion of data, but instead of deleting it, you would prefer that we block it and process it only for retention purposes because you will need it later to make a complaint. Again, please note that there may be times when we are legally entitled to refuse your request for a restriction.

Right to object

It is your right to object to our processing of your data for a specific purpose, in certain circumstances provided for by law and related to your personal situation.

Right to portability

It is your right to ask us to receive your personal data in a structured, commonly used, machine-readable and interoperable format and to transfer it to another data controller, provided that we process your data by automated means.

The right to not be subject to automated individual decisions

This is your right to ask us not to subject you, in certain circumstances, to a decision based solely on automated processing of your data, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Means of exercising them and deadlines for response

In general, you may exercise these rights at any time and free of charge by contacting Telefónica at privacidad@wayra.com. Likewise, in general, mechanisms for the automated unsubscription of communications and other options for withdrawal of consent and opposition will be made available to the User.

It is important to bear in mind that when you exercise a right, in some cases, you must clearly specify which right you are exercising and provide a copy of a document proving your identity. It should also be noted that some of the data processing is carried out by Telefónica in a way that does not require the direct identification of the Users, without Telefónica being obliged to obtain and/or process additional information to verify the User for the purposes of enabling the data subject to exercise his/her data protection rights.

In the event that a User exercises a data protection right and, due to the reasons indicated, Telefónica is not in a position to identify him or her in order to deal with the request, it will inform him or her to that effect if possible. Such a request shall be suspended until such time as the User provides additional information enabling him or her to be identified.

Any exercise of rights shall be answered within a maximum period of one month, which may be extended by two months if we need to do on a reasoned basis, taking into account the complexity of the request and the number of requests.

Finally, in the event that you do not agree with the way in which your data is handled by Telefónica, you have the right to lodge a complaint with the national supervisory authority by contacting the Spanish Data Protection Agency (AEPD, by its initials in Spanish), whose contact details are as follows:

Agencia Española de Protección de Datos

Edificio Cuzco IV, Paseo de la Castellana, 141, planta 9

28046 Madrid

www.aepd.es

We recommend that before submitting any complaint or claim to the Spanish Data Protection Agency (AEPD), you contact our Data Protection Officer in order to analyse the specific situation and try, if necessary, to find an effective and amicable solution. Apart from the above, if you wish, you can also contact the AEPD.

8. Further processing of data and changes to the Privacy Policy

Telefónica reserves the right to update this Privacy Policy at any time. Any such update will be made public by Telefónica, in any event, with such notice prior to its entry into force as is legally required.

In addition, it shall be communicated directly to the User where it affects his or her rights or freedoms or where, for example, the inclusion of a new processing activity would require the User’s consent or changes the scope of the legitimate interest that enables the processing to be carried out.

Last update date: September 2026