PRIVACY POLICY

Version 1.3. 24/02/2026

At Internet Construdata21, S.A.U. we consider that the protection of your personal data and privacy is a matter of utmost importance. Therefore, through this Privacy Policy, we hereby inform you of and define the context in which we process the personal data that we collect. We also explain, transparently and concisely, the rights that protect you and our obligations throughout the data processing procedure.
This policy is available in several languages. If you are reading this policy in a language other than Spanish, we ensure that the content is accurately translated and consistent with the original version. If you have any questions regarding the content of this document, please contact us at info@construdata21.com, and we will be happy to assist you in your preferred language.

What customer information do we access?

The personal data we process may have been provided directly by data subjects, by the legal entity for which they work, or by a co-worker, or obtained from reliable public or private sources, after obtaining their consent to provide us with their personal data when required by the applicable legislation.

It is important to note that we only process the data necessary for the provision of the services we offer and in compliance with the legal obligations and legitimate interests that govern our activities. We want to inform you clearly about the types of personal data we process and how we use them:

• Identifying and contact data: This may include your name, surnames, telephone, address, and e-mail address.
• Professional information: This refers to data related to your professional role, including the company for which you work, job title, specific department, and other information that you provide during the contractual relationship.
• Data of third parties: It is important for you to know that if you provide us with the personal data of others, such as your co-workers or your company’s employees, you must ensure that you have provided them with a copy of this Privacy Policy, either directly or through their superior. You are responsible for obtaining their consent, or if applicable, for sharing this document with them, either directly or through their superior.
• Information about the activities or interactions that you maintain with Construdata 21, in relation to any service provided by the company. This includes information about your use of our platform, such as the services you interact with, your usage history, and the communications or requests made through the platform.

For what purpose do we process your personal data and why is it lawful and justified?

Lawfulness of processing:

At Internet Construdata21, S.A.U. we will only process your personal data if we have the appropriate lawful basis for doing so, provided under current legislation, and we will therefore use only and exclusively the personal information that concerns you:

• If we have obtained your prior consent, as in the case of data processing related to commercial, advertising and marketing communications. You may withdraw your consent at any time, and this will not affect the lawfulness of processing prior to such withdrawal.
• If processing is necessary to meet the contractual obligations that we have undertaken with you or to take pre-contractual measures if requested (for example, providing the services derived from the commercial relationship between you and Construdata21). This allows us to manage, develop, improve, and fulfil our obligations related to the services we provide, including access to information about construction projects, managing advertising services, and supporting business-related communications.
• If processing is necessary to meet legal obligations that we are subject to, such as tax or reporting obligations, or other legal duties imposed by public authorities.
• If processing is essential for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, such as regulatory compliance or audits.
• If processing is essential for our legitimate interests and does not unduly affect your interests or your fundamental rights and freedoms. Our legitimate interests may include ensuring the proper functioning of our platform, improving user experience, and communicating important updates or changes related to the services you use. In certain cases, we may process your personal data based on our legitimate interests for commercial communications or advertising. This is applicable primarily in the context of business-to-business communications or communications related to services you have previously used or shown interest in. We ensure that these interests do not override your rights and freedoms and that you have the option to opt out of receiving such communications. You may always object to the processing of your data for these purposes.

Data processing objectives

At Internet Construdata21, S.A.U. we aim to process personal data in a transparent, lawful and fair manner, monitoring their accuracy, integrity and confidentiality and limiting ourselves to using the data that are strictly necessary in relation to the purposes for which they are processed.

Specifically, we broadly inform you that we perform data processing only for certain, explicit and legitimate purposes, and the data will not be further processed in a way that is incompatible with those purposes. The purposes for which we process your personal data include:

• Managing our relationship with the users of the platform and in relation to the services we provide, services related to access to information on data for works by geographical segment, stage of implementation and/or type of work.
• The contracting of the temporary advertising service.
• Managing access to the different trial versions and/or offers of services, and for managing any form of collaboration and interaction with the services provided by the platform, including the services linked to advertising.
• Sending the newsletter.
• Performing commercial, marketing and advertising communications.
• Responding to your requests and providing effective assistance through any contact method used by the user.
• Improving the quality of our interactions and service by adapting our offer to your specific needs.
• Managing, planning and carrying out interactions and communications with you.
• Filing and storing records.
• Consulting service or search for subsidies.
• Managing invoices and payment.
• Training activities.
• Any other purpose required by law and the relevant authorities.

Who has access to your personal data?

During the course of our activities, your personal data will be shared only with those parties who have a legitimate need to access the information in order to fulfil the contracted services and obligations. Specifically, your data may be accessed or transferred to:

• Members of our corporate group: This includes companies within the same group as Internet Construdata21, S.A.U. (Hubexo) where their involvement is necessary to carry out the services you have contracted. These companies are required to protect your personal data and use it only for the purposes of fulfilling the services provided to you.
• Service providers: We may need to share your data with third-party service providers who support us in the delivery of services. These may include IT providers, marketing and advertising agencies, customer support services, payment processors, or other relevant suppliers. They process your data only to the extent necessary to provide the contracted services and under strict confidentiality agreements.
• Public authorities: In certain cases, your personal data may be transferred to public authorities or regulatory bodies when required by law, such as for compliance with tax obligations, audits, or other legal requirements.
• Other parties: Your data may be shared with other third parties only when necessary to fulfil the purposes of the contractual relationship or comply with legal obligations

In any case, we remind you that the aforementioned third parties are also bound by contract to protect the confidentiality and security of the personal data and information to which they have access, in compliance with the applicable legislation and the agreements signed with the company.

International Data Transfers

In the course of our activities, it may be necessary for us to transfer your personal data to countries outside the European Economic Area (EEA). In these cases, we ensure that appropriate measures are taken to guarantee the protection of your personal data and that it is processed in compliance with applicable data protection laws, including the GDPR.

When transferring your personal data outside the EEA, we will ensure that such transfers are made in full compliance with the GDPR. We use one or more of the following safeguards to ensure your data is protected:

• Standard Contractual Clauses (SCCs): These are the most common and legally approved mechanism under the GDPR to transfer data outside the EEA. SCCs ensure that the data recipient agrees to the same level of data protection as required by EU law.
• Adequacy Decision: If the European Commission has determined that the country to which we are transferring data offers an adequate level of protection, we can transfer the data without additional safeguards. We will inform you if your data is transferred to a country that the EU recognizes as having adequate protection.
• Binding Corporate Rules (BCRs): If data is transferred within our corporate group, we may use Binding Corporate Rules as a safeguard to ensure data protection across our global operations.
• Other Appropriate Safeguards: In some cases, we may use other approved mechanisms, such as certifications, or obtain specific consent for the transfer of your personal data.

You have the right to request more information about the safeguards we use to protect your data during international transfers. If you wish to obtain a copy of the relevant contractual clauses or ask questions regarding the transfer, you can contact us at info@construdata21.com.

How do we protect your personal data?

At Internet Construdata21, S.A.U. we have the appropriate technical and organisational resources to provide a level of security and confidentiality for the personal data being processed that takes into account the nature of your data, the scope, context and purposes of data processing, and the likelihood and severity of the risk that may compromise the rights and freedoms of natural persons. In addition, both the data controller and processor will apply the appropriate technical and organisational measures to ensure a level of security taking into account the processing risk and the state of the art.

We continuously review and update our security practices to adapt to new threats and technological advancements, ensuring that your data remains secure.

How long will we store personal data?

We will only store personal data for the time necessary to fulfil the purpose for which they were collected, to comply with legal requirements and provided that their removal has not requested by the data subject.

Specifically, we store personal data for the following periods:

• In the event that the legal basis for data processing is a contract, the period during which the data are stored will be the duration of the contract, to which the limitation period for legal claims under said contract has expired will be added.
• If the data is required for compliance with legal obligations, we will store it for as long as needed to fulfil those obligations (for example, tax or accounting requirements).
• The data provided for commercial and promotional purposes will continue to be stored and processed once the commercial relationship ends, until the data subject revokes his or her consent and without prejudice to the exercise of the right to limit and/or erase the processed data.
• If the processing is based on legitimate interests, we will store the data for as long as needed to fulfil those interests, and only for as long as it is required to balance those interests with your fundamental rights and freedoms. You have the right to object to the processing of your data if you believe it infringes upon your rights. If you exercise your right to object, we will stop processing your data unless we can demonstrate legitimate grounds that override your interests.

When no longer required for this purpose, the data shall be eliminated using appropriate security measures to guarantee the pseudonymisation of the data and/or the total destruction thereof.

What are the rights that the data subjects are entitled to and how may they exercise them?

Data subjects may exercise the following rights under the conditions and with the limits established by the legislation:

• Access their data to determine, inter alia, what personal information we are processing that concerns them or the purposes for which they are being processed.
• Request rectification of their data and therefore correct the inaccurate information that concerns them. They also have the right to complete the data that they consider incomplete or to update the data that do not correspond to their current situation.
• Request the deletion of their data when for example, among other reasons, they consider that the data are no longer necessary for the purposes for which they were collected or when they withdraw their consent for the processing of said data.
• Request the limitation of the processing of their data in certain circumstances, in which case we inform them that we will only store them, as established by the GDPR, for:
  • the exercise or defence of legal claims
  • the purpose of protecting the rights of another natural or legal person
  • important grounds of public interest.
• Portability of their data, allowing data subjects to receive the personal data that concern them, and that they have provided, in a structured, commonly used and machine-readable format; and for Construdata 21 to transmit them directly to another data controller.
• Object to the processing of their data. In certain circumstances and for reasons related to their particular situation, they have the right to object to the processing of their data. In these cases, we will stop processing them, unless there are compelling legitimate reasons, or the exercise or defence of possible legal claims is to be carried out.
• You also have the right to withdraw your consent at any time, without affecting the lawfulness of prior data processing based on that consent.
• Right to lodge a claim with the supervisory authority (agpd.es) if they consider that the processing of data does not comply with current regulations

If you have any questions or wish to exercise the aforementioned rights, you may send an email to info@construdata21.com or send a letter to the company’s address, attaching a valid form of identification to verify your identity when submitting your request.

How will you be informed of the changes in the Privacy Policy of Internet Construdata 21, S.A.U.?

Changes to this privacy policy will be communicated through individual notification via our usual communication channels, by email or through our website. We encourage you to regularly review this policy to stay informed about how we protect and handle your personal data.