Who is this information intended for?

This page is intended for the natural or legal persons who are the holders of the supply, installation or final use of energy from which a Certificado de Ahorro Energético (CAE) is generated under Real Decreto 36/2023. These persons are referred to below as final beneficiaries of the energy savings.

You may be a final beneficiary if, for example, you have contracted an energy efficiency action at your facilities (LED lighting, variable speed drive, heat pump, insulation, etc.) under the CAE system and a Sujeto Obligado or Sujeto Delegado has obtained a certificate linked to those savings.

Who is the data controller?

The data controller is HM Capital, a single-member SARL under French law (SIREN 843 444 464), with registered office at 55 Rue du Bois d'Amour, 86280 Saint-Benoit, Francia. HM Capital operates the CertificAhorro service, which includes the Mercado CAE module (secondary marketplace for certificates).

HM Capital acts as controller when it holds the regulatory documents of the CAE file (Resolución MITECO, ENAC dictamen, chain of assignment, signed contract). These documents may contain personal data of the final beneficiary insofar as the CAE regulations require identifying the holder of the supply or installation.

What personal data do we process?

The final beneficiary data processed is limited to what is strictly necessary for the regulatory validity of the CAE file. Depending on the case, the following may appear:

Name and surnames or company name.
NIF or CIF.
Address of the installation and/or tax address.
Technical data of the supply point (CUPS, consumption, characteristics of the replaced equipment and the installed equipment).
In the Verifier's dictamen, technical data and identity of the beneficiary.

We do not process data from the special categories of Article 9 GDPR (racial origin, political opinions, health, etc.) or data relating to criminal convictions and offences under Article 10.

Where do we obtain your data?

The data is obtained from the Sujetos Obligados or Sujetos Delegados who hold the CAE, who upload the regulatory documents to the Marketplace as part of preparing an assignment transaction. The contractual relationship between the final beneficiary and the Sujeto Obligado or Delegado is prior to and independent of the Marketplace.

For what purpose and on what legal basis do we process your data?

HM Capital processes this data for:

Regulatory custody of the CAE file (legal basis: legal obligation arising from Real Decreto 36/2023, Art. 6.1.c GDPR).
Documentary traceability of the assignment transaction between system Sujetos (legal basis: legitimate interest of the controller in providing a secure and transparent secondary market service, Art. 6.1.f GDPR, with a specific balancing test).
Franco-Spanish tax obligations arising from the invoicing of Marketplace commissions (Art. 6.1.c).

A specific balancing test has been carried out between the controller's legitimate interest and the rights of the final beneficiary, the result of which favours the legitimate interest for the following reasons:

the processing is necessary for the regulatory validity of the CAE (the document cannot be dissociated from the beneficiary's identity without losing its legal value);
the data processed is mostly professional B2B (legal entities and professional representatives), with a smaller proportion of natural persons;
enhanced technical measures are applied: authenticated storage (no public URL) on Cloudinary, distribution via ephemeral signed URL, complete logging of each download (MktDocAccess), strict RBAC;
this page meets the requirement of Article 14 GDPR regarding indirect-source information;
the final beneficiary may exercise their right to object (Art. 21 GDPR) on grounds relating to their particular situation.

To whom do we disclose your data?

The data contained in the CAE file may be disclosed to:

The counterparty of the assignment transaction (only the data strictly necessary to verify the CAE chain of ownership).
HM Capital's processors (Railway for hosting, Cloudinary for document custody, DocuSeal as electronic signature operator). The full list appears in the Mercado CAE Privacy Policy.
The competent authorities in the event of a legally founded regulatory, tax or judicial requirement (MITECO, AEAT, DGFIP, judicial authorities).

There are no international transfers of your data outside the European Economic Area other than those associated with storage on Cloudinary (multi-region), covered by the European Commission's Standard Contractual Clauses. A migration to an EU provider is planned within 6 to 12 months.

How long do we keep your data?

The regulatory documents and the data they contain are kept for 10 years from the closure of the related transaction, in accordance with the more demanding period between Art. L102 B of the French Livre des Procédures Fiscales and Real Decreto 36/2023 applicable in Spain.

What rights can you exercise?

In accordance with Articles 15 to 22 GDPR, you have, free of charge, the following rights:

Right of access to the data that HM Capital processes about you.
Right to rectification if the data is inaccurate or incomplete.
Right to erasure, subject to the limitation arising from the legal retention duty described above (HM Capital may carry out an in-place anonymisation where the obligation persists).
Right to restriction of processing.
Right to object (Article 21 GDPR) on grounds relating to your particular situation, given that the processing relies in part on the controller's legitimate interest.
Right to portability where the processing is based on the performance of a contract or on consent.
Right not to be subject to automated decisions (Art. 22). The Mercado CAE makes no automated decision that affects you legally or significantly.

How to exercise your rights?

You can exercise your rights at any time, without having to justify your request, through the following channels:

Email to legal@certificahorro.es. Where applicable, attach a copy of an identity document so that HM Capital can verify your identity reasonably and with the safeguards of Art. 12.6 GDPR.
Postal mail to HM Capital's registered office address (55 Rue du Bois d'Amour, 86280 Saint-Benoit, Francia).

HM Capital will respond within a maximum period of one month, extendable by two months in the event of complexity or a high number of requests, informing you of the extension and its reasons.

Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR). You may address yourself indifferently to:

the Commission Nationale de l'Informatique et des Libertés (CNIL), the controller's lead authority (France): www.cnil.fr;
the Agencia Española de Protección de Datos (AEPD), the authority concerned for residents in Spain: www.aepd.es.