Privacy Policy

You are here: / Privacy Policy
ENA INFRAESTRUCTURAS S.A.U. (hereinafter, “ENA”) makes this Privacy Policy available to users of the website located at the URL https://www.ena.es/ (hereinafter, the “Website”) in order to provide information on how we process your personal data and protect your privacy and information.
ENA kindly requests users to take a few minutes to read this Privacy Policy carefully.

Introduction

This Privacy Policy applies to ENA’s website, made available to the public at the URL https://www.ena.es/, as well as to the interactions that users carry out with ENA through the said website.
ENA may amend this Privacy Policy whenever necessary. In the event that modifications are introduced, we will notify you through the website or by other means, so that you may review the new Privacy terms. Continuing to use the functionalities made available by ENA after being notified of the aforementioned amendments shall constitute your agreement to them, except in scenarios where your express consent is legally required.
ENA INFRAESTRUCTURAS S.A. is part of the ITINERE Group, whose website, freely accessible to users, is https://www.grupoitinere.com/.

Who is the data controller for your personal data?

The Data Controller is Ena Infraestructuras S.A.U, with its registered office in Madrid (28020), C/ Poeta Joan Maragall, 1-11th Floor. NIF (Tax Identification Number): A28920965.
ENA has formally appointed a Personal Data Protection Officer (DPO) and has also established the following communication channel: dpd@grupoitinere.com.

Joint Controllership and Legitimate Interest within the Corporate Group:

Please be informed that the various concessionary and service companies comprising the Itinere Group (hereinafter, interchangeably, the “Group Companies”) act as Joint Data Controllers regarding certain activities involving administrative management, commercial support, human resources, and internal operational exploitation. To this end, the Group Companies have entered into a Joint Controllership Agreement, pursuant to the provisions of Article 26 of the General Data Protection Regulation (GDPR), the core substance of which is detailed below:
  • Purpose of the Agreement: To regulate joint responsibility over the processed personal data to guarantee unified, efficient, and secure management within the shared technological and operational infrastructure of the Group.
  • Allocation of Obligations: It has been determined that the corporate parent company centralises the implementation, maintenance, and supervision of technical and organisational security measures, as well as the global management of the Data Protection Officer (DPO). Conversely, each individual concessionary company remains directly responsible for the day-to-day processing of data directly linked to the exploitation of their respective road infrastructures and local contracts.
  • Lawful Basis (Legitimate Interest): The internal communication and exchange of your data among the Group Companies is based on the Controller’s legitimate interest (in accordance with Article 6(1)(f) of the GDPR and Recital 48 of the same legal text). This processing addresses the legitimate interest held by the Itinere Group for the transmission of personal data within the business group for internal administrative purposes, resource optimisation, centralisation of IT systems, and the integrated management of customer or user services. A prior balancing test has been conducted to guarantee that this processing does not adversely affect your fundamental rights and freedoms.
  • Data Subject Requests: Irrespective of the terms of the agreement, you may exercise your rights of access, rectification, erasure, restriction, portability, and objection—including the right to object to processing based on legitimate interest—before any of the Joint Controllers. However, to expedite your request, the Group has set up a single, centralised service channel via the email address of our Data Protection Officer: dpd@grupoitinere.com.

Group Companies party to the Joint Controllership Agreement and their Registered Offices:

The entities involved in this joint processing and data exchange based on corporate legitimate interest are:
  • Itínere Infraestructuras, S.A. (Group Parent Company), with its registered office at calle Capuchinos de Basurto, nº 6, 4th Floor, 48013 Bilbao (Bizkaia). NIF: A28200392.
  • Ena Infraestructuras S.A.U, with its registered office in Madrid (28020), C/ Poeta Joan Maragall, 1-11th Floor, 28020 Madrid. NIF: A28920965.
  • Autopistas del Atlántico Concesionaria Española, S.A.U. (AUDASA), with its registered office at calle Poeta Joan Maragall, nº 1, 11th Floor, 28020 Madrid. NIF: A15020522.
  • Autopista Concesionaria Astur-Leonesa, S.A.U. (AUCALSA), with its registered office at calle Poeta Joan Maragall, nº 1, 11th Floor, 28020 Madrid. NIF: A28415784.
  • Autopistas de Navarra, S.A. (AUDENASA), with its registered office at Autopista AP-15, Km 83 Sur, 31192 Tajonar (Navarra). NIF: A31038771.
  • Autoestradas de Galicia, Autopistas de Galicia, Concesionaria de la Xunta de Galicia, S.A.U., with its registered office at calle Alfredo Vicenti, nº 13, 2nd Floor, 15004 A Coruña. NIF: A15508856.
  • Gestión de Infraestructuras Viarias de Bizkaia – Bizkaiko Bide Azpiegituren Kudeaketa, S.A. (GESBISA), with its registered office at calle Capuchinos de Basurto, nº 6, 4th Floor, 48013 Bilbao (Bizkaia). NIF: A05354279.

For what purpose do we process your personal data?

Personal data provided by users of this website will be processed by ENA to ensure user contact and website management. Specifically, the personal data of users who contact ENA via any of the communication channels provided on the website managed by ENA will be processed to manage said contact, address requests received through them, deliver required services, or provide information requested by the user.

What data is processed by ENA and from which sources does it originate?

I. Data Provenance and Collection Channels
Personal data processed by the companies of the ITINERE Group is integrated into corporate information systems through a diversified multi-channel ecosystem, classified into the following sources of origin:
  1. Direct Submission Sources (Provided by the data subject themselves):
    • Integrated Digital Channels: Data provided by completing contact forms, employment portals, provider tendering portals, and customer/user service platforms hosted on the holding company’s web domains.
    • Compliance and Governance Channels: Data provided through the Internal Information System (Whistleblowing/Ethics Channel) formally designated before the Ministry of Justice, including declarations, testimonies, and enclosed documentation.
    • Direct Communication Channels: Information sent via postal mail, corporate electronic correspondence, centralised telephone calls, or any other enabled channel of institutional interaction.
  2. Automatic Generation and Technological Interaction Sources:
    • Browsing Metadata and Digital Audit Logs: Data derived from browsing the Group’s web environments, including unique identifiers, activity logs, operational and analytical cookie usage, behavioural heatmaps, and sections visited.
    • Connectivity and Infrastructure Data: Public IP addresses, device telemetry data, operating systems, and estimated technical geolocation required for the perimeter security of digital assets.
  3. Sources Derived from Legal and Contractual Relationships:
    • User/Customer Lifecycle Management: Data generated organically as a consequence of the development, processing, maintenance, billing, and auditing of the contractual, pre-contractual, or commercial relationship established between the data subject and any of the Group companies.
  4. Indirect and Third-Party Sources:
    • Legal Representation and Third Parties: Data collected when the user provides contact or identification information of third parties (employees of suppliers, guarantors, beneficiaries, legal representatives, or corporate contact persons), whereby the individual providing the data assumes the legal obligation to have informed and obtained prior consent from said data subjects.
II. Taxonomy and Typology of Personal Data Under Processing
Depending on the nature of the relationship (web user, customer, contractor, supplier, or whistleblower) and the principle of data minimisation, ENA processes the following categories of information:
  • Identification and Contact Data: First name, surname, official identity document number (DNI/NIE/Passport), postal address (tax and billing), corporate or personal telephone number, email address, handwritten or electronic signature, access credentials for corporate portals and, where applicable, photographic images or biometric/video surveillance records for security reasons within the firm’s infrastructure.
  • Personal Characteristics and Social Circumstances Data: Age, date of birth, sex, nationality, preferred language, and professional/academic details (in the case of candidates in recruitment processes or representatives of contractors and suppliers).
  • Browsing, Digital Behaviour, and Preferences Data: Source IP address, interaction history on the firm’s web platforms, consented configuration preferences (such as cookie settings), session ID, and browser performance parameters.
  • Financial and Business Transaction Data: Bank details (account number/IBAN), billing details, payment history, associated contracts, and economic-financial data necessary for third-party due diligence (KYC/Know Your Customer).
  • Regulatory Compliance Data (Special Categories / High Sensitivity): Strictly necessary data associated with the investigation of reports within the framework of the Internal Information System (which in exceptional cases and in accordance with Law 2/2023 could reveal data of a criminal nature, administrative offences, or highly sensitive data under rigorous security measures).

What is the lawful basis for the processing of your data by ENA?

ENA processes personal data provided by users of this website in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD).
The lawful bases legitimising the different processing operations apply depending on the nature of the interaction the user establishes with the firm:
  • Performance of a legal relationship and handling of requests (Art. 6(1)(b) GDPR): The processing of personal data associated with the purpose of “Contact and website user management” is strictly based on managing and processing the relationship initiated at the request of the data subject. This includes processing queries, resolving requests for information, maintaining direct contact between parties and, where applicable, providing and correctly executing the service or pre-contractual measures formally requested by the user.
  • Compliance with applicable legal obligations (Art. 6(1)(c) GDPR): In scenarios where the user utilises spaces allocated for regulatory compliance (such as submitting communications through the Internal Information System / Ethics Channel formally designated before the Ministry of Justice), the primary lawful basis will be compliance with the mandatory legal obligations imposed on the Group by Law 2/2023, regulating the protection of persons who report regulatory infractions and the fight against corruption.
  • Explicit and informed consent (Art. 6(1)(a) GDPR): Processing derived from the storage and reading of non-essential cookies (analytical or personalisation cookies), as well as the voluntary submission of CVs through job portals provided by the Group, will be unequivocally based on the free, specific, and affirmative indication of the user’s wishes when accepting those options.
  • Corporate Legitimate Interest (Art. 6(1)(f) GDPR): The processing of technical browsing data (such as the logging of IP addresses or connectivity metadata) is justified by the Group’s legitimate interest in ensuring the perimeter security of its digital assets, preventing fraud, correcting technical errors on the platform, and ensuring proper website functionality.

To whom is your data communicated?

ENA informs users that the personal data processing detailed in this Privacy Policy does not involve communications or transfers of your data by THE ENTITY to third-party entities.

How long do we retain your data?

ENA will retain your personal data for the duration necessary to provide the requested service and/or to achieve the pursued processing purpose.
Subsequently, provided that the user has not exercised their right to erasure, your data will be retained for the statutory limitation periods applicable in each case, taking into account the type of data as well as the purpose of the processing.

What personal data must you provide in each case?

ENA informs users that when personal data is collected via a form made available on our website, the user must provide at least the data marked with an asterisk (*). Failure to supply at least such data, which is deemed mandatory, will prevent ITINERE from managing the delivery of the service or addressing the query or complaint submitted by the user.

What do you guarantee when providing your personal data?

The user guarantees that the data provided is true, accurate, complete, and up to date, and shall be held liable for any direct or indirect loss or damage that may arise as a consequence of breaching this obligation.
In the event that the user provides data belonging to a third party, they guarantee that they have informed said third party of all aspects contained in this Privacy Policy and have obtained their consent to provide us with their data for the relevant processing purpose. All of this must take place prior to submitting third-party data through any of our websites.
ENA informs you that in order to submit your personal data in any manner via our website, you must be over 16 years of age. Any user providing data to THE ENTITY through this website declares and warrants that they are over 16 years old, accepting full responsibility for such statement.

What measures do we adopt to protect your personal data?

In response to ENA’s commitment to ensuring the security and confidentiality of your data, the security levels required for personal data protection have been adopted. Technical means within our reach have been implemented to prevent the loss, misuse, alteration, unauthorised access, and theft of personal data provided through the Website. Nonetheless, you must bear in mind that internet security measures are not infallible.

What are your rights regarding your personal data?

ENA informs you that you have the right to access your personal data and obtain confirmation on how it is being processed. Likewise, you have the right to request the rectification of inaccurate data or, where applicable, request its erasure when, among other reasons, the data is no longer necessary for the purposes for which it was collected by ENA.
Under certain circumstances, you may request the restriction of the processing of your data, in which case THE ENTITY will only retain it for the establishment, exercise, or defence of legal claims.
Furthermore, under certain circumstances, you may object to the processing of your personal data for the purpose communicated by ITINERE. In that case, ITINERE will cease processing the personal data unless compelling legitimate grounds exist, or to ensure the establishment, exercise, or defence of potential claims.
Finally, you may request the right to data portability and obtain for yourself or for another service provider certain information derived from the formalised relationship with the Entity.
Such rights may be exercised through the following channels, specifying the reference “DATA PROTECTION” in your request:
  • In writing addressed to ENA INFRAESTRUCTURAS S.A.U., for the attention of the Data Protection Officer, at the address Calle Poeta Joan Maragall, nº 1 Planta 11ª (28020 Madrid).
  • By writing addressed to the Data Protection Officer at the email address dpd@grupoitinere.com.
In both scenarios, proof of identity of the person exercising their rights is required by sending a copy of both sides of their DNI, NIE, Passport, or equivalent identity document.
ENA will provide the requested information within a maximum period of one month from receipt of the request. This period may be extended by a further two months if necessary, taking into account the complexity and number of the requests.
You have the right to lodge a complaint with the competent supervisory authority for data protection. However, in the first instance, you may submit a complaint to the Data Protection Officer, who will resolve the matter within a maximum period of two months.
V. 21/10/2026