1. Data controller and privacy contact
The data controller is PLATAFORMA DE TRANSACCIONES ELECTRONICAS TODORECARGAS, S.L.U., Tax ID (CIF) B21555750, C/ La Fuente, 8, 21720 Rociana del Condado, Huelva. The sole channel for privacy-related matters and the exercise of rights is hola@tarifalia.es. For inquiries regarding data protection, please use the channel designated by the data controller.
2. Processing activities, categories, purposes, legal bases, and retention
| Activity | Data processed | Purpose and legal basis | Retention |
|---|---|---|---|
| Comparison | Service preferences and temporary selection, without mandatory identification | Filtering and sorting the catalog to provide the requested service | During the session; the temporary selection identifier expires after a maximum of 45 minutes |
| Callback request | Name, phone number, preferred time, selected option, date, IP address, and browser | Addressing and documenting the request: consent and requested pre-contractual measures | Up to 12 months if the relationship does not proceed; thereafter, data is restricted (blocked) for the duration of any applicable legal liability period |
| Service subscription/contract request | Identification, contact details, address, installation, lines, number portability, SIM/eSIM, IBAN, remarks, documents, and evidence of acceptance | Verifying and processing the sign-up: pre-contractual measures, contract execution (if formalized), and legal obligations | During the processing stage; if the contract is not formalized, data is deleted within a maximum of 12 months, unless subject to a legal hold or a claim |
| Commercial communications | Identity, contact details, and evidence of consent | Sending updates and the company’s own offers: separate consent | Until consent is withdrawn; thereafter, the minimum data necessary is retained on an exclusion list to respect the user’s objection |
| Security and defense | IP address, date, browser, technical logs, and incident records | Preventing abuse, protecting the service, and bringing or defending legal claims: legitimate interest and legal obligations | For a period proportionate to the risk; typically no more than 12 months, unless an incident occurs or liability arises |
| Measurement and advertising | Identifiers, browsing activity, campaign data, and conversions | Measuring and attributing campaigns: cookie consent | Based on user choices, the cookie inventory, and the provider’s specified retention periods |
2b. Electricity and gas assessments and contracting
When you request an energy assessment, we process your contact details, preferred contact times, customer type, any additional notes, evidence of consent, and your full electricity or gas bill—which may include the account holder’s name, supply address, CUPS (Universal Supply Point Code), consumption, contracted power, pricing, and other billed items. The purpose is to receive and review your bill, prepare a proposal (available via TARIFALIA), and send you the requested report. If you subsequently select "I want to sign up," we will also process your national ID (DNI, NIE, or CIF), current account holder status, relationship to the property, address, CUPS, IBAN, account holder’s name, any other necessary documentation, and confirmation records, in order to prepare and submit your application to Gana Energía. This processing is based on the pre-contractual measures you have requested and, where applicable, the management of the contractual relationship. A request made via TARIFALIA does not replace the need to read and sign the official contract that the service provider will send to the account holder. If you do not proceed with a contract, your invoices and the assessment will be retained for the duration of the administrative process—typically for up to 12 months—after which they will be deleted or, if legal liability applies, restricted (blocked).
3. Source and Mandatory Nature
Data is obtained from the data subject or from an individual who declares they are authorized to act on the subject's behalf. Mandatory fields are required to process your request; if this information is not provided, the request cannot be fulfilled. Comparing telecommunications services does not require your name, national ID number (DNI), IBAN, or other documentation. For an energy assessment, you must provide your full invoice and the contact details requested in the form; your national ID number (DNI) and IBAN are only requested at a later stage, during the actual contracting process, if applicable.
4. Legitimate Interest
Where "legitimate interest" serves as the legal basis, we process data to ensure service security, prevent fraud, and handle potential claims. This processing is limited to the data provided or data that can reasonably be expected to be processed. You may object to this processing based on your specific situation; we will then evaluate whether there are compelling grounds or legal defense requirements that take precedence.
5. Recipients and Data Processors
To verify service coverage or process your chosen service, necessary data may be shared with the relevant operator, wholesaler, or partner—and, where applicable, with financial institutions for direct debit arrangements. For the purpose of preparing an electricity or gas assessment—and, at the account holder's request, facilitating the contracting process—the necessary invoices, data, and documents may be shared with Gana Energía or the energy partner involved in the proposal. Additionally, third-party providers—such as those for hosting, email, security, technical support, or authorized metering services—may access this data, subject to contractual agreements and confidentiality obligations. Databases are not sold.
6. International data transfers
Some technology providers may process data outside the European Economic Area. In such cases, an adequacy decision, standard contractual clauses, or another valid safeguard will be applied, along with supplementary measures where appropriate. You may request information regarding the applicable safeguard by writing to hola@tarifalia.es.
7. Comparison tool and automated decision-making
The engine applies compatibility, pricing, and sorting rules based on the preferences provided. It does not assess creditworthiness, create profiles of individuals using identifying data, or make automated decisions that have legal or similarly significant effects. The results are for guidance purposes only, and any subsequent contract requires further validation.
8. Rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing, data portability, and withdrawal of consent by writing to hola@tarifalia.es. Please specify the right you wish to exercise and provide only the information necessary to verify your identity. Withdrawing your consent does not affect the lawfulness of any processing that took place prior to the withdrawal. If you believe your rights have been violated, you may lodge a complaint with the Spanish Data Protection Agency (*Agencia Española de Protección de Datos*).
9. Minors, third parties, and documents
Requests are intended for individuals of legal age. Do not provide information about third parties without their authorization. Attached documents must be in JPG, PNG, WebP, or PDF format and are subject to format and size checks; they are used solely for the specific request, are not published, and should contain only the necessary information. For electricity and gas assessments, it is essential to submit all pages of your bill to ensure a complete analysis.
10. Security, confidentiality, and updates
We implement access controls, encryption in transit, data minimization, request limits, file validation, and restricted management of recipients. No system can eliminate all risks. Any material changes to the purposes, legal bases, or recipients will be reflected in a new version, including an updated date.
11. Regulations and Official Sources
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR).
- Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights.
- Official information from the AEPD (Spanish Data Protection Agency) on exercising your rights.
Additional information for the professional sector
We process data regarding identity, representation, business activity, contact details, billing, bank accounts, and necessary documentation provided by our partners in order to evaluate onboarding, manage contracts, grant access, and settle transactions. The legal bases for this processing include pre-contractual measures, the execution of a contract, legal obligations, and our legitimate interest in security and protection. Evidence of signature and acceptance includes the version, date, IP address, and other technical data required to verify the process.
Distributors have access to their own business activity; wholesalers have access to information concerning their specific network; and authorized personnel have access only to the information necessary for the performance of their duties. Authorization to access data does not permit the reuse of customer data for the user’s own prospecting or marketing purposes. If data is provided by a distributor, the distributor must inform the data subject about the recipients and the specific process being requested. You may request information regarding the origin of your data.
For electricity and gas, the full invoice, contact details, supply information, consumption data, and any proposals are processed in order to carry out the requested assessment. For the new electricity comparison tool, Auro receives the contact details, invoice information, supply data, and consumption figures necessary to prepare the comparison and the resulting report. If the account holder decides to proceed with a contract, the necessary identification, banking, and supply details are provided to Auro and the chosen energy supplier. Gana Energía or other partners may be involved in preliminary steps or in services that continue through their respective channels. Contract-related data and documentation are requested at the appropriate stage. Uploading an invoice does not change your energy supplier, nor does it activate a contract.
Professional access requires information about the partner; however, searching for tariffs does not require the entry of the customer’s personal identification details. Optional marketing communications are subject to a specific legal basis and are not a condition for submitting a request. The comparison tool does not make automated decisions that have legal effects on the customer.
Requests regarding data rights are generally addressed within one month; if an extension is legally permitted due to the complexity or volume of requests, you will be notified within that initial one-month period. Additional information may be requested to verify your identity, though this does not automatically require the submission of a full copy of your national ID (DNI). You may file a complaint with the AEPD (Spanish Data Protection Agency).
Revision: September 17, 2026 · V41 (electricity comparison tool).