Privacy policy
At luzgasia we process your data on a simple principle: we only ask for what is necessary, we only use it for what we tell you, and we do not keep it any longer than is essential. This policy explains exactly what we do, with no small print.
- Version
privacidad-2026-07-demo-v6- Last updated
- August 2026
- Sections
- 9
Draft: This document is a draft pending validation by our legal advisers. Not to be published as a final version.
Courtesy translation: This translation is for information purposes. The legally binding version is the Spanish one, which prevails in the event of any discrepancy. See the Spanish version
Who is the data controller
luzgasia (full identifying details pending from our legal advisers) is the data controller for the data you provide to us through this website.
For any question about privacy, including the exercise of your rights, you can write to us at info@luzgasia.com.
What data we process
Contact details that you provide to us: name, email, telephone, postal code and type of customer.
Your electricity or gas bill and the data extracted from it: account holder, CUPS, supply address, current retailer, contracted power, tariff, consumption, billing period and amounts.
Technical data: the IP address and the browser from which you accept each permission. We keep them precisely so that we can evidence what you accepted and when.
If you decide to contract: your DNI/NIE and your bank account (IBAN). We do not ask for them beforehand, and when we do ask for them we tell you what for. The IBAN is used solely to set up the direct debit for the supply you contract: it is neither shared with third parties outside the registration process nor used for any other charge.
Website usage measurement (without cookies): in order to know how many people view the home page and the comparison tool, we record on our servers an irreversible identifier (a fingerprint encrypted with a server key) derived from your IP address and your browser, together with the date. We do not use cookies or any storage on your device for this, it does not make it possible to identify you and it is automatically deleted after 6 months. Legal basis: legitimate interest in measuring and improving our own service (art. 6.1.f GDPR).
What we use your data for and on what legal basis
We do not use a single legal basis for everything. Each purpose has its own, and that changes what you can decide:
- Analysing your bill, calculating your savings and showing you the result: we do this because you have asked us to, as a step prior to a possible contract (art. 6.1.b GDPR). We do not need your consent for this, but you can ask us to delete your data whenever you wish.
- Sending you the result of your analysis by email and whatever is needed to continue with it: same basis, it is the service you have requested.
- Helping you to finish a contracting process you left halfway: if you created your account and stopped midway, we may contact you to help you complete what is missing. This is the performance of what you yourself started, not a sales call.
- Sending you offers or calling you to sell you something: only with your express consent (art. 6.1.a GDPR), which is optional, separate and revocable at any time. Not ticking it changes nothing about your analysis.
- Managing your contracting and the switch of retailer: performance of the contract and of the authorisation you sign.
Our model is 100 % online: what that means for you
The entire process —analysis, proposal, documentation and signature— is carried out from the website, without you having to speak to anyone. That is the idea behind the product and not an obstacle: we do not want you to depend on someone picking up the phone.
There is only one exception, and it is to help you: if you have created your account and have left the contracting process half-completed, we may get in touch with you to give you a hand with what is missing. If you would rather we did not, tell us and we will not contact you again.
Apart from that case, we do not make sales calls to anyone who has not expressly requested them by ticking the corresponding box. It is our own decision and it is also what the electricity sector regulations require.
Who we share your data with
We do not sell your data or transfer it for third-party advertising. It only reaches those who are needed to provide you with the service:
To read the documents you provide automatically we work with three artificial intelligence providers, all of them processors acting on our instructions and under the contract required by Article 28 GDPR: Anthropic PBC (United States), Google LLC (United States) and OpenAI, L.L.C. (United States). Each document is read by one of them only: we try the one we have configured as primary at that moment and turn to another only if that reading fails because of a service failure — an outage, a timeout or a provider error. We do not send the same document to all three. Which one is the primary may change for reasons of availability, quality or cost, and that change does not alter any of the safeguards described here; our internal records show which provider read each document.
- Automatic reading of your bill: the image or PDF you upload is sent to one of those three providers in order to extract its data (account holder, CUPS, supply address, contracted power, tariff, consumption, period and amounts). They process it solely in order to return that reading to us, and none of the three uses your data to train or improve their models: the terms we have agreed with them expressly exclude it.
- Automatic reading of your identity document: only if you give us that permission, the photograph of the ID card, foreigner ID or passport that you upload to your private area when contracting is sent to one of those same providers in order to propose your first name, surnames and document number already filled in, which you confirm or correct. In the current configuration this reading is provided by whichever provider we have set as primary, with the same safeguards as the reading of the bill. It is an optional permission, separate from the previous one: if you do not tick it, no image of your document leaves our systems and you type that data in yourself.
- Transfers outside the European Economic Area: all three providers are established in the United States, so sending them a document entails an international transfer of data. These transfers are covered by the safeguards of Chapter V GDPR: the standard contractual clauses approved by the European Commission (Art. 46(2)(c)) and, for the providers that adhere to it, the adequacy decision of the EU-US Data Privacy Framework (Art. 45). You can ask us for a copy of those safeguards by writing to info@luzgasia.com.
- The calculation of your savings is carried out entirely on our own systems: no third party receives your data in order to compare it.
- If you decide to contract: the retailer you choose and the distribution company receive the data that is essential to process the registration. You will see the name of that retailer before signing anything.
- Technology providers for hosting, email and SMS, which act on our behalf and under a data processing agreement.
How long we keep each thing
We do not keep anything just in case. These are the periods:
- The file of your bill: 30 days from upload, and only 24 hours if you did not go on to complete the analysis.
- The data extracted from your bill and your analysis: 12 months, so that you can consult it again and compare it the following year.
- Your contact details, if you did not go on to contract: 12 months from the last contact.
- Your DNI, your IBAN and the contracting documents: 90 days from the formalisation of the registration, and 7 days if you never completed it.
- If you did contract: the data of the relationship is kept for as long as it lasts and thereafter for as long as legal and tax obligations require.
- The record of your permissions: for as long as the relationship lasts and for 3 years thereafter, because it is the evidence that we acted correctly.
Your rights, and how to exercise them without friction
You can exercise the rights of access, rectification, erasure, objection, restriction and portability. It is free of charge and we will reply to you within one month at most.
If you have a customer or collaborator account, you have a cancellation button inside your own area: you do not need to write to anyone or justify anything. For anything else, write to us at info@luzgasia.com.
If you gave your consent for commercial communications, you can withdraw it as easily as you gave it: every communication includes an unsubscribe link.
If you consider that we have not handled your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es).
Security
Your bill is transmitted encrypted, is not accessible through any public URL and is only served through authenticated access.
Your DNI, your IBAN and your signature are stored encrypted at rest. No one on our team sees your full IBAN or your full DNI: in the internal panel they only appear masked.
We apply appropriate technical and organisational measures against unauthorised access, and before any definitive deletion we make a backup so as not to destroy anything by mistake.
Automated decisions
The analysis of your bill is automatic: a reading technology extracts the data and our comparison engine calculates the savings against our tariff catalogue.
It is not a decision that produces legal effects concerning you or significantly affects you: it is an informative proposal. You decide freely whether or not to contract, and you can always ask us for a person to review the result.
The savings we show are an estimate based on what we have read from your bill. If the figures do not add up for us, we prefer not to give you any figure rather than give you one that is made up.