Last updated version: 05/05/2022

In compliance with current legislation on personal data protection, you are hereby informed of the following:

DATA CONTROLLER AND INFORMATION OFFICER

We inform you that Atlantica Sustainable Infrastructure PLC, whose registered office is at Great West House 17th Floor, Great West Road, Brentford, Middlesex, Greater London, United Kingdom, TW8 9DF, and/or its subsidiaries (hereinafter, “Atlantica”) are the Data Controllers of your personal data for the purposes described herein.

Atlantica’s subsidiaries are listed in our most recent Consolidated Annual Report published on the website www.atlantica.com.

Once you apply for a particular position at Atlantica and your details are assessed by a specific company of the group, you will be informed of the identity of the company that will be the Controller of your personal data. Then, or at any other time, you may decide whether or not to agree to the processing your data by the specific Atlantica company. Please note that if you choose not to give your consent, your personal data will not be processed and therefore your request will not be considered.

You can contact our Information Officer at the address above or at the following e-mail address .

HOW WE HAVE OBTAINED YOUR DATA

The personal data that will be processed will be the data contained in your CV and cover letter or similar, provided by you to Atlantica, through the different means that Atlantica makes available to you, in order to assess your application for current or future vacancies to be filled in our organisation.

Likewise, we may also obtain your application data through recruitment companies to which you have applied for your job search, your university, or job portals.

WHAT PERSONAL DATA WE PROCESS, WHAT WE PROCESS YOUR PERSONAL DATA FOR AND WHY WE MAY PROCESS YOUR PERSONAL DATA

CURRENT RECRUITMENT PROCESS AND SPONTANEOUS APPLICATIONS
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the following personal data: · Identification data (name and surname, NIF/NIE, username); · Contact details (email and telephone); · Data relating to your training, skills, professional experience and motivation (data in the CV, data in the motivation letter, skills test reports). We will also process any other personal data relating to you that are generated or processed during the selection processes in which you may be included.	We process your personal data to assess your application for job vacancies in our organisation.	The processing of your personal data is legitimised by the application, at your request, of pre-contractual measures between you and the company identified in the job offer, consisting of the selection processes leading to your possible incorporation into the staff of our organisation.
FUTURE RECRUITMENT PROCESSES
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the following personal data: · Identification data (name and surname, NIF/NIE, username); · Contact details (email and telephone); · Data relating to your training, skills, professional experience and motivation (data in the CV, data in the motivation letter, reports on assessment tests and assessment tests). We will also process any other personal data relating to you that are generated or processed during the selection processes in which you may be included.	We will retain your personal data to assess your application for future vacancies to be filled in our organisation. This is without prejudice to your right, now or at any time, to object and exercise your rights as explained in the “WHAT ARE YOUR RIGHTS” section of this Privacy Policy.	The processing of your personal data is carried out in our legitimate interest to expedite these processes, without infringing your rights as you have voluntarily provided them to us for a job in our organisation.
INTERNET CONSULTATION AND/OR PUBLIC SOCIAL NETWORKS
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the following personal data: · Personal data published on professional social networks whose privacy settings are not restricted to third parties and/or those data published on the internet.	The possible consultation in professional social networks and/or on the internet is carried out to assess the suitability of your application for jobs in our organisation.	The processing of your personal data is based on the legitimate interest of our organisation in identifying the right candidate for the selection process.
FORMALITIES FOR INCORPORATION INTO THE WORKPLACE
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the following personal data: · Identification data (name and surname, NIF/NIE, signature); · Contact details (email and telephone) We will also process any other personal data relating to you that you provide for the purpose of drawing up the employment contract.	In the event that you have been pre-selected for a job in our organisation, we will process your personal data in order to carry out the necessary job application procedures.	The processing of your personal data is necessary for the implementation of pre-contractual measures at your request.
LEGAL OBLIGATIONS
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the personal data that you provide to us, and that is generated in the course of your relationship with our organisation.	We process your personal data in order to comply with our legal obligations.	The processing of your personal data is necessary in order to comply with our legal obligations.
CONDUCTING PSYCHO-TECHNICAL TESTS
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the personal data obtained and generated from the performance of psycho-technical tests by you. The answers given in these tests will generate a result that will allow us to evaluate the candidate.	The selection process may involve an analysis of your personal profile in order to assess your suitability for the relevant vacancy by means of psycho-technical tests. If you do not want a personal profile to be drawn up on the basis of your personal data, you should not tick the box expressly indicated for your consent.	Your personal data will be processed with your prior consent. You may withdraw this consent at any time.

AUTOMATED DECISIONS

Atlantica does not adopt decisions that may affect you based solely on the automated processing of your personal data. All decision-making processes related to the purposes described above are carried out with human intervention.

WHEN AND WHY WE MAY TRANSFER YOUR DATA TO THIRD PARTIES

Your data may be communicated to the recipients indicated below, for the following reasons:

• Public Administrations: in order to comply with legal obligations to which Atlantica is subject due to its activity.

• Accounting auditing companies: in order to comply with legal account auditing obligations to which Atlantica is subject due to its activity.

• Security Forces and Bodies: when our organisation is obliged to provide information in compliance with a legal obligation.

• Suppliers that require access to your personal data for the provision of the services that Atlantica has contracted from them and with which Atlantica has entered into confidentiality and data processing agreements necessary and mandatory under the privacy protection regulations.

• Atlantica may communicate your personal data to third interested parties that may arise from the development of any operation of structural modification of our company or from the transfer of business or branch of business activity. This data communication shall be based on Atlantica´s legitimate interest in the correct company´s governance.

• Other companies belonging to Atlantica: We may disclose personal data to companies that are part of the Atlantica group that can be consulted in the latest Consolidated Annual Report published on the website www.atlantica.com, in order to properly perform the relationship you have with Atlantica and for internal organisational purposes, for example, to evaluate your selection based on the legitimate corporate interest of the Atlantica group.  Atlantica may also communicate your application data to other entities of the group in order to enable other companies to assess your application for other job offers, if you give your consent.

• And any other transfer to which Atlantica is required by the legislation in force.

If Atlantica communicates in the future personal data to additional recipients, we will inform you in a timely manner.

INTERNATIONAL DATA TRANSFERS

Intragroup

Due to the international nature of the Atlantica group, it is possible that your personal data may be transferred and shared with Atlantica entities in our offices outside the European Union. Atlantica protects such transfers in accordance with the international data transfer agreements adopted, which incorporate the Standard Data Protection Clauses (Standard Contract Clauses) adopted by the European Commission. To obtain a copy of the Standard Contractual Clauses applicable in the EU adopted by Atlantica, please contact the Information Officer indicated at the beginning of this document.

From third parties

Atlantica does not need to make international transfers of its data to countries that do not have regulations equivalent to the European one (“Third Countries”). In the event that our entity needs to contract the services of suppliers located in Third Countries for the processing of your data, such contracting would be carried out after fulfilling all the requirements established by the data protection regulations and applying the necessary guarantees and safeguards to preserve your privacy. For further information on guarantees in relation to international data transfers, you may contact our Information Officer at the postal and e-mail addresses indicated.

HOW LONG WE WILL KEEP YOUR PERSONAL DATA

We inform you that your data will be kept for as long as it is necessary to manage the selection process. Once the selection process has been completed, your data:

• They will be kept for the purpose of possible future selection processes, for a period of 2 years, provided that you do not state otherwise or exercise your right of deletion. At the end of this retention period, your data will be deleted or, alternatively, anonymised.

• In the event that you become a member of our workforce, your data will be kept in your employee file for as long as the relationship with our company is maintained and, after the termination of this relationship for any reason, for the applicable statutory limitation periods. In this case, they will be processed for the sole purpose of accrediting compliance with our legal, fiscal and/or contractual obligations. At the end of these limitation periods, your data will be deleted or, alternatively, anonymised.

WHAT ARE YOUR RIGHTS

We inform you that you can exercise your rights of access, rectification, erasure and portability, objection and/or restriction to the processing, through the postal and electronic addresses indicated.

Furthermore, if you consider the processing of your personal data violates the regulation or your rights to privacy, you may file a complaint:

• To our Information Officer, through the electronic and postal addresses indicated.

• To the applicable Data Protection Authority.

DATA PROTECTION FOR SOUTH AFRICA

1. The Protection of Personal Information Act 4 of 2013 (“POPIA”) regulates the protection of Personal Information Processed in South Africa. As such, the Processing of Personal Information will be done in accordance with POPIA by our South African offices and in line with the principles reflected in the Atlantica privacy policy.

2. Capitalised terms herein will have the meaning ascribed thereto in POPIA.

3. POPIA provides for the protection of Personal Information of both juristic and natural persons. In South Africa, Atlantica may Process the Personal Information of both natural and juristic persons. This will be done in accordance with POPIA.

4. POPIA provides Data Subjects with a number of rights. These rights include –

4.1.  a right of access: subject to certain exceptions, a Data Subject after providing adequate proof of identity has the right to –

4.1.1. request Atlantica to confirm whether any Personal Information is held about the Data Subject; and/or

4.1.2. request from Atlantica a description of the Personal Information held including information about third parties who have or have had access to Personal Information.

4.2. a right to request correction or deletion: a Data Subject may request Atlantica to –

4.2.1. correct or delete Personal Information about the Data Subject in our possession or control that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or obtained unlawfully; and/or

4.2.2. destroy or delete a record of Personal Information about the Data Subject that Atlantica is no longer authorised to retain in terms of the relevant legislative provision.

4.3. a right to withdraw consent and to object to processing: a Data Subject that has previously consented to the Processing of his/her/its Personal Information has the right to withdraw such consent and may do so by providing Atlantica with notice to such effect to our Information Officer (at the contact details set out in paragraph 6 below). Furthermore, a Data Subject may object, on reasonable grounds, to the Processing of Personal Information relating to him/her/it;

4.4. a right to not be subjected to direct marketing by means of unsolicited electronic communications: a Data Subject has a right not to be subject to direct marketing by means of unsolicited electronic communications unless you have given us your consent or you are an existing customer of ours;

4.5. a right not to be subjected automated decision making: a Data Subject has a right not to be subject to a decision which results in legal consequences for him/her/it which is based solely on the basis of the automated Processing of Personal Information.

5. To exercise the above rights, please contact the Information Officer of Atlantica at the contact details set out in paragraph 6 below.

6. The contact details of the South African Information Officer are as follows –

– Address: Office 103, Ancorley Building

45 Scott Street

8800 Upington

South Africa

– Email: