Last updated version: 05/05/2022

In compliance with current legislation on personal data protection, you are hereby informed of the following:

DATA CONTROLLER AND INFORMATION OFFICER

We inform you that Atlantica Sustainable Infrastructure PLC, whose registered office is at Great West House 17th Floor, Great West Road, Brentford, Middlesex, Greater London, United Kingdom, TW8 9DF, and/or its subsidiaries (hereinafter, “Atlantica”) are the Data Controllers of your personal data for the purposes described herein.

Atlantica’s subsidiaries are listed in our most recent Consolidated Annual Report published on the website www.atlantica.com.

You can contact our Information Officer at the address above or at the following e-mail address .

HOW WE HAVE OBTAINED YOUR DATA

Personal data are collected directly from you through the registration form in the Atlantica SafetyApp and using it.

WHAT PERSONAL DATA WE PROCESS, WHAT WE PROCESS YOUR PERSONAL DATA FOR AND WHY WE MAY PROCESS YOUR PERSONAL DATA

REGISTERING IN THE APPLICATION
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the following personal data: ·Identification data (name and surname, country we work, company where you are employed, department); ·Contact details (email).	We process your personal data in order to register you correctly in the SafetyApp as well as to provide you with sufficient information and recommendations on occupational risk prevention.	The processing of your personal data is legitimised by the employment relationship that you have with Atlantica or with the company with which Atlantica has contracted Maintenance and Operations services, as well as by compliance with the obligations regarding prevention of occupational risks to which Atlantica is subject.
SENDING NOTIFICATIONS WITHIN THE APPLICATION
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
Identification and contact details used for registration in the Application (name and surname, e-mail).	We process your personal data in order to send you, within the Safety App, emails and notifications related to safety measures that need to be taken at Atlantica ´s workplaces.	The processing of your personal data is carried out in execution of the employment relationship that you have with Atlantica or with the company with which Atlantica has contracted Maintenance and Operations services. This processing is necessary in order to comply with our legal obligations regarding the prevention of occupational risks.
LEGAL OBLIGATIONS
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
We process the personal data that you provide to us as well as the personal data generated in the course of your relationship with our organisation.	We process your personal data in order to comply with all legal obligations we are subject to.	The processing of your personal data is necessary in order to comply with legal obligations we are subject to.
APPLICATION ENHANCEMENT AND MAINTENANCE
CATEGORIES OF DATA	PURPOSES	LEGAL BASIS
Data and application usage traffic, cookies, tags, beacons.	We may use statistical, analytical and other aggregate data derived from the use of the Application in order to properly maintain and improve the Application.	The processing of your personal data is necessary to provide you accurately and securely with the information contained in the Safety App, in compliance with your employment relationship with Atlantica or with the company with which Atlantica has contracted Maintenance and Operations services. However, this processing will not require the use of personal data, for these reasons, the data will be processed in an aggregate way.

WHEN AND WHY WE MAY TRANSFER YOUR DATA TO THIRD PARTIES

Your data may be communicated to the recipients indicated below, for the following reasons:

• Public Administrations: in order to comply with legal obligations to which Atlantica is subject due to its activity.

• Accounting auditing companies: in order to comply with legal account auditing obligations to which Atlantica is subject due to its activity.

• Law Compliance: when our organisation is required to provide information in compliance with a legal obligation.

• Suppliers that require access to your personal data for the provision of the services that Atlantica has contracted from them and with which Atlantica has entered into confidentiality and data processing agreements necessary and mandatory under the privacy protection regulations.

• Atlantica may communicate your personal data to third interested parties that may arise from the development of any operation of structural modification of our company or from the transfer of business or branch of business activity. This data communication shall be based on Atlantica´s legitimate interest in the correct company´s governance.

• Other companies belonging to Atlantica: We may disclose personal data to companies that are part of the Atlantica group that can be consulted in the latest Consolidated Annual Report published on the website www.atlantica.com, in order to properly perform the relationship you have with Atlantica and for internal organisational purposes, for example, to properly assist you as an Atlantica´s contact person on the basis of Atlantica’s legitimate corporate interest.

If Atlantica communicates in the future personal data to additional recipients, we will inform you in a timely manner.

INTERNATIONAL DATA TRANSFERS

Intragroup

Due to the international nature of the Atlantica group, it is possible that your personal data may be transferred and shared with Atlantica entities in our offices outside the European Union. Atlantica protects such transfers in accordance with the international data transfer agreements adopted, which incorporate the Standard Data Protection Clauses (Standard Contract Clauses) adopted by the European Commission. To obtain a copy of the Standard Contractual Clauses applicable in the EU adopted by Atlantica, please contact the Information Officer indicated at the beginning of this document.

From third parties

Atlantica does not need to make international transfers of its data to countries that do not have regulations equivalent to the European one (“Third Countries”). In the event that our entity needs to contract the services of suppliers located in Third Countries for the processing of your data, such contracting would be carried out after fulfilling all the requirements established by the data protection regulations and applying the necessary guarantees and safeguards to preserve your privacy. For further information on guarantees in relation to international data transfers, you may contact our Information Officer at the postal and e-mail addresses indicated.

AUTOMATED DECISIONS

Atlantica does not adopt decisions that may affect you based solely on the automated processing of your personal data. All decision-making processes related to the purposes described above are carried out with human intervention.

HOW LONG WE WILL KEEP YOUR PERSONAL DATA

Please note that your data will be retained for as long as you are registered with the SafetyApp and maintain employment or professional ties with Atlantica. Once either of the above two situations come to end, Atlantica will keep your personal data in a blocked form, being those data only accessible in order to respond to legal requirements. Once the limitation period has elapsed, your data will be eliminated or, alternatively, anonymized.

WHAT ARE YOUR RIGHTS

We inform you that you can exercise your rights of access, rectification, erasure and portability, objection and/or restriction to the processing, through the postal and electronic addresses indicated.

Furthermore, if you consider the processing of your personal data violates the regulation or your rights to privacy, you may file a complaint:

• To our Information Officer, through the electronic and postal addresses indicated.

• To the applicable Data Protection Authority.

DATA PROTECTION FOR SOUTH AFRICA

1. The Protection of Personal Information Act 4 of 2013 (“POPIA”) regulates the protection of Personal Information Processed in South Africa. As such, the Processing of Personal Information will be done in accordance with POPIA by our South African offices and in line with the principles reflected in the Atlantica privacy policy.

2. Capitalised terms herein will have the meaning ascribed thereto in POPIA.

3. POPIA provides for the protection of Personal Information of both juristic and natural persons. In South Africa, Atlantica may Process the Personal Information of both natural and juristic persons. This will be done in accordance with POPIA.

4. POPIA provides Data Subjects with a number of rights. These rights include –

4.1.  a right of access: subject to certain exceptions, a Data Subject after providing adequate proof of identity has the right to –

4.1.1. request Atlantica to confirm whether any Personal Information is held about the Data Subject; and/or

4.1.2. request from Atlantica a description of the Personal Information held including information about third parties who have or have had access to Personal Information.

4.2. a right to request correction or deletion: a Data Subject may request Atlantica to –

4.2.1. correct or delete Personal Information about the Data Subject in our possession or control that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or obtained unlawfully; and/or

4.2.2. destroy or delete a record of Personal Information about the Data Subject that Atlantica is no longer authorised to retain in terms of the relevant legislative provision.

4.3. a right to withdraw consent and to object to processing: a Data Subject that has previously consented to the Processing of his/her/its Personal Information has the right to withdraw such consent and may do so by providing Atlantica with notice to such effect to our Information Officer (at the contact details set out in paragraph 6 below). Furthermore, a Data Subject may object, on reasonable grounds, to the Processing of Personal Information relating to him/her/it;

4.4. a right to not be subjected to direct marketing by means of unsolicited electronic communications: a Data Subject has a right not to be subject to direct marketing by means of unsolicited electronic communications unless you have given us your consent or you are an existing customer of ours;

4.5. a right not to be subjected automated decision making: a Data Subject has a right not to be subject to a decision which results in legal consequences for him/her/it which is based solely on the basis of the automated Processing of Personal Information.

5. To exercise the above rights, please contact the Information Officer of Atlantica at the contact details set out in paragraph 6 below.

6. The contact details of the South African Information Officer are as follows –

– Address: Office 103, Ancorley Building

45 Scott Street

8800 Upington

South Africa

– Email: