Last updated version: 27/06/2022

In compliance with the current regulation regarding personal data protection, the Company informs you of the following:

DATA CONTROLLER AND INFORMATION OFFICER

We inform you that Atlantica Sustainable Infrastructure PLC , with address at Great West House 17th Floor, Great West Road, Brentford, Middlesex, Greater London, United Kingdom, TW8 9DF, and/or its subsidiaries are the Data Controller of your personal data for the purposes described here. The specific company, which is the Data Controller of your data, will be the one who signed the contract with you.

The subsidiaries of Atlantica Sustainable Infrastructure PLC, which comprise the Atlantica group (hereinafter “Atlantica”) are listed in the last consolidated annual report published on the website www.atlantica.com.

You may contact the Information Officer in the postal address previously indicated or in the following email address .

HOW WE HAVE OBTAINED YOUR DATA

We have obtained your data from the commercial or contractual relationship that the company, entity or organization you work for or collaborate with has maintained (or currently maintains) with Atlantica.

We may also obtain your personal data from external sources with from which we may verify and approve you as a supplier of Atlantica. In particular, we may obtain personal data from the Achilles South Europe, S.L.U. entity.

WHAT PERSONAL DATA WE PROCESS

The data we will process for the purposes stated further on is limited to the business contact data related to the company, entity or organization you work for or with whom you collaborate.

WHAT WE PROCESS YOUR PERSONAL DATA FOR

Your business contact data is processed with the exclusive purpose of maintaining the commercial, contractual or collaborative relationships that Atlantica has with the company, entity or organization you work for or collaborate with.

Furthermore, we may use your business contact data in the company, entity or organization you work for or collaborate with, to send commercial communications, even by electronic means, regarding activities of our entity that are of a similar nature to those that motivate the existing relationship between our entity and the company, entity or organization that you work for or collaborate with.

WHY WE MAY PROCESS YOUR PERSONAL DATA

The processing of your business contact data relative to maintaining the relationship between Atlantica and the company, entity or organization you work for or collaborate with responds to  the precontractual or contractual relationship of our organization with you, specifically recognized in the privacy regulation.

The processing of your personal data in order for Atlantica to send information regarding activities similar to those that motivate the relationship with the company, entity or organization you work for or collaborate with, responds to a legitimate interest of our entity and is authorized by the existing regulation.

WHEN AND WHY WE MAY TRANSFER YOUR DATA TO THIRD PARTIES

Your data may be transferred to the following addressees for these reasons:

• Public Administrations: for compliance with legal obligations to which Atlantica is subject based on its activity.

• Accounting audit firms: to comply with the legal obligations of auditing accounts to which Atlantica is subject due to its activity.

• Law Enforcement: when our organization is required to provide information in compliance with a legal obligation.

• Providers who require access to your personal data in order to execute the order contracted with Atlantica and with whom Atlantica has subscribed confidentiality and data processing agreements that are necessary and mandatory by the privacy protection regulation.

• Atlantica may communicate your personal data to interested third parties that may arise from the development of any structural modification of our company or the contribution or transfer of business or branch of business activity. Such communication of data will be carried out under the protection of the legitimate interest of the Company consisting of the correct governance of the same.

• Other companies belonging to Atlantica. We will be able to communicate the data to the other companies that make up the Atlantica group and that you can see in the most recent Consolidated Annual Report published on the web site www.atlantica.com, all with the aim of correctly executing the Order and for internal organisational purposes, for example to correctly execute the Order based on the legitimate corporate interest of the Atlantica group.

• And any other transfer to which Atlantica is required by current legislation.

You will be duly informed if Atlantica transfers personal data to other addressees in the future.

INTERNATIONAL DATA TRANSFERS

Intragroup

Due to the international nature of the Atlantica group, it is possible that your personal data will be transferred and shared with Atlantica entities in our offices outside the European Union. Atlantica protects such transfers in accordance with the international data transfer agreements adopted, which incorporate the Standard Data Protection Clauses (Standard Contract Clauses) adopted by the European Commission. To obtain a copy of the Standard Contract Terms applicable in the EU adopted by Atlantica, please contact the Information Officer indicated at the beginning of this document.

From third parties Atlantica does not need to make international transfers of its data to countries that do not have regulations equivalent to the European one (“Third Countries”). In the event that our entity needs to hire the services of suppliers located in Third Countries for the treatment of their data, such hiring would be done after complying with all the requirements established by the data protection regulations and applying the necessary guarantees and safeguards to preserve your privacy.

For further information regarding warranties to your privacy, you may contact the Information Officer at the electronic or postal addresses previously indicated.

HOW LONG WE WILL STORE YOUR DATA

Your personal data will be stored while your relationship with Atlantica is ongoing and, once said relationship is terminated for whatever cause, for the applicable legal terms. Once the relationship is terminated, your data will be processed solely to the effects of demonstrating compliance with the legal or contractual obligations of the Company. Once said legal terms are met, your data will be eliminated or, alternatively, anonymized.

WHAT ARE YOUR RIGHTS

We inform you that you have a right to access your personal data, rectify inaccurate data, request their erasure when they are no longer necessary, oppose or limit the processing or request the portability of the data, through the postal and electronic addresses indicated.

Furthermore, if you consider the processing of your personal data violates the regulation or your rights to privacy, you may file a complaint:

• To our Information Officer, through the electronic and postal addresses indicated.

• To the applicable Data Protection Authority.

DATA PROTECTION FOR SOUTH AFRICA

1. The Protection of Personal Information Act 4 of 2013 (“POPIA”) regulates the protection of Personal Information Processed in South Africa. As such, the Processing of Personal Information will be done in accordance with POPIA by our South African offices and in line with the principles reflected in the Atlantica privacy policy.

2. Capitalised terms herein will have the meaning ascribed thereto in POPIA.

3. POPIA provides for the protection of Personal Information of both juristic and natural persons. In South Africa, Atlantica may Process the Personal Information of both natural and juristic persons. This will be done in accordance with POPIA.

4. POPIA provides Data Subjects with a number of rights. These rights include –

4.1.  a right of access: subject to certain exceptions, a Data Subject after providing adequate proof of identity has the right to –

4.1.1. request Atlantica to confirm whether any Personal Information is held about the Data Subject; and/or

4.1.2. request from Atlantica a description of the Personal Information held including information about third parties who have or have had access to Personal Information.

4.2. a right to request correction or deletion: a Data Subject may request Atlantica to –

4.2.1. correct or delete Personal Information about the Data Subject in our possession or control that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or obtained unlawfully; and/or

4.2.2. destroy or delete a record of Personal Information about the Data Subject that Atlantica is no longer authorised to retain in terms of the relevant legislative provision.

4.3. a right to withdraw consent and to object to processing: a Data Subject that has previously consented to the Processing of his/her/its Personal Information has the right to withdraw such consent and may do so by providing Atlantica with notice to such effect to our Information Officer (at the contact details set out in paragraph 6 below). Furthermore, a Data Subject may object, on reasonable grounds, to the Processing of Personal Information relating to him/her/it;

4.4. a right to not be subjected to direct marketing by means of unsolicited electronic communications: a Data Subject has a right not to be subject to direct marketing by means of unsolicited electronic communications unless you have given us your consent or you are an existing customer of ours;

4.5. a right not to be subjected automated decision making: a Data Subject has a right not to be subject to a decision which results in legal consequences for him/her/it which is based solely on the basis of the automated Processing of Personal Information.

5. To exercise the above rights, please contact the Information Officer of Atlantica at the contact details set out in paragraph 6 below.

6. The contact details of the South African Information Officer are as follows –

– Address: Office 103, Ancorley Building

45 Scott Street

8800 Upington

South Africa

– Email: