Last updated version : 16/06/2020

DATA CONTROLLER AND DATA PROTECTION MANAGER

We inform you that Atlantica Sustainable Infrastructure PLC (from now on, “Atlantica”), with address at Great West House 17^th Floor, Great West Road, Brentford, Middlesex, Greater London, United Kingdom, TW8 9DF is the Data Controller of your personal data for the purposes described here.

You may contact our Data Protection Manager in the address previously indicated or in the following email address .

HOW WE HAVE OBTAINED YOUR DATA

We have obtained your data from the relationship that you have maintained (or currently maintain) with Atlantica as member of the Board of Directors of the company.

WHAT PERSONAL DATA WE PROCESS

The data we will process for the purposes stated further on is the data you have provided to us before and during the relationship, including your particular contact data and your bank data.

WHAT WE PROCESS YOUR PERSONAL DATA FOR

Your personal data is processed with the exclusive purpose of maintaining the relationships that Atlantica has with you as member of the Board of Directors of the company.

WHY WE MAY PROCESS YOUR PERSONAL DATA

The processing of your personal data relative to maintaining the relationship between Atlantica and you is necessary for the execution of the contract between us.

WHEN AND WHY WE MAY TRANSFER YOUR DATA TO THIRD PARTIES

Your data may be transferred to the following addressees for these reasons:

• Public Administrations: for compliance with legal obligations to which Atlantica is subject based on its activity

• Providers who require access to your personal data in order to provide the services that Atlantica has hired from them, and with whom Atlantica has subscribed confidentiality and data processing agreements that are necessary and mandatory by the privacy protection regulation.

• Atlantica may communicate your personal data with interested third parties that may arise from the development of any structural modification operation of our company or the contribution or transfer of business or branch of business activity. Such communication of data will be carried out under the protection of Atlantica’s legitimate interest in the correct governance of the company.

• Other companies belonging to Atlantica. We may communicate the data to the other companies that comprise the Atlantica group and that you can see in the most recent Consolidated Annual Report published on the web www.atlantica.com, all with the purpose of correctly execute the relationship you hold with the company and with internal organizational purposes, for example to correctly keep you posted of the relevant information you may have access, or to assist to the boards of directors to which you may be summoned among other activities, all of them based on the legitimate corporate interest of the Atlantica group.

You will be duly informed if Atlantica transfers personal data to other addressees in the future.

INTERNATIONAL DATA TRANSFERS

Intragroup

Due to the international nature of the Atlantica group, it is possible that your personal data may be transferred and shared with Atlantica entities in our offices outside the European Union. Atlantica protects such transfers in accordance with the international data transfer agreements adopted, which incorporate the Standard Data Protection Clauses (Standard Contract Clauses) adopted by the European Commission. To obtain a copy of the Standard Contractual Clauses applicable in the EU adopted by Atlantica, please contact the Data Protection Manager indicated at the beginning of this document.

From third parties

Atlantica does not need to make international transfers of its data to countries that do not have regulations equivalent to the European one (“Third Countries”). In the event that our entity needs to contract the services of suppliers located in Third Countries for the processing of your data, such contracting would be carried out after fulfilling all the requirements established by the data protection regulations, and applying the necessary guarantees and safeguards to preserve your privacy. For further information on guarantees in relation to international data transfers, you may contact our Data Protection Manager at the postal and e-mail addresses indicated.

HOW LONG WE WILL STORE YOUR DATA

Your personal data will be stored while your relationship with Atlantica is ongoing and, once said relationship is terminated for whatever cause, for the applicable legal terms. Once the relationship is terminated, your data will be processed solely to the effects of demonstrating compliance with the legal or contractual obligations of the Company. Once said legal terms are met, your data will be eliminated or, alternatively, anonymized.

WHAT ARE YOUR RIGHTS

We inform you that you have a right to access your personal data, rectify inaccurate data, request their erasure when they are no longer necessary, oppose or limit the processing or request the portability of the data, through the postal and electronic addresses indicated.

Furthermore, if you consider the processing of your personal data violates the regulation or your rights to privacy, you may file a complaint:

• To our Data Protection Manager, through the electronic and postal addresses indicated.

• To the UK Information Commissioner’s Office (ICO) through its electronic or postal addresses.