PRIVACY POLICY - INVESTORS

1. DATA CONTROLLER:

GRUPO ANTOLÍN IRAUSA, S.A., domiciled in Burgos, at Carretera Madrid-Irún, Km. 244,8 (SPAIN), registered at Burgos Commercial Registry in volume 182, book 102 of Companies Section 3, sheet 133, page 1960, with employer identification number A09092305 (“Antolín” or the “Company”) is the controller of the personal data that are processed through the financial information distribution list for current or potential investors of Antolín. This clause provides information on the use that the Company will make of your personal data and your rights under the General Data Protection Regulation (“GDPR”). Should you have any doubts regarding the processing of your data, please write to Grupo Antolín Irausa, S.A. at (Ctra. Madrid-Irún Km. 244,8 09007 Burgos) or via the Company’s website, at: https://www.grupoantolin.com/en/contact-us?contact=privacy. Should you wish to use the whistle-blowing channel made available to you by Antolín, you may do so by accessing the following link: https://extranet.grupoantolin.com/Web/GA.CanalTransparencia.Web.

2. PURPOSES OF THE PROCESSING, LEGAL GROUNDS AND DATA DISCLOSURES:

In the following table you can consult the purposes of the processing of your data, the legal grounds that entitle the Company to process your data for those purposes, the possible disclosure of your data to third parties and the existence of potential international data transfers. You will receive information on the storage periods of your data on the Company’s systems, notwithstanding the obligations to block data set forth in applicable legislation. You may request a list of recipients of your data by sending an information request to the following address https://www.grupoantolin.com/en/contact-us?contact=privacy, indicating the specific recipients in relation to which you require information.

Purpose of the processing	Legal basis	Recipients	International transfers	Storage period
Sending of financial information on the Antolín Group that may be of interest to you, given the status of the company you work for as a current or potential investor in the Antolín Group.	Legitimate interest of Antolín: To maintain and/or promote the commercial investment relationship with your company, based on your request.	Your personal data shall not be disclosed on the basis of this processing. The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are: • Technology services and systems maintenance companies of Antolín.	Your data may be transferred to technology services and systems maintenance companies of Antolín located outside the European Union. If you would like to know where these companies are located, please send an information request to the following address https://www.grupoantolin.com/en/contact-us?contact=privacy and you will be provided with an updated list. These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.grupoantolin.com/en/contact-us?contact=privacy.	If you are a contact person for a potential investor of Antolín, your data will be processed by the Company for a period of three years following your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation. If you are a contact person for a current investor of Antolín, your data will be processed by the Company for the duration of the contractual relationship between the investor and Antolín. From this date onwards, your data may be used to send you this information for a period of three years from your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

Purpose of the processing

Legal basis

Recipients

International transfers

Storage period

Sending of financial information on the Antolín Group that may be of interest to you, given the status of the company you work for as a current or potential investor in the Antolín Group.

Legitimate interest of Antolín: To maintain and/or promote the commercial investment relationship with your company, based on your request.

Your personal data shall not be disclosed on the basis of this processing.

The categories of service providers of Antolín that may have access to your data as data processors, given the services they provide to the Group, are:

• Technology services and systems maintenance companies of Antolín.

Your data may be transferred to technology services and systems maintenance companies of Antolín located outside the European Union. If you would like to know where these companies are located, please send an information request to the following address https://www.grupoantolin.com/en/contact-us?contact=privacy and you will be provided with an updated list.

These transfers shall be carried out on the basis of the signature by these companies located outside the EU of standard data protection clauses adopted by the European Commission for international transfers, pursuant to article 46.2 GDPR. Should you require a copy of these contractual clauses please write to Antolín at: https://www.grupoantolin.com/en/contact-us?contact=privacy.

If you are a contact person for a potential investor of Antolín, your data will be processed by the Company for a period of three years following your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

If you are a contact person for a current investor of Antolín, your data will be processed by the Company for the duration of the contractual relationship between the investor and Antolín. From this date onwards, your data may be used to send you this information for a period of three years from your last interaction with Antolín (where interaction is understood to refer to the opening of an email, for example), notwithstanding the possible blocking of the data imposed by applicable legislation.

Necessary, up-to-date information

Completion of all the fields marked with an asterisk (*) in the forms you may be given is compulsory. Failure to complete any of these fields could lead to your being denied access to the functionalities of this tool.

In order to ensure that the information provided is constantly up to date and does not contain errors, you should inform Antolín as soon as possible of any amendments to or changes in your personal data. By clicking on the “Send” button (or similar) on such forms, you state that the information and data provided are accurate and true.

3. DATA SUBJECTS’ RIGHTS:

You may exercise the following rights:
(i)   right of access to your personal data to know which data are being processed and the processing operations that are being performed with that data;
(ii)   right to rectification of any inaccurate data;
(iii)   right to erasure of the personal data, where possible;
(iv)   right to request the restriction of the processing of your personal data where the accuracy, legality or need to process the data is doubtful and in the other cases envisaged in the GDPR;
(v)   right to object, at any time, for reasons related to your specific situation. The Company shall stop processing your data unless it has a compelling legitimate interest for the processing, or for the establishment, exercise or defense of legal claims.

In order to exercise these rights, you should send a written request by letter to Grupo Antolín Irausa, S.A. (Ctra. Madrid-Irún Km. 244,8 09007 Burgos) or via the Company’s website: https://www.grupoantolin.com/en/contact-us?contact=privacy. You must sign the request, include your full name and address, and indicate which rights you wish to exercise.

You may also lodge a complaint with the AEPD if you consider that data protection legislation has been breached in the processing of your personal data.

4. CONFIDENTIALITY AND SECURITY

The Company shall make all reasonable efforts to maintain the confidentiality of the personal information in question through this tool. Antolín has implemented and maintains strict levels of security in order to protect the personal data it processes from accidental loss and unauthorized access, processing or disclosure, having regard to the state of the art, the nature of the stored data and the risks to which they are exposed. This notwithstanding, the transmission of information via the Internet is not totally secure; accordingly, and despite the fact that the Company shall make its best efforts to protect your personal data, it cannot guarantee the security of such data during transit to the tool or systems of Antolín. All information provided by you shall be sent at your own risk. Once your personal data have been received, the Company shall use rigorous security functions and procedures to prevent any unauthorized access.

5. REGISTRATION OF USER NAME AND PASSWORD

The Company also informs you that by registering on this tool, you will be assigned a user name and password to enable you to sign in, at any time, as a “Registered User” and access the functionalities of the tool. You may change the password, although in this case you may not choose expressions or combinations of words and symbols that are rude, offensive, coincide with brands, trade names, store signs, corporate names, advertising slogans, names or pseudonyms of public figures or celebrities the use of which is not authorized and, in general, any that are contrary to the law or to good morals and generally accepted standards of decency.

It is essential that you ensure the confidentiality of your password at all times. You (or, failing that, your employer) will be the sole party responsible for the use of your account, authorized or otherwise, and, in this connection, you undertake to make diligent use of such information, not to make it available to third parties, and to notify its loss or theft.

6. THIRD-PARTY SITES

The tool may include links to sites controlled by third parties. You should remember that by accessing third-party websites using the tool, this privacy policy will no longer apply, since it does not reflect the privacy practices of third-party websites. The Company rejects any liability with respect to the privacy and processing of data by such third parties. Browsing and interaction on any other website, including those linked to this tool, is subject to the rules and policies of said website. Antolín recommends that Users read the data processing and privacy policies of the third-party websites.