INFORMATION ON THE PROCESSING OF PERSONAL DATA COLLECTED THROUGH THE REPORTING CHANNEL 1.

Who is responsible for the processing of your personal data?

Atlantica Corporate Resources SL. (“the “Company” and/or the “Responsible”) is the person responsible for the processing of personal data that is processed through the Complaints Channel (hereinafter, the “Channel”).

The Company respects the fundamental rights and freedoms of individuals, including the fundamental right to the protection of personal data.

This policy provides information on the use that the Company will make of your personal data. If you have any questions regarding the processing of your personal data, contact the Company at the following address: [email protected] or by letter to the address Albert Einstein S/N, Edificio Insur, Isla de la Cartuja, Seville, CP41092 (Seville).

2. What do we process your personal data for?

Your personal data is processed by the Company to (i) carry out investigations of communications received within the framework of the Channel in compliance with Law 2/2023 and (ii) carry out the management and processing of the corresponding files as a result of the communications received.

3. What categories of personal data do we process?

The categories of personal data that we process about you depend on the condition you have in the communication submitted. Below, the categories of data processed are identified according to the different interested parties:

· Informant (unless anonymous): the personal data provided in the communication will be processed

· Affected person: identification and contact data, personal characteristics, academic and professional data, employment details, economic, financial and insurance data and, potentially, specially protected data will be processed.

· Witness: Identifying data will be processed.

In cases where the interviews, meetings or communications are carried out by telephone or in meetings that are recorded, we may also process the image or voice of the participants in them.

4. From what sources do we obtain your personal data?

The informants' data are obtained from the communication submitted on the Channel.

The data of affected persons and witnesses are obtained from the communication submitted to the Channel and during the investigation process carried out.

5. What is the legal basis for the processing of your personal data?

We will process your personal data on the legitimate basis of compliance with the legal obligations established in Law 2/2023.

In the event that specially protected data (such as health data, sexual life, trade union membership, political opinions, religious convictions...) they will be treated, in addition to complying with the legal obligations indicated above, on the basis that the processing of such personal data is necessary for the formulation or defense of claims by the Company or the entity to which the complainant belongs.

People who communicate through some of the Channel's media must ensure that the personal data provided is true, accurate, complete and up to date.

6. Which service providers will be able to access your personal data?

The providers of legal services, compliance management, computer systems and technological tools of the Company may access your personal data during the provision of such services, although such data processing will always be carried out under the Company's guidelines and will be returned or duly destroyed at the end of the contracted service.

7. To which third parties will your personal data be transferred?

Your data may be transferred to (i): Public Prosecutor's Office for the fulfillment of the obligations established in Law 2/2023 (ii) State Security Forces and Bodies on the basis of the legitimate interest in defending the interests of the Company or complying with their requirements to the Company, (iii), if the communication submitted ends with the initiation of a judicial or administrative proceeding, your personal data will be transferred to the competent Administration, Judges and Courts on the legal basis of the interest legitimate of the Company linked to our right to effective judicial protection. If during the research process it has proved necessary to collect specially protected personal data, these would be transferred, in addition to the legitimate interest of the Company, on the basis that the processing is necessary for the formulation or defense of claims.

8. Are there international transfers of my personal data?

Some of the compliance management service providers are located outside the European Economic Area. Therefore, international transfers of your personal data may be made to the United States, on the basis of standard contractual clauses approved by the parties or to the United Kingdom, on the basis of the European Commission's Adequacy Decision

9. How long do we keep your personal data?

The data incorporated in the communications and those derived from the investigation procedure will be kept during the processing of the file until the final decision is adopted, and may be kept duly blocked during the statute of limitations for legal actions against the Company.

10. What are your rights?

We inform you that you have the following rights:

· Right to access your personal data to know which ones are being processed and the processing operations carried out with them;

· Right to rectify any inaccurate personal data;

· Right to delete your personal data, when this is possible;

· Right to request the limitation of the processing of your personal data when the accuracy, legality or the need for data processing is doubtful, in which case, we may keep the data and keep them for the exercise or defense of claims

· Right to object to the processing of your personal data. The Company will stop processing your data unless it has an overriding legitimate interest or for the formulation, exercise or defense of claims

You can exercise your rights at any time and free of charge by means of a communication, addressed: (i) to the email address [email protected]; or (ii) by letter to the address PAMA- Park of Environmental Activities of Andalusia. Albert Einstein S/N, Insur Building, Isla de la Cartuja, Seville, CP41092 (Seville).

Finally, we inform you that you have the right to file a complaint with the Spanish Data Protection Agency if you consider that a violation of data protection legislation has been committed with respect to the processing of your personal data.