Shareholder privacy statement

Personal shareholders data protection

Pursuant to the applicable legislation on the protection of personal data, European Data Protection Regulation (GDPR 2016/679) and implementing regulations, shareholders are informed of the existence of automated processing of personal data provided by shareholders or by the banking institutions, companies and securities agencies in which such shareholders have deposited their shares, through the entity legally authorised to keep the book-entry register. The purpose of this processing is the management and administration of the shareholders' data and, where appropriate, those of their representatives, as well as the due information and communication to the investor.

Ercros S.A., in its capacity as data controller, hereby informs that it has adopted the legally required security measures in its facilities, systems and files, guaranteeing the confidentiality of personal data. The custody of the documents generated, for a period of no less than five years.

Ercros S.A. reserves the right to communicate to the competent authorities the personal data and any other information in its possession or accessible through its systems that may be required in accordance with the applicable legal and regulatory provisions, as well as upon prior judicial request. In our management of shareholder information, there is no international transfer of data, nor is profiling carried out anonymously on the basis of the information provided by the data subject himself/herself.

Data subjects may exercise their rights of access, rectification, deletion, limitation of processing, data portability and opposition by the following means:

• Sending a written communication to the registered office of Ercros S.A., indicating: "For the attention of the privacy officer - Exercise of rights", or
• By e-mail: privacidad@ercros.es.