Shareholders Privacy Policy

NATURGY ENERGY GROUP, S.A. PRIVACY POLICY

I. DATA CONTROLLER

Naturgy Energy Group, S.A. (Naturgy), with registered address at Avenida América, 38, 28028, Madrid, and Tax Code (C.I.F.) A-08015497, is the data controller holding your personal data.

II. THE PERSONAL DATA WE PROCESS

II.1. Origin of the personal data we process

Personal data provided by shareholders processed by Naturgy may come from the following sources:

Data provided directly to Naturgy by the shareholder.

II.2. Categories of personal data we process

Naturgy may process personal data of different types, depending on the purpose for which they are to be used:

Identification and contact details, such as: full name, identity document (DNI), passport or foreigner identity document (NIE), email, postal address, telephone.

III. PURPOSE OF PROCESSING, LAWFUL BASIS, RECIPIENTS AND STORAGE PERIOD

The table below contains information on each of the data processing actions undertaken by Naturgy:

Processing purpose: reason why Naturgy processes your personal data.
Legal Grounds: the legal grounds that entitle Naturgy to process your personal data for each of the purposes described. When the basis is your consent, it means that your data will only be processed for that purpose when you have previously indicated that you consent to such processing through a statement or a clear affirmative action, in which case you have the right to withdraw your consent at any time, without retroactive effect, if you so wish.
Recipients: those third parties with whom, when applicable, your personal data may be shared and the reason for such action. Certain suppliers and service providers contracted by Naturgy may also have access to your personal data so that, as data processors, they may assist Naturgy in achieving the corresponding processing purpose. Said suppliers will be party to a data processing contract in order to guarantee legal compliance in terms of personal data protection.
Storage period: period of time for which Naturgy will process your personal data. However, pursuant to applicable legislation, your data may subsequently remain blocked in our systems so that it can potentially be provided to courts and tribunals, the Public Prosecutor’s Office or competent public bodies for the purpose of establishing possible liabilities stemming from the processing activity, and only for the prescription period thereof.

PROCESSING PURPOSE	LAWFUL BASIS	RECIPIENTS	STORAGE PERIOD	COMMENTS
Send you information of interest, by any means, on Naturgy activities, initiatives and other events (Shareholders’ Meeting, dividends, results, etc.). .	The consent that you provide when entering your data on the form.	Your personal data will be disclosed to third parties when Naturgy is legally obliged to do so. Naturgy’s service providers and suppliers may also have access to your data, in their capacity as data processors, with whom we have signed the corresponding contracts in order to fulfil the aforementioned purpose.	Naturgy will store your data until you request their erasure or revoke the consent given. Subsequently, the data blocking obligations imposed by current legislation may be applicable.	You may revoke your consent or oppose the processing of your data for the purpose indicated at any time and free of charge.
To manage the requests submitted by you to exercise your individual rights regarding the protection of personal data.	Compliance with the legal obligation imposed on the controller by Regulation (EU) 2016/679 (GDPR), and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).	Those service providers and suppliers of Naturgy with whom, as data processors, we may have signed the corresponding contracts in order to achieve the aforementioned purpose may have access to your personal data.	Naturgy will retain and process your data for this purpose for as long as necessary for the purpose described. Subsequently, the data blocking obligations imposed by current legislation may be applicable.

PROCESSING PURPOSE

LAWFUL BASIS

RECIPIENTS

STORAGE PERIOD

COMMENTS

Send you information of interest, by any means, on Naturgy activities, initiatives and other events (Shareholders’ Meeting, dividends, results, etc.).

The consent that you provide when entering your data on the form.

Your personal data will be disclosed to third parties when Naturgy is legally obliged to do so.
Naturgy’s service providers and suppliers may also have access to your data, in their capacity as data processors, with whom we have signed the corresponding contracts in order to fulfil the aforementioned purpose.

Naturgy will store your data until you request their erasure or revoke the consent given.

Subsequently, the data blocking obligations imposed by current legislation may be applicable.

You may revoke your consent or oppose the processing of your data for the purpose indicated at any time and free of charge.

To manage the requests submitted by you to exercise your individual rights regarding the protection of personal data.

Compliance with the legal obligation imposed on the controller by Regulation (EU) 2016/679 (GDPR), and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

Those service providers and suppliers of Naturgy with whom, as data processors, we may have signed the corresponding contracts in order to achieve the aforementioned purpose may have access to your personal data.

Naturgy will retain and process your data for this purpose for as long as necessary for the purpose described.

Subsequently, the data blocking obligations imposed by current legislation may be applicable.

IV. INTERNATIONAL DATA TRANSFERS.

Naturgy does not foresee any international data transfers when processing your personal data. Nevertheless, you are hereby informed that the Shareholders’ General Meeting is subject to audiovisual recording and public broadcasting online under the terms described in section III above, without geographical limitation.

However, if in order to process your data for the indicated purposes, said data needs to be transferred outside of the European Economic Area (“EEA”), such transfers would take place after signing the standard data protection clauses adopted by the European Commission for international data transfers with said companies located outside of the EEA or after adopting the other appropriate safeguards provided for under applicable regulations.

V. DATA PROTECTION OFFICER

Naturgy has appointed a Data Protection Officer, whose contact details are as follows:

– Postal address: Avenida de América, 38 – 28028, Madrid

– Email: dpd-dpo@naturgy.com

VI. RIGHTS REGARDING YOUR PERSONAL DATA

The rights to which you are legally entitled, when applicable, are as follows:

RIGHT	CONTENT
Access	You may consult any of your personal data that may be subject to processing activities by Naturgy.
Rectification	You may change your personal data if they are inaccurate or incomplete.
Erasure	You may ask for your personal data to be erased.
Objection	You may ask for your personal data not to be processed on the basis of legitimate interest. Furthermore, you may object to the processing of your personal data for direct marketing purposes, including the creation of profiles when this action is related to direct marketing.
Limitation on processing	You may ask for restrictions to be imposed on the processing of your data: – While the accuracy of your data is being challenged. – When the processing is unlawful but you object to the erasure of your data and request a restriction on the use thereof. – Whenever Naturgy no longer needs to process your data but you need them to bring or defend against legal action. – When you have objected to the processing of your data for compliance with action taken in the public interest or to meet a legitimate interest, while checks are performed to verify that the legal grounds for processing take precedence over your objection.
No Automated Decisions	You may ask not to be the subject of decisions based solely on the automated processing of your data.
Withdraw consent	At any time and without retroactive effect, you may withdraw any consent you may have provided in the past to authorise the processing of your data for a specific purpose.
Portability	You may receive, in a digital format, the personal data that you provided to us and pass them on to another company.

You may exercise the aforementioned rights via the following channels:

Email: dpd-dpo@naturgy.com
Postal address: Avenida de América, 38 – 28028, Madrid

The subject line of your message must state “Protección de Datos Personales. Accionistas”. Given that these are individual rights, Naturgy must ensure that they are being exercised by the data subject or authorised representative. Thus, if Naturgy has any doubts about your identity, it may request additional information for confirmation purposes, for example, a copy of your identity document (DNI/NIE), passport or equivalent. You may also use your electronic signature instead of your identity document (DNI). If rights are exercised by someone authorised by the data subject, evidence of the identity of the authorised party must be provided and the authorisation accredited.

Naturgy will provide the requested information within one month from receiving the request. Said period may be extended to two months, if necessary, based on the complexity and number of requests.

If you believe that we have not duly processed your personal data, you may contact the Data Protection Officer via any of the aforementioned channels.

In any event, we hereby inform you that, if you believe that the regulations governing personal data protection have been violated in the processing of your personal data, you are also entitled to lodge a complaint with the competent Supervisory Authority (e.g. Spanish Data Protection Agency – www.aepd.es).

November 2023