At Aena, we are committed to guaranteeing that our clients' personal data will be used in a transparent and secure manner, and therefore inform you, in accordance with the provisions of current Personal Data Protection regulations and, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, of this privacy policy.

1. Who is the data Controller?

Aena SME, SA (hereinafter, Aena)

Address: Peonías, 12, 28042 Madrid

CIF/ Tax ID number: A86212420

Contact telephone no.: (+34) 91 321 10 00

Commercial Registry of Madrid, Volume 28,806, Document 211, Section 8, Page M-518648.

Data Protection Officer: dpd@aena.es

2. What personal data can we process and where does it come from?

The personal data that Aena may process comes directly from you or is generated as a result of your browsing and use of the website or app.

The personal data of minors under fourteen (14) years of age will be collected and processed based on the permission and consent granted by their parents, guardians or legal representatives through electronic communication to rgpd-derechos-comercial@aena.es. Therefore, if you are under 14 years of age, we ask you to refrain from providing personal data if you do not have the consent of your parents, guardians or legal representatives. Aena shall not be held responsible for the actions of any minor under fourteen (14) years of age or legally incapacitated person. Aena may process the data of those over fourteen (14) years of age with their consent, except in those cases in which the Law requires parental or guardian assistance.

Specifically, the data that we can process is:

• Identification and contact information (name, surname, ID no., sex, date of birth, address, post code, country, email address, telephone number, etc.).
• Financial and transactional data (information on purchases, reservations, orders, returns, means of payment, bank details, etc.).

  Should Aena Club enter into partnerships in the future with third-party companies to offer products or services linked to the Club (for example, cards or other identification media), such partner entities will only provide Aena with the data strictly necessary to verify membership status and, where applicable, to apply the programme’s promotional benefits. Currently there is no active financial card associated with the Aena Club program.

• Information relating to the employment relationship, in the case of Aena employees who are registered members of the “Enjoy Club: My Airport Community” (employee number (TIA)).
• Data about your tastes and preferences (based on your browsing and purchases). Data related to the use of the Parking service (your car registration number).
• Data on the use of the Wi-Fi service (connection and browsing data, name of the device that connects to the Wi-Fi, IP address, MAC address and telephone number. In the case of access via telephone, ICCID code (SIM card number) Eimei).
• Location data (information about Wi-Fi access points (location) or data relating to latitude and longitude)
• Data reported by collaborating companies (products and/or services acquired on the Food to Fly and Shop to Fly portals, hereinafter “Aena Marketplaces”).
• Data relating to comments and ratings (comments and ratings published on the products and services offered on the Aena Marketplace portal). Please note that they will be considered public and not confidential, allowing access to said information by any user who browses the portal.
• • The data provided through social media, if the access registration for our services is made through a social media account enabled for registration.

  In particular, we inform you that if you register access via a social media account, we may use the data provided through the social media, as detailed above. If the registration is made directly through the corresponding portal, we may use the personal data provided when registering for access, as well as your SIM card in order to identify you as a user and ensure the best possible connection (the latter for the Wi-Fi service).

We inform you that all the data that we request or may request is necessary for the purposes described in this Privacy Policy and if you do not provide said data, we will not be able to contact you or offer you a response to any request you may make. For this reason, we reserve the right not to respond or process any type of request if you do not provide us with the aforementioned data.

It is important that you guarantee the veracity of the personal data you provide us with, and we may periodically ask you to review and update it, so that said personal data is as accurate and truthful as possible.

3. Why do we process your data? On what legal basis do we process it?

The personal data that you may provide us with or that may be collected through cookies on this website or application will be processed for the purposes indicated below:

• Management as a registered member of Aena Club (full customer) and of the contracted subscription: This consists of managing all aspects related to your status as a member of Aena Club and the subscription contracted.

  Legal Basis: This processing based on the contractual relationship established by accepting the Terms and Conditions of the Club.

  Data processed: Identification and contact information.

• Management as a member of the “Enjoy Club: My Airport Community”: This consists of managing all aspects related to membership of the Enjoy Club: My Airport Community, a digital space where relevant content, services and exclusive benefits for the Airport Community are integrated. You can access this if you are an airport employee and have previously registered with Aena Club.

  Legal Basis: This processing is based on the contractual relationship established when you accept the Terms and Conditions of Aena Club, including any additional memberships that may be provided as a result of being a member of the club.

  Data processed: Identification and contact information, information relating to the employment relationship (employee number (TIA)).

• Creation of profiles or customer segmentation: This consists of Aena processing the information collected to create a commercial profile and/or segment customers in order to:

  Improve your experience as a user of the Aena Club mobile application.

  Allow Aena to send personalised commercial offers. This processing is based on providing the service of sending communications to Aena members ("according to my tastes and preferences"), which is detailed in the terms and conditions of this club, which you may object to at any time through the channels provided for this purpose in the email received as well as in the Aena Club personal area.

  Legal Basis: This processing is based on legitimate interest Aena's goal is to gather information about its customers and take it into consideration to improve the quality of its services, as well as to benefit them by sending information that may be more interesting to them, thus resulting in greater satisfaction with the quality of the services/products offered or finally contracted or acquired.

  For this purpose, we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in carrying out this type of survey, to improve the user experience and the service itself, concluding that there is a reasonable expectation on your part about this processing, in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this Policy.

  Data processed: Identifying data, contact information, tastes and references, data on comments and ratings, among other things.

  This processing involves profiling and decision-making on the generated profile. More information in section “5. What do we mean by profiling and decisions-making on the generated profile?” of this policy.

• Sending electronic commercial communications about the products or services contracted: This consists of Aena sending communications about the services you have contracted with us (VIP Services, Parking, and other services specific to Aena's airport management) as well as information about these.

  Legal Basis: This processing is based on your consent. You may opt out of receiving these communications at any time, through the channels enabled for this purpose, both when you register as a member, and through the offer email received, in your personal area in the Aena Club or by sending an email to dpd@aena.es.

  Data processed: identification and contact data, data on tastes and preferences, financial and transactional data.

• Sending electronic marketing communications to inform you about the latest benefits of Aena’s services, which you can enjoy exclusively as a Club member, and how to access these:

  Aena Club is a service that Aena offers to the group of users registered as members of the club and its main and inherent purpose is to inform you of discounts, promotions, offers, news and benefits in certain Aena services, which you can access as a member of the club, as well as send you accurate and updated information about them and information related to your membership status. Thus, this consists of sending communications about the services and offers directed to the members of the Aena Club and the Enjoy Club (VIP Services, Parking, Aena Pets and other services of the airport management, either from Aena or contracted), as detailed in the Terms and Conditions of this Club.

  Legal Basis: This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this Policy. We inform you that, if you object to this processing, the functionalities of the service may be reduced, since we will not be able to tell you about the discounts, promotions, offers, news and benefits that are applicable at any given time to the services offered through the Club.

  Data processed: identification and contact data, data on tastes and preferences, financial and transactional data, data relating to employment if employed by the Airport and registered in the Enjoy Club (employee number (TIA)).

• Sending electronic marketing communications to inform you about other Aena airport management products and/or services, different from those mentioned above. This consists of Aena sending—without transferring your data to third parties—electronic communications relating to VIP Services, Parking, Aena Pets, and other airport management services provided by Aena, as well as information about these, separate from the previously mentioned exclusive offers for Club members.

  Legal Basis: This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this Policy.

  Data processed: identification and contact data, data on tastes and preferences, financial and transactional data.

• Sending other electronic commercial communications other than those mentioned above: This consists of Aena sending electronic communications—without transferring your data to third parties—such as promotions and discount coupons for airport shops or for third-party companies that collaborate with Aena, relating to the following sectors: automotive and vehicle rental, leisure, travel agencies, tourism, transport, airlines, restaurants, textiles, fashion, beauty and cosmetics, financial and insurance, press and magazines, gaming and betting.

  Legal Basis: This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this Policy.

  Data processed: identification and contact data, data on tastes and preferences, financial and transactional data.

• Sending quality and satisfaction surveys: The purpose of this is for Aena to send these types of surveys about the services enjoyed in order to find out your level of satisfaction.

  Legal Basis: This processing is based on legitimate interest as Aena is committed to understanding the opinions of its customers and taking them into consideration to improve the quality of its services.

  For this purpose, we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in carrying out this type of survey, to improve the user experience and the service itself, concluding that there is a reasonable expectation on your part about this processing, in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this Policy.

  Data processed: Identifying data, contact information, tastes and references, data on comments and ratings, among other things. Information regarding employment details if you are an Airport employee and registered with the Enjoy Club (employee number (TIA)).

• Access or log in to Wi-Fi, the Aena Marketplace, Aena Club, Commerce portals, and the Aena app through social media: This consists of allowing you to use the access or login option through a social media platforms that offers this functionality (“social login”), whenever this option is available on our login screen. This option can be used either to link your login to an existing account or to create a new one.

  Legal Basis: This processing is based on your consent, given when you authorised the transfer of information from the social media platform.

  Data processed: Identification and contact details (your login credentials, as well as your name and email address or telephone number, will be imported from your social media account, subject to your prior authorisation, where required). The social media network concerned may share additional information from your public profile with us, such as your name, gender, approximate age, or profile picture, in accordance with its own terms of use. Unless you give us your express consent, we will not retain this additional information. Additionally, using a social media login may involve sharing certain information about your activity with the social media network concerned.

  We recommend that you carefully review the terms and conditions of use, as well as the privacy policy, of the social media platforms or networks of your choice.

• Management of the environmental classification badge: The purpose of this is to allow users with less polluting vehicles to enjoy benefits or discounts offered by Aena.

  In the event that you, as an Aena Club member, make a Parking reservation, a public consultation will be carried out through the DGT Statistics Portal to check the environmental classification badge associated with the vehicle registration.

  Legal Basis: This processing is based on Aena's legitimate interest in promoting environmental protection.

  For this reason, we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in making this consultation with the DGT, to improve the user experience. Our conclusion is that there is a reasonable expectation on your part regarding this processing , in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this Policy.

  Data processed: Identification data, contact data and data related to the Parking service.

• Management of Car Number Plate Payments: This consists of managing and processing payments from Aena Club customers associated with their stay in the car park.

  Legal Basis: This processing is based on the execution of a contract by accepting the terms and conditions of this service. For more information, consult the Terms and Conditions of the Car Number Plate Payment Service.

  Data processed: Vehicle registration details and financial and transactional data (relating to the credit card provided by the user in their Aena Club customer profile for the purpose of paying for Parking services).

• Management of Mobile Payments: This consists of managing payments made by a Club member using their mobile device, within the VIP Rooms or in relation to the Parking service.

  Legal Basis: This processing is based on the execution of a contract by accepting the terms and conditions of this service. For more information, consult the Aena Club Terms and Conditions.

  Data processed: Financial and transactional data (Aena will store the last four digits of your credit card in order to identify the card used to pay for the contracted service); vehicle registration details (where the Parking service is used, these will be stored in order to determine the period during which you have used the parking facilities and to enable billing); identification data (if you pay via your mobile device for access to one of the VIP Lounges managed by Aena, your National Identity Document (DNI) will be collected for identification purposes).

• Anonymisation Process: This consists of anonymising personal data in order to perform statistical processes.

  Legal Basis: This processing is based on Aena's legitimate interest in, obtaining aggregating and anonymising data, for subsequent statistical uses or other legitimate business purposes. IIn this regard, we have carried out an internal assessment, balancing your right to data protection against our interest in conducting this type of process for statistical purposes. We have concluded that there is a reasonable expectation that such processing will take place (through the removal of all data that could enable your identification, by means of deletion, aggregation or replacement with data that cannot be associated with a natural person). No special categories of data are processed, nor are automated decisions made. You may object to or request further information about this processing through the channels provided for this purpose in this Policy or by sending an email to dpd@aena.es. Data processed: Aggregated and anonymous data.

• Management of products bearing the Aena brand or linked to Aena and partner companies: This consists of applying, where appropriate, promotions or benefits associated with products or services offered by partner companies with which Aena maintains a current agreement.

  - There is currently no active financial bank card linked to the Aena Club programme, as the collaboration between Aena and the issuing banking entity ended on 29 April 2026.

  - Accordingly, no data processing will be carried out in relation to verifications, purchase reports or benefits derived from the former Enjoy Aena card.

  - Should new collaborations be established in the future, Aena will inform users in advance of the associated processing and, where appropriate, obtain the user’s consent.

• Provision of the Aena Marketplace service (FoodtoFly): This consists of geolocating your data in order to locate you at the airport and offer you the services offered.

  Legal Basis: This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this policy.

  Data processed: : Identifying data, contact data and geolocation data, data reported by collaborating companies.

• Provision of Wi-Fi services: The goal is to offer a personalised Wi-Fi service experience. Additionally, the data provided when you register to sign up for this Wi-Fi service, as well as the data obtained from browsing and location, may be used to provide you with a personalised experience by sending electronic marketing communications adjusted to your profile, if you authorised this, and advertising, as previously indicated.

  In addition to the above, if access registration is carried out through a social media platform, we may use the data provided relating to the user’s browsing activity. This information will be used to analyse and understand how users interact with our Wi-Fi service, with the aim of improving its performance and making it more intuitive.

  In the event that you revoke and/or unsubscribe from the indicated commercial and advertising communications and/or information sent by electronic means, AENA informs you that it will process the data associated with the device and the USER's registration credentials in order to process the withdrawal request. Under no circumstances does the withdrawal of consent condition the execution of the Wi-Fi service provision contract.

Your data will be kept for the time necessary to fulfil the purpose for which it was collected, as well as for the legally established period of time as per Law 25/2007.

• Legal Basis: The processing is based on the execution of the contract for the provision of a Wi-Fi service according to the General Conditions of Use, as well as compliance with legal obligations related to Article 31 bis of the Penal Code and obligation of Law 25/2007, on data conservation in electronic communications.

• Data processed: identification data, contact data, data related to your tastes and preferences, data related to the use of the Wi-Fi service, data relating to browsing (in the case of access from a social media platform).

4. Who is your data shared with?

Your personal data may be transferred in the following cases:

• In the case of requesting a service for the International Airport of the Region of Murcia, your data will be communicated to Aena Sociedad Concesionaria del Aeropuerto Internacional de la Región de Murcia SME, SA, an Aena subsidiary company that manages said airport, to provide the service. This communication is carried out as it is necessary for the execution of the contract.

  Your data will be communicated to your bank, to make payment for the contracted services, as well as, where appropriate, to your company,in cases where said entity is the contracting party for the service you receive. These communications are made on the basis of being necessary for the execution of the signed contract.

• Your data may be communicated to the companies in the Aena MarketPlace in order to be able to proceed with the management of the service and/or product contracted by you. These communications are made on the basis of being necessary for the execution of the contract signed between you and Aena or between you and said companies.

  Some companies in the MarketPlace compile a report for us of the products and/or services purchased by you, as long as they are initiated in the MarketPlace. These communications are sent based on the execution of the contract that you sign with said company when making your purchase or contracting a service with it.

• The Wi-Fi service is provided by an external company at the Airports, therefore said company will have access to your data to be able to provide the service.

• Likewise, Aena may communicate your data to third parties to whom it is obliged to transmit information, such as public authorities, in order to comply with the requirements of said authorities and the applicable regulations. These communications are sent based on compliance with legal obligations. Should products linked to Aena and managed by partner companies be introduced in the future, Aena may disclose to such entities the data strictly necessary to verify membership status, provided that a valid agreement is in place.

  There is currently no active bank card linked to the Aena Club programme, nor are any data disclosures made to banking institutions for the management of promotional benefits.

• The Aena Pets service is provided to Aena Club members by an external company (PETPASS). Aena will disclose the data necessary for the provision of this service (UID, first name, surname, email address and customer type). These communications will be carried out on the basis of the legitimate interest of Aena and PETPASS in providing a service that has been expressly requested by the user.

No further communications or international data transfers are foreseen unless legally required.

5. What do we mean by profiling and decision-making about the generated profile?

As long as Aena has the legal right to send you marketing communications according to your tastes and preferences, we will use your interactions on the website and the contracting of products and/or services to adapt our advertising according to your preferences. Aena will process the information collected to create a commercial profile and/or segment customers in order to send personalised marketing offers and improve your experience as a user of our services.

If the access registration for our Services was made via social media, we may also use the data provided relating to user navigation, using this information to analyse and understand how people use our services and make them more intuitive.

Likewise, you have the right not to be subject to automated decision-making (including profiling), so you may exercise this right at any time following the instructions established in point “7. What are your rights regarding your personal data?” in this policy.

6. How long will we keep your personal data?

Your data will be kept as long as you maintain a relationship with Aena as a member of the Aena Club, do not withdraw the consent granted or do not exercise your rights, as well as during the corresponding legal periods to address possible claims and liabilities that arise from the processing.

Personal data subject to processing based on your consent will be kept to fulfil its corresponding purposes as long as you do not revoke it.

Without prejudice to the foregoing, additionally, your data will be kept duly blocked, while responsibilities may arise from the execution of our contractual or pre-contractual relationship, as well as for compliance with other legal obligations under the responsibility of Aena. In this regard, Aena guarantees that it will not process the data unless it is necessary for the formulation, exercise or defence of claims or when it is required to provide the same to the Public Administration, Judges and Courts during the period of prescription of your rights or legal obligations.

This processing relating to the subsequent retention of data is based on compliance with legal obligations, specifically those established under personal data protection legislation and Law 25/2007 of 18 October on the retention of data relating to electronic communications and public communications networks.

7. What are your rights regarding your personal data?

Any interested party has the right to obtain confirmation about whether their personal data is being processed or not. Likewise, the General Data Protection Regulations stipulate that the interested party has the following rights:

• To access their data
• To request rectification or deletion of their data
• To request the limitation of the processing of their data
• The portability of their data
• To oppose the processing of their data
• To reject automated decision-making (profiling)

Their requests will be answered as soon as possible and, in any case, within a period of one month from receipt of their request. This period may be extended for another two months if necessary, taking into account the complexity and number of applications. In any case, Aena will inform the interested party of the extension within the first month from the request.

The interested party is entitled to exercise the rights granted to them, as well as to withdraw any consent given at any time or object to processing for commercial purposes, without this affecting the management of the contracted service, through the following available channels:

• Via the unsubscribe link included at the bottom of the communication received,
• In the event that the user is a member of Aena Club: By logging in to the portal or app, and accessing ‘My account’ to manage consents, delete the account, update or download personal data, or
• If you are a guest user: by visiting the portal https://preferencias.aena.es. Enter your email address and you will receive a new message at that address containing a link from which you can withdraw your consent, download your personal data, modify your data or request cancellation. The previous step is necessary to verify that you are exercising your rights from your registered email address and to prevent a third party from exercising them on your behalf, or
• Via the following email address rgpd-derechos-comercial@aena.es indicating in the subject the right you wish to exercise and, if applicable, about what data processing), by writing to the address Calle Peonías, No. 12, 28042-Madrid, as well as through the Procedures and Complaints Portal (https://tramitesyreclamaciones.aena.es).

If you have any questions you can contact our Data Protection Officer by email: dpd@aena.es.

The interested party has the right to file a claim with the Spanish Data Protection Agency (AEPD) as the supervisory and controlling authority in matters of data protection in the Spanish territory (www.aepd.es).

8. Modification of this Privacy Policy

Aena reserves the right to modify this Privacy policy. Aena may modify these conditions, by notifying the partners, a requirement that the parties expressly agree is understood to be fulfiled by publishing the modifications on the Aena website. www.aena.es or through Aena Club or any other Aena communication point.

This policy was updated in February 2026 to reflect the termination of the collaboration between Aena and Bankinter on April 29, 2026, and the consequent elimination of non-financial benefits associated with the Enjoy Aena card.

Last updated, February 2026