At Aena, we are committed to guaranteeing that our clients' personal data will be used in a transparent and secure manner, and therefore inform you, that in accordance with the provisions of current Personal Data Protection regulations and, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights in this privacy policy.

1. Who is the data Controller?

Aena SME, SA (hereinafter, Aena)

Address: Peonías, 12, 28042 Madrid

CIF/ Tax ID number: A86212420

Contact telephone no.: (+34) 91 321 10 00

Commercial Registry of Madrid, Volume 28,806, Folio 211, Section 8, Sheet M-518648.

Data Protection Officer: dpd@aena.es

2. What personal data can we process?

The personal data that Aena may process comes directly from you or is generated as a result of your browsing and use of the website or application. Specifically, the data that we can process is:

• Identification and contact data (name, surname, ID no., address, email, telephone number).
• Data on economic and transactional information (data on purchases, reservations, orders, returns and means of payment).
• Information about your tastes and preferences based on your browsing history and purchases made.
• If you use the Parking service and being a member of Aena Club, your car's registration number will be stored in Aena Club in order to establish the period of time that you have used the parking services and to be able to charge for them.
• Aena will compile information on Wi-Fi access points (location) and data relating to their latitude and longitude, so that this information can help us to show their location and provide our services
• Some companies that participate in the Food to Fly, Aena Travel and Shop to Fly portals (hereinafter “Aena Marketplaces”) provide us with a report of the products and/or services purchased by you and those that have been initiated within it.
• In the event that you are an Aena Club member and apply for the loyalty card, the collaborating bank will inform us of your details to verify that you are a member of the Club. It will also inform us when you are a cardholder and have made a certain number of purchases with the card so that you can enjoy the advantages and benefits linked to the club.
• Your comments and evaluations that you publish about the products and services offered on the Aena MarketPlace portal. Please note that they will be considered public and not confidential, allowing access to said information by any user who browses the portal.
• The data provided through your social media, if the access registration for our services is made through your social media account enabled for registration.
• To offer certain services that require registration, Aena may obtain personal contact information provided by the User when accessing or registering for the Wi-Fi service, in order to provide the service. In particular, we inform you that if you register access via a social media account, we may use the data provided through the social media, as detailed above. If the registration is made directly through the corresponding portal, we may use the personal data provided when registering for access, as well as your SIM card in order to identify you as a user and ensure the best possible connection (the latter for the Wi-Fi service). Likewise, there is other data that is recorded in the system and which is also mandatory for the purposes related to the Wi-Fi service, such as the name of the device connecting to the Wi-Fi, MAC address, IP address, telephone number and IMEI (in the case of access via a telephone) and connection and browsing data.

We inform you that all the data that we request or may request is necessary for the purposes described in this privacy policy and if you do not provide said data, we will not be able to contact you or offer you a response to any request you may make. For this reason, we reserve the right not to respond or process any type of request if you do not provide us with the aforementioned data.

It is important that you guarantee the veracity of the personal data you provide us with, and we may periodically ask you to review and update it, so that said personal data is as accurate and truthful as possible.

3. Why do we process your data? With what legitimacy do we process them?

The personal data that you may provide us with or that may be collected through cookies on this website or application will be processed for the purposes indicated below:

As a registered member of Aena Club (full client):

• Management as a member of Aena Club and the contracted subscription. Processing based on the contractual relationship established by accepting the Terms and Conditions of the Club.

• Sending members information about the latest Aena service advantages that, as exclusive members of the club, they can enjoy, and how to access them. To do this, Aena will send you communications with information about VIP Services, Parking, and other Aena airport management services, for as long as you remain a member of the Club and have not objected to receiving them.

  This processing is based on your status as an Aena member, and the provision of services and offers aimed at Aena Club members, as detailed in the terms and conditions of this club, which you may object to at any time through the channels provided for this purpose, either when you register as a member and in the email offer received or in your Aena Club personal area.

  We inform you that, if you object to this processing, the functionalities of the service may be reduced, as we will not be able to inform you of the benefits available to you as a Club member.

  Aena Club is a service that Aena offers to the group of users registered as members of the club and its main and inherent purpose is to inform you of discounts, promotions, offers, news and benefits in certain Aena services, which you can access as a member of the club, as well as send you accurate and updated information about them and information related to your membership status. However, requesting to unsubscribe from said communications will mean that we will not be able to inform you of the discounts, promotions, offers, news and benefits that are applicable at all times to the services offered through the Club. Consequently, if you do not wish to receive these communications with information about said benefits, you may request to unsubscribe from them at any time, through the channels enabled for this purpose in this policy.

• Sending commercial electronic communications to inform you about other Aena airport management products and/or services other than those mentioned above. These electronic communications are sent by Aena -without any transfer of your data to third parties- and refer to communications relating to VIP Services, Parking, and other specific Aena airport management services, as well as further information beyond the aforementioned exclusive offers for club members.

  This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this policy.

• Sending quality and satisfaction surveys. Aena sends this type of survey about the services you have used to find out how satisfied you are, based on Aena's legitimate interest of finding out the opinions of its clients and take them into consideration for improving the quality of its services.

  For this purpose, we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in carrying out this type of survey, to improve the user experience and the service itself, concluding that there is a reasonable expectation on your part about this processing, in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this policy or by sending an email to dpd@aena.es.

• Sending other electronic marketing communications. These electronic communications are sent by Aena - without transferring your data to third parties, such as promotions and discount coupons from the Airport shops or third-party companies with which Aena collaborates, in the following sectors: automotive and vehicle rental, leisure, travel agencies, tourism, transport, airlines, restaurants, textiles, fashion, beauty and cosmetics, financial and insurance, press and magazines, gaming and betting.

  This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this policy.

• Access or log in to Wi-Fi, the Aena Marketplace, Aena Club, Commerce portals, and the Aena app through social media. You have the option to access or login through a social media network that offers this functionality (“social login”), whenever it is available on our home screen. This option can be used either to link your login to an existing account or to create a new one. In such cases, your access credentials, as well as your name and email address or telephone number (subject to prior authorisation, if necessary), will be imported from your social media account.

  When using this functionality, the social media network concerned may share additional information from your public profile with us, such as your name, gender, approximate age, or profile picture, in accordance with its own terms of use. We recommend that you review those terms carefully. Unless you give us your express consent, we will not retain this additional information.

  Additionally, using social login may involve sharing certain information about your activity with the social media network concerned. For this reason, we advise you to review your account’s privacy settings and consult that social media network’s privacy policy to understand how your data is managed.

  If you choose this access method, the processing of your personal data will be based on the consent that you grant us by authorizing the transfer of information from the social media network.

• Management of the environmental classification badge. In the event that you, as an Aena Club member, make a Parking reservation, a public consultation will be carried out through the DGT Statistical Portal to check the environmental classification badge associated with the vehicle registration. This processing is carried out in order to offer benefits or discounts to those users with less polluting vehicles based on Aena's legitimate interest in promoting protection of the environment.

  For this reason, we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in making this consultation with the DGT, to improve the user experience. Our conclusion is that there is a reasonable expectation on your part regarding this processing , in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this policy or by sending an email to dpd@aena.es.

• Creation of profiles or customer segmentation. Aena will process the information collected to create a commercial profile and/or segment customers in order to send personalised commercial offers and improve your experience as a user of our mobile application.

  This processing is based on providing the service of sending communications to Aena members (“according to my tastes and preferences”), which is detailed in the terms and conditions of this club, which you may object to at any time through the channels provided for this purpose in the email received as well as in the Aena Club personal area.

  This processing involves profiling and decision-making on the generated profile. More information in section “5. What do we mean by profiling and making decisions on the profile developed?” of this policy.

• Management of Car Number Plate Payments. The vehicle number plate data and credit card data that the user has provided in their Aena Club customer profile will be processed for the purpose of paying for the parking stay.

  This processing is based on the execution of a contract by accepting the terms and conditions of this service. For more information, consult the Terms and Conditions of the Car Number Plate Payment Service.

• Mobile Payment Management. We inform you that Aena will store the last four digits of your payment card to identify the card used to pay for the contracted service. In the case of using the Parking service, the car's number plate will be stored in order to establish the period of time that you have used the parking services and to be able to invoice them. If you pay through your mobile device for access to one of the VIP Rooms managed by Aena, your ID will be collected for identification purposes.

  This processing is based on the execution of a contract by accepting the terms and conditions of this service. For more information, consult the Aena Club Terms and Conditions.

• We will process your data to carry out an Anonymisation process, based on our legitimate interest, thus obtaining aggregated and anonymous data, for subsequent statistical uses or other legitimate business purposes.

  For this purpose we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in carrying out this type of processing for statistical purposes, concluding that there is a reasonable expectation (elimination of all data that allows identification, through processes of deletion, aggregation or replacement of said data with others that cannot be associated with a natural person), in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this policy or by sending an email to dpd@aena.es.

• Management of products with a distinctive logo or link to Aena and other collaborating companies (bank cards). Your identification data and credit card data will be processed, in your capacity as an Aena Club customer with a credit card from the bank, or with the product of the collaborating company linked to Aena.

  Please be informed that as part of the commitment we have made with the companies, the membership status will be shared with collaborating companies whenever the customer acquires the product that Aena and the collaborating company offer, with the purpose of providing our members with exclusive promotions and benefits. In all cases, Aena guarantees the protection of your personal data and only the necessary data will be shared with these companies in order to provide you with an exceptional experience as a member of our club.

  Aena currently has an agreement with the bank BANKINTER to offer our interested customers a bank card.

  This processing is based on the execution of a contractby accepting the terms and conditions of this service. For more information, check the bank card Terms and Conditions.

• When making a purchase or reservation in any of our services: Parking reservations, VIP Services, Aena Marketplaces, via our web portals or via our App, Wifi Service, both as a member of Aena Club (Full user) or as a guest (by registering using your email).

• When carrying out the purchase or reservation process, the data that you have provided us with will be processed for the purpose of managing, processing and monitoring the products and/or services that you purchase or reserve, through our website or App, data processing is based on the execution of a contract by accepting the specific terms and conditions of each service indicated above.

• If, in addition to the above, the access registration is made via social media, we may utilise the data provided relating to the user's browsing, using this information to analyse and understand the use that people make of our services and make these more intuitive.

• Sending quality and satisfaction surveys. Aena sends this type of survey about the services you have used to assertain how satisfied you are, based on Aena's legitimate interest of finding out the opinions of its clients and take them into consideration for improving the quality of its services.

  For this purpose, we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in carrying out this type of survey, to improve the user experience and the service itself, concluding that there is a reasonable expectation on your part about this processing, in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this policy or by sending an email to dpd@aena.es.

• We will process your data to carry out an Anonymisation process, based on our legitimate interest , thus obtaining aggregated and anonymous data, for subsequent statistical uses or other legitimate business purposes.

  For this purpose we have carried out an internal legitimate interest assessment to weigh up and balance your right to data protection and our interest in carrying out this type of processing for statistical purposes, concluding that there is a reasonable expectation (elimination of all data that allows identification, through processes of deletion, aggregation or replacement of said data with others that cannot be associated with a natural person), in which specially protected data is not processed nor does it involve automated decision-making.

  You can object or request additional information about this processing through the channels enabled for this purpose in this policy or by sending an email to dpd@aena.es.

• Sending information about the contracted products or services. To do this, Aena will send you communications about the service(s) that you have contracted with us (VIP Services, Parking, and other Aena airport management services) as well as information about them, as long as you have not objected to receiving them.

  This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this policy.

• Sending electronic marketing communications to inform you about other Aena airport management products and/or services other than those already contracted. These electronic communications are sent by Aena - without the transfer of your data to third parties, and refer to Aena products and services other than those you are contracting.

  This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this policy.

• Sending other electronic marketing communications. These electronic communications are sent by Aena - without transferring your data to third parties, such as promotions and discount coupons from the Airport shops or third-party companies with which Aena collaborates, in the following sectors: automotive and vehicle rental, leisure, travel agencies, tourism, transport, airlines, restaurants, textiles, fashion, beauty and cosmetics, financial and insurance, press and magazines, gaming and betting.

  This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this policy.

• Creation of profiles or customer segmentation. Aena will process the information collected to create a commercial profile and/or segment customers in order to send personalised commercial offers and improve your experience as a user of our mobile application.

  This processing is based on your consent (“according to my likes and preferences”), along with consent for each type of marketing communications, which may be revoked at any time through the channels enabled for this purpose in this policy.

  This processing involves profiling and decision-making on the generated profile. More information in section “5. What do we mean by profiling and the adoption of decisions made on the profile that has been set up” in this policy.

• For the provision of the Aena Marketplace service (Food to Fly) through the geolocation of your data in order to locate you at the airport and offer you services accordingly.

  This processing is based on your consent, which may be revoked at any time through the channels enabled for this purpose in this policy.

• For the provision of Wifi services. This processing is based on the execution of the contract for the provision of a Wifi service according to the General Conditions of Use, as well as compliance with legal obligations related to article 31 bis of the Penal Code and obligation of Law 25/2007, on data conservation in electronic communications.

  Additionally, the data provided when you register to sign up for this Wi-Fi service, as well as the data obtained from browsing and location, may be used to provide you with a personalised experience by sending electronic marketing communications adjusted to your profile, if you have given authorisation, and advertising, as previously indicated.

  If, in addition to the above, the access registration is made via social media, we may utilise the data provided relating to the user's browsing, using this information to analyse and understand the use that people make of our Wi-Fi service and make this more intuitive.

  In the event that you revoke and/or unsubscribe from the indicated commercial and advertising communications and/or information sent by electronic means, AENA informs you that it will process the data associated with the device and the USER's registration credentials in order to process the withdrawal request. Under no circumstances does the withdrawal of consent condition the execution of the Wi-Fi service provision contract.

  Your data will be kept for the time necessary to fulfil the purpose for which it was collected, as well as for the legally established period of time as per Law 25/2007.

The personal data of minors under fourteen (14) years of age will be collected and processed based on the permission and consent granted by their parents, guardians or legal representatives through electronic communication to rgpd-derechos-comercial@aena.es. Therefore, if you are under 14 years of age, we ask you to refrain from providing personal data if you do not have the consent of your parents, guardians or legal representatives, Aena not being responsible for the actions of a minor under fourteen (14) years of age or a person who has an incapacity. Aena may process the data of those over fourteen (14) years of age with their consent, except in those cases in which the Law requires parental or guardian assistance.

4. Who is your data shared with?

In the case of requesting a service for the International Airport of the Region of Murcia, your data will be communicated to Aena Concessionaire Company of the International Airport of the Region of Murcia SME, SA, Aena subsidiary company that manages said airport, to provide the service.

This communication is carried out on the basis of being necessary for the execution of the contract.

Your data will be communicated to your bank, to make payment for the contracted services, as well as, where appropriate, to your company, in cases where said entity is the contracting party for the service you receive.

These communications are made on the basis of being necessary for the execution of the signed contract.

Your data may be communicated to the companies in the Aena MarketPlace in order to be able to proceed with the management of the service and/or product contracted by you.

These communications are made on the basis of being necessary for the execution of the contract signed between you and Aena or between you and said companies.

The Wifi service is provided by an external company at the Airports, therefore said company will have access to your data to be able to provide the service.

Likewise, Aena may communicate your data to third parties to whom it is obliged to transmit information, such as public authorities, in order to comply with the requirements of said authorities and the applicable regulations.

These communications are sent based on compliance with legal obligations.

If you have a bank card with an Aena link and logo, you are hereby notified that the bank (currently BANKINTER) will be informed of your status as a member of Aena Club or of any situation that modifies your status as an active user of Aena Club.

These communications are made in the event that you are a member of Aena Club and have contracted the loyalty bank card with the collaborating bank.

Some companies in the MarketPlace compile a report for us of the products and/or services purchased by you, as long as they are initiated in the MarketPlace.

These communications are sent based on the execution of the contract that you sign with said company when making your purchase or contracting a service with it.

The Aena Pets service is provided by an external company (PETPASS), so Aena will transfer your UID, name, surname(s), email address, and customer type. These communications will be carried out on the basis of the legitimate interest of Aena and PETPASS in providing a service that has been expressly requested by the user.

No further communications or international data transfers are foreseen unless legally required.

5. What do we mean by profiling and decision-making about the profile created?

As long as Aena has the legal right to send you marketing communications according to your tastes and preferences, we will use your interactions on the website and the contracting of products and/or services to adapt our advertising according to your preferences. Aena will process the information collected to create a commercial profile and/or segment customers in order to send personalised marketing offers and improve your experience as a user of our services.

If the access registration for our Services was made via social media, we may also use the data provided relating to user navigation, using this information to analyse and understand how people use our services and make them more intuitive.

Likewise, you have the right not to be subject to automated decision-making (including profiling), so you may exercise this right at any time following the instructions established in point “7. What are your rights regarding your personal data?” in this policy.

6. How long will we keep your personal data?

Your data will be kept as long as you maintain a relationship with Aena as a member of the Aena Club, do not withdraw the consent granted or do not exercise your rights, as well as during the corresponding legal periods to address possible claims and liabilities that arise from the processing.

Personal data subject to processing based on your consent will be kept to fulfil its corresponding purposes as long as you do not revoke it.

Without prejudice to the foregoing, additionally, your data will be kept duly blocked, while responsibilities may arise from the execution of our contractual or pre-contractual relationship, as well as for compliance with other legal obligations under the responsibility of Aena. In this regard, Aena guarantees that it will not process the data unless it is necessary for the formulation, exercise or defence of claims or when it is required to provide the same to the Public Administration, Judges and Courts during the period of prescription of your rights or legal obligations.

This processing regarding this subsequent conservation of data is based on compliance with legal obligations, specifically the obligation included in the personal data protection regulations.

7. What are your rights regarding your personal data?

Any interested party has the right to obtain confirmation about whether their personal data is being processed or not. Likewise, the General Data Protection Regulations stipulate that the interested party has the following rights:

• To access their data
• To request rectification or deletion of their data
• To request the limitation of the processing of their data
• The portability of their data
• To oppose the processing of their data
• To reject automated decision-making (profiling)

Their requests will be answered as soon as possible and, in any case, within a period of one month from receipt of their request.

This period may be extended for another two months if necessary, taking into account the complexity and number of applications. In any case, Aena will inform the interested party of the extension within the first month from the request.

The interested party has the right to exercise their recognised rights, as well as to withdraw the consents granted at any time or oppose their processing for commercial purposes, without affecting their management of the contracted service, via the following authorised means:

• Via the unsubscribe link included at the bottom of the communication received,
• In the event that the user is a member of Aena Club: By logging in to the portal or app, and accessing ‘My account’ to manage consents, delete the account, update or download personal data, or
• If you are a guest user: by visiting the portal https://preferencias.aena.es. Enter your email address and you will receive a new message at that address containing a link from which you can withdraw your consent, download your personal data, modify your data or request cancellation. The previous step is necessary to verify that you are exercising your rights from your registered email address and to prevent a third party from exercising them on your behalf, or
• Via the following email address rgpd-derechos-comercial@aena.es (indicating in the subject the right you wish to exercise and, if applicable, about what data processing), by writing to the address Calle Peonías, Nº 12, 28042-Madrid, as well as through the Procedures and Complaints Portal (https://tramitesyreclamaciones.aena.es).

If you have any questions you can contact our Data Protection Officer by email: dpd@aena.es.

The interested party has the right to file a claim with the Spanish Data Protection Agency (AEPD) as the supervisory and controlling authority in matters of data protection in the Spanish territory (www.aepd.es).

8. Modification of this Privacy Policy

Aena reserves the right to modify this Privacy policy. Aena may modify these conditions, by notifying the partners, a requirement that the parties expressly agree is understood to be fulfilled by publishing the modifications on the Aena website. www.aena.es or through Aena Club or any other Aena communication point.