Data Protection Policy

1.    Data controller

Endesa, S.A. holder of Tax No. A28023430 shall be the data controller under this policy. Data controller contact details are as follows: postal address: 60 C/ Ribera del Loira, 28042 Madrid, Spain.

2.    Purpose and processing

The personal data provided by shareholders (to exercise or delegate their attendance and voting rights at Shareholders’ Meetings and to enable communications) or that are provided by the banking entities, companies and securities brokers in which the said shareholders have deposited their shares shall be stored and processed by Endesa, S.A. to enable communication with the shareholder within the framework of corporate relations and to enable compliance with related legal obligations.

Personal data storage limitation

Shareholder personal data shall be kept as long as they are required to meet the above purposes. Whenever they are no longer needed for this purpose, the data shall be blocked throughout the period in which they may be required for prosecution or defence purposes in administrative or judicial actions and may only be unblocked and processed again for this reason. After this period, the data shall be definitively erased.

3.    Lawfulness of the processing

The legitimate interest of Endesa, S.A. is the legal basis to process shareholder data as is compliance with any related legal obligations. Accordingly, the refusal to provide the requested personal data or the provision of inaccurate or incomplete data may affect your activity as a shareholder in Endesa S.A.

Shareholders are responsible for the reliability of the data they provide and for notifying Endesa S.A. of any future changes to them.

4.    Data recipients

Your personal data may be transferred to Public Administrations, Authorities and Bodies, including Courts and Tribunals, when so required by applicable regulations.

Personnel belonging to service providers that Endesa hires or may hire and which act as data processors may also be given access to your personal data.

5.    Security measures

To ensure the efficiency and effectiveness of its Data Protection Policy, Endesa S.A. has adopted the necessary technical and organisational security measures to prevent any alteration, loss, misuse, unauthorised processing and accessing or theft thereof in accordance with the current state-of-art of the technology.

6.    Shareholder rights in relation to the processing of their personal data

Shareholders can exercise their rights of access, rectification, erasure, restriction of processing and portability of the data in those cases and within the scope established by the regulations applicable at any time.

To exercise these rights, Endesa, S.A. can be contacted through any of the following channels:

• Post, attaching photocopy of your National ID card, passport or any other identification document, and stating your request, addressed to the Secretary's Office of the Endesa, S.A. Board of Directors, 60 C/ Ribera del Loira, 28042 Madrid.
• Email to eoaccionista@endesa.es containing the following information: name and surname of the data subject, address for the purposes of notifications, photocopy of their National ID card, passport or any other identification document, and statement of the request.
• Freephone: +34 900 666 900

You are also hereby informed of your right to file a complaint with the Spanish Data Protection Agency.

7.    Data Protection Officer

Endesa, S.A. has appointed a Data Protection Officer for the Endesa Group. Protection officer contact details are as follows: postal address: 60 C/ Ribera del Loira, 28042 - Madrid, Spain Email: dpo@endesa.es.