“SACYR CARE” PRIVACY POLICY

1. Data Controller:

The entity responsible for the collection and processing of your personal data, when registering in "Sacyr Care" application, is SACYR, S.A. (hereinafter, SACYR), with Tax Identification Code A28013811 and registered office at Condesa de Venadito, 7, 28027, Madrid.

2. Data collected and purposes of processing:

SACYR will treat the information provided for different purposes, depending on the use of the Application:

• Process your contact details (name, surname and email) to manage your registration as a user of the application and provide you with travel assistance services in the destination countries (information about the country, safe forms of transportation, driver details, places of interest, etc.).
• Manage the comments you post on your wall to share your experiences with other users.
• Offer the possibility of sharing your location, which will allow the app to offer you assistance in the event of any incident or during journeys. To this end, once you register in the application, the application will ask you to give your consent to Sacyr in order to collect your location data for the sole purpose of keeping your safety. If you give your consent, you will be asked to activate the location on your mobile device and accept the "activation of the GPS signal". In this case, the application will locate you in the foreground and background (i.e. even when the application is not in use) on the route of a journey that you have previously requested via the application or when you activate the "panic button" in a situation that you consider to be dangerous. In the event of an alert, your response will provide us with your location in case you need help.

If you do not give your consent for this purpose, the application will not be able to provide the assistance service mentioned before. Please note that you can activate and deactivate the location option at any time.

• When the application is not in use and the user is not logged out, the "positioning location" will continue to be active, as the application will be located in the background. If the user has also performed any of the following actions: travel tracking / activation of the panic button, the user's location will continue to be active, informing about:

• Positioning location.
• Location for travel assistance.
• Location for activation of the panic button.

3. International transfers:

For the correct provision of the service offered by the application, your data may be communicated to Sacyr Group companies, which may be located in other countries outside the European Union, as well as to collaborators, bodies and authorities located in these countries, without prejudice to SACYR obtaining data protection guarantees from these entities.

4. Addressees of information:

In addition to what has been mentioned above, no other transfers of data are foreseen, unless they are authorised by law or the data are requested by the State Security Forces and Corps, the Public Prosecutor's Office, Judges or Courts, in the exercise of the functions attributed to them.

5. Legal basis legitimising the processing:

The legal basis for this processing is your consent given at the time of registration in the application.

6. Data retention period:

The data will be kept until the time you decide to unsubscribe from the "Sacyr Care" application and exercise your rights of deletion or opposition, or you revoke your consent.

7. Exercise of rights:

You may revoke the consent given and exercise your rights of access, rectification, deletion, limitation, opposition and portability, insofar as they are applicable, by sending a written communication to the e-mail address protecciondedatos@sacyr.com, identifying yourself as an employee of the Company, providing a photocopy of your ID card or equivalent document and specifying your request.

If you would like further information in this regard or consider that your right to data protection has been violated, you may contact the SACYR Data Protection Delegate (dpo@sacyr.com) or file a complaint with the Spanish Data Protection Agency (www.aepd.es)..