Cellnex values your privacy and is committed to protecting your personal data. This notice applies to the processing of your personal data in the context of landlords commercial and contractual relationships and explains how we collect, use, and protect your personal data, as well as how you can contact us if you have any questions about these matters and/or want to pose other privacy queries.

Your personal data will be processed by the Cellnex group company which is the party to the  lease contract or any similar type of agreement with you (the “Agreement“).  If you are in the process of agreeing a lease contract (or similar type of agreement) then your personal data will be processed by the Cellnex group company with which you are dealing.

This company acts as the Data Controller for your personal data under the UK General Data Protection Regulation (the “UK GDPR“) and the Data Protection Act 2018.

The personal data processed by Cellnex is that collected at the time the Agreement was concluded, as well as any other that may be necessary to ensure the purposes set out below. This data may include, among others, identification data (e.g. name, driving licence data and passport data), contact data (e.g. address, telephone number and e-mail) and economic and financial data (e.g. rent amount, tax identification number and bank details).

Cellnex will process your personal data in order to fulfil obligations, exercise rights, manage the Agreement, and address any issues arising from it. The lawful basis for this processing is the performance of the Agreement and, in certain cases, compliance with legal obligations, especially in tax matters, to which Cellnex is subject.  In addition, Cellnex may process your personal data in pursuance of Cellnex’s legitimate interests in running its business.

• Whenever necessary to ensure the above purposes, your personal data may be shared with: Companies or entities within the Cellnex group, herein defined as the set of companies or entities owned directly or indirectly by Cellnex Telecom, S.A. – a company incorporated and operating under the laws of Spain, with registered office at Calle Juan Esplandiú, 11-13, 28007 Madrid, Spain, and Spanish VAT A-64907306 –, including Cellnex Telecom, S.A.;
• Public authorities and regulators, such as HMRC;
• Service providers of Cellnex, for the purposes of: providing services relating to the Agreement or previously approved proposals; renegotiation of the Agreement; for the purposes of formalization of new contracts; providing accounting, administration and management services; providing information and communication systems and technology service providers;
• Lawyers and auditors, both internal and external, of Cellnex; and
• Other companies or entities that Cellnex may need to share your personal data in order to deliver its obligations or exercise its rights under the Agreement, manage the relationship or provide its services.

If Cellnex intends to transfer your personal data to a third country or an international organisation (within the meaning of the UK GDPR) outside of the UK  and there is no UK adequacy regulations in place about this country, the “appropriate safeguards” provided for in Chapter V of the UK GDPR will be adopted.

Your personal data will be kept for:

(a) the duration of the contractual relationship arising from the Agreement and for as long as necessary to fulfill the purposes for which it was collected;

(b) as long as is necessary (and to the extent necessary) for the fulfilment of Cellnex’s legal, accounting and reporting obligations and requirements.   It will then be securely deleted or anonymized.

At any time, you may ask us for:

• Access to your personal data processed by us;
• Rectification of your personal data, if it is inaccurate or incomplete;
• The erasure of your personal data;
• The restriction of the processing;
• The portability of your personal data; and
• Objection to processing;

More information on these rights are set out below.

You may exercise these rights by sending an e-mail to personaldata@cellnextelecom.com.

We will handle your requests with great care to ensure the effectiveness of your rights. Proof of your identity may be required to safeguard the privacy of your personal data.

Please note that, in some cases, your request may not be immediately fulfilled. Regardless, we will promptly inform you, no later than one month after receiving your request, explaining the reasons for any delay.

You also have the right to file a complaint with the  Information Commissioner’s Office.

Right of access

The data subject has the right to obtain from Cellnex confirmation of whether or not personal data concerning him or her is being processed and, if so, to access his or her personal data and the  information specified in Article 15 of UK GDPR.

Right of rectification

The data subject has the right to obtain from Cellnex, without undue delay, the rectification of inaccurate or incomplete personal data concerning him or her.

Right to personal data erasure (“right to be forgotten”)

The data subject has the right to obtain the erasure of his or her personal data from Cellnex, without undue delay, and the latter has the obligation to erase the personal data, without undue delay, where one of the following reasons specified in Article 17 of UK GDPR apply and provided that the right of erasure is not excluded under Article 17 (3).  Examples of when the data subject has a right to erasure are:

1. The personal data are no longer necessary for the purpose for which they were collected or processed;
2. The data subject objects to the processing and there are no overriding legitimate interests justifying the processing;
3. The personal data has been unlawfully processed.

Right to restriction of processing

The data subject has the right to obtain the restriction of processing from Cellnex if one of the following situations applies in particular:

1. The accuracy of the personal data is contested by the data subject, for a period that allows Cellnex to verify its accuracy;
2. The processing of personal data is unlawful and the data subject opposes the erasure of the personal data and requests, in return, the restriction of its use;
3. Cellnex no longer needs the personal data for the purposes of processing, but such data are required by the data subject for the purpose of declaration, exercise or defence of a right in a judicial proceeding;
4. If he or she opposed the processing, until it is established that the legitimate interests of Cellnex take precedence over those of the data subject.

Right to personal data portability

If the processing depends on the consent of the data subject and that consent has been provided by automated means, the data subject has the right to receive the personal data concerning him or her and which he or she has provided to Cellnex in a structured, commonly used and automatically readable format.

Right to object

In cases where personal data processing is carried out for the purposes of the legitimate interests pursued by Cellnex or for other situations provided for in the UK GDPR, if applicable, the data subject may also, at any time, object to the processing of his or her personal data.

Should you remain with any questions regarding the processing of your personal data and/or wish to inquire about other privacy-related matters, you may send an e-mail to personaldata@cellnextelecom.com

July 2025