Cellnex values your privacy and is committed to protecting your personal data. This notice applies to the processing of your personal data in the relation to requests for support services on Cellnex’s JIRA  service desk (“JIRA Service Desk Requests”) by persons that are not Cellnex UK Limited (or its subsidiaries) employees, individual contractors or workers.

This policy  explains how we collect, use, and protect your personal data, as well as how you can contact us if you have any questions the processing of your personal data.

Cellnex UK Limited has its registered office at R+, 4th Floor, 2 Blagrave Street, Reading, United Kingdom, RG1 1AZ and its company registration number is 05153745 (“Cellnex UK”).  Cellnex UK Limited is a wholly owned subsidiary of Cellnex Telecom S.A.   Cellnex Telecom S.A is a public company listed on the Spanish stock exchange.  Its registered office is 11-13, Juan Esplandiu, 28007 Madrid, Spain and its registration number is A64907306.

Cellnex UK Limited has a number of subsidiaries in the United Kingdom and sister companies.  You may deal with these on a day to day basis.  In respect of JIRA Service Desk Requests, Cellnex UK is the “data controller” for your personal data under the UK General Data Protection Regulation (the “UK GDPR“) and the Data Protection Act 2018.

The personal data processed by Cellnex UK is that collected at the time you make your JIRA Service Desk Request.  This includes:

• Contact data such as your name, email address, telephone number and employer.
• Identification data such as your name, address, driving licence data, passport data or utility bill data.
• Other information necessary to complete the JIRA Service Desk Request.

Cellnex UK will process your personal data in order to fulfil the JIRA Service Desk Request, and address any issues arising from it. The lawful basis for this processing is that it is necessary for the purposes of the legitimate interests of the data controller and/or a third party.

Whenever necessary for the above purpose, your personal data may be shared with:

• Companies or entities within the Cellnex group, herein defined as the set of companies or entities owned directly or indirectly by Cellnex Telecom, S.A. including Cellnex Telecom, S.A.;
• Service providers, landlords or customers of Cellnex UK with which Cellnex UK need to share your data to fulfil the JIRA Service Desk Request;
• Public authorities and regulators, such as HMRC; and Lawyers and auditors, both internal and external, of

If Cellnex intends to transfer your personal data to a third country or an international organisation (within the meaning of the UK GDPR) outside of the UK  and there is no UK adequacy regulations in place about this country, the “appropriate safeguards” provided for in Chapter V of the UK GDPR will be adopted.

Your personal data will be kept for: (a) as long as necessary to fulfill the purposes for which it was collected; (b)  as long as is necessary (and to the extent necessary) for the fulfilment of Cellnex’s legal, accounting and reporting obligations and requirements.   It will then be securely deleted or anonymized.

You have the following rights in respect of your personal data.

Right of access: The data subject has the right to obtain from Cellnex confirmation of whether or not personal data concerning him or her is being processed and, if so, to access his or her personal data and the  information specified in Article 15 of UK GDPR.

Right of rectification: The data subject has the right to obtain from Cellnex, without undue delay, the rectification of inaccurate or incomplete personal data concerning him or her.

Right to personal data erasure (“right to be forgotten”): The data subject has the right to obtain the erasure of his or her personal data from Cellnex, without undue delay, and the latter has the obligation to erase the personal data, without undue delay, where one of the following reasons specified in Article 17 of UK GDPR apply and provided that the right of erasure is not excluded under Article 17 (3).  Examples of when the data subject has a right to erasure are:

• The personal data are no longer necessary for the purpose for which they were collected or processed;
• The data subject objects to the processing and there are no overriding legitimate interests justifying the processing;
• The personal data has been unlawfully processed.

Right to restriction of processing: The data subject has the right to obtain the restriction of processing from Cellnex if one of the following situations applies in particular:

• The accuracy of the personal data is contested by the data subject, for a period that allows Cellnex to verify its accuracy;
• The processing of personal data is unlawful and the data subject opposes the erasure of the personal data and requests, in return, the restriction of its use;
• Cellnex no longer needs the personal data for the purposes of processing, but such data are required by the data subject for the purpose of declaration, exercise or defence of a right in a judicial proceeding;
• If he or she opposed the processing, until it is established that the legitimate interests of Cellnex take precedence over those of the data subject.

Right to personal data portability:  If the processing depends on the consent of the data subject and that consent has been provided by automated means, the data subject has the right to receive the personal data concerning him or her and which he or she has provided to Cellnex in a structured, commonly used and automatically readable format.

Right to object: In cases where personal data processing is carried out for the purposes of the legitimate interests pursued by Cellnex or for other situations provided for in the UK GDPR, if applicable, the data subject may also, at any time, object to the processing of his or her personal data.

You may exercise these rights by sending an e-mail to personaldata@cellnextelecom.com.

We will handle your requests with great care to ensure the effectiveness of your rights. Proof of your identity may be required to safeguard the privacy of your personal data.  Please note that, in some cases, your request may not be immediately fulfilled. Regardless, we will promptly inform you, no later than one month after receiving your request, explaining the reasons for any delay.

We hope that our Data Protection Officer or UK Head of Legal & Regulatory Affairs will be able to resolve any query or concern you raise about our use of your data.

If not, you can find further information about your rights and guidance on how to make a complaint to the Information Commissioner, the UK data protection regulator, at https://ico.org.uk  or by telephoning telephone: 0303 123 1113.

Should you remain with any questions regarding the processing of your personal data and/or wish to inquire about other privacy-related matters, you may send an e-mail to personaldata@cellnextelecom.com.

July 2025