Privacy Policy
This Privacy Policy aims to inform users of the website www.edprinvestors.com (the “User” and the “Website”) and its shareholders (together, the “Data Subjects”) about how their personal data is processed by EDP Renewables, S.A., with registered office at Plaza del Fresno No. 2, 33007 Oviedo, Asturias, Spain, registered with the Commercial Registry of Asturias, Volume 3671, Book 177, Page AS-37669, Entry No. 1 | Tax Identification Number (C.I.F.) A-74219304 (“EDPR”).
The User should carefully read this Privacy Policy and decide whether to provide their personal data before using the Website. The provision of personal data implies knowledge and acceptance of the terms set out in this Privacy Policy.
This Privacy Policy should be read in conjunction with the Website’s Cookie Policy and Terms and Conditions (together, the “Contractual Documentation”). If the User does not accept the Contractual Documentation, they must cease using the Website.
1. Collection and Processing of Personal Data
Browsing the Website does not necessarily entail the provision of personal data (i.e., information relating to a natural person which may, directly or indirectly, identify or render that person identifiable). However, the use of certain functionalities, such as submitting contact requests, results in the collection of the User’s personal data.
EDPR also wishes to inform its shareholders of the processing of their personal data by EDPR in the context of its activities.
Data Subjects may consult the table below for further information regarding the data collected, as well as the purposes and legal bases of the processing:
| Purpose | Legal Basis | Personal Data |
|---|---|---|
| Analysis of and response to contact/information requests submitted through a form | EDPR’s legitimate interest in ensuring a response to any contact/information request | Identification data, contact details, the message sent by the User and any data provided through the form |
| Management of the exercise or delegation of attendance and voting rights at the General Shareholders’ Meeting, whether the data is obtained from the shareholder or provided for that purpose by banking institutions and securities companies or agencies that ensure the deposit or custody of the relevant shareholders’ shares | Performance of a contract to which the Data Subject is a party or compliance with a legal obligation, as applicable | Identification data, contact details and information relating to shareholder status |
| Preparation of a participants’ list for the proper management of the various processes arising from shareholder status in the context of the General Shareholders’ Meeting | Performance of a contract to which the Data Subject is a party or compliance with a legal obligation, as applicable | Identification data and information relating to shareholder status |
| Management of the proper functioning and development of the shareholder relationship with the Data Subject in the context of the General Shareholders’ Meeting | Performance of a contract to which the Data Subject is a party or compliance with a legal obligation, as applicable | Identification data, contact details and information relating to shareholder status |
| Website management and maintenance | EDPR’s legitimate interest in providing, maintaining and ensuring the security and operation of the Website, or consent, where applicable | Data relating to interaction with the Website (such as the IP address of the device used, the date and time of the beginning and end of the Website visit, browser history, or other information collected through cookies). For further information regarding this processing, please refer to our Cookie Policy |
| Analysis of Website usage |
The User declares and warrants that they are of legal age and that the data communicated is true, accurate, complete and up to date, being responsible for any inconsistency. If the data communicated belongs to a third party, the User declares and warrants that they have informed that third party of the conditions set out in this document and have obtained their authorisation to provide their data to EDPR for the purposes indicated above.
2. Retention Periods
The personal data collected is processed in strict compliance with applicable legislation. Personal data shall be retained in accordance with the respective purposes and the applicable legal retention periods. In relation to Data Subjects who are EDPR shareholders, for the purposes indicated above, a retention period of six (6) years shall apply, in accordance with applicable legislation.
Where there is no specific legal requirement, the data shall be stored and retained only for the period appropriate and necessary for the purposes for which it was collected, except where the right to object or the right to erasure is exercised within the legal limits.
In the event of potential litigation or ongoing litigation, it may be necessary to retain personal data for a longer period until such proceedings have been concluded. When determining the appropriate retention period, criteria such as the nature of the data, the purposes of processing, and the need to comply with legal or regulatory obligations shall be taken into account
3. Recipients
The personal data of Data Subjects may be disclosed:
- To other entities contracted to provide certain services, where those services involve access to the personal data of Data Subjects. Accordingly, any processor engaged by EDPR shall process the personal data of Data Subjects on behalf of EDPR, following its instructions and in accordance with the data processing agreement entered into with such entities;
- To third parties where such disclosure is necessary or appropriate: (i) under applicable law; (ii) in compliance with legal obligations or court orders; (iii) pursuant to decisions or rulings of supervisory authorities; or (iv) in response to requests from public or governmental authorities. In the case of shareholder Data Subjects, personal data may also be disclosed to public officials within the scope of the General Shareholders’ Meeting for the preparation of the notarial deed, may become publicly accessible when included in documentation available for consultation or when mentioned during the General Shareholders’ Meeting, or may be disclosed to third parties exercising statutory rights to information.
In all of the above situations, appropriate measures shall be taken to ensure the effective protection of personal data.
4. Transfers of Data to Third Countries
EDPR does not transfer the personal data of Data Subjects to countries outside the European Economic Area (“EEA”). Should such transfers take place, EDPR shall ensure that they are carried out: (i) where an adequacy decision of the European Commission exists in relation to the recipient country; or, in other cases, (ii) on the basis of appropriate safeguards, such as Standard Contractual Clauses adopted by the European Commission, together with supplementary measures to ensure that personal data benefits from a level of protection essentially equivalent to that existing within the European Union.
Notwithstanding the above, data collected while browsing the Website, namely through cookies and similar technologies, may be transferred outside the EEA if the User consents to the implementation of certain categories of cookies (e.g., analytics or advertising cookies). These cookies are placed by third parties that may transfer data to countries which do not benefit from a European Commission adequacy decision and which do not provide a level of personal data protection essentially equivalent to that provided within the European Union (e.g., the United States of America), as is the case with the “Google Analytics” web analytics and optimisation service provided by Google Ireland Limited.
By way of example, the sharing of data with service providers established outside the EEA (such as Google LLC) may result in disproportionate access to such data by governmental authorities and intelligence services in the importing country or may make it impossible to effectively exercise the applicable rights. For further information regarding the use of these cookies, please refer to our Cookie Policy.
5. Data Subject's Rights
Data Subjects have the right to request access to their personal data, as well as its rectification or erasure, restriction of processing and data portability, in accordance with and within the limits established by law.
Data Subjects also have the right to object, at any time and on grounds relating to their particular situation, to the processing of their personal data where such processing is based on the legitimate interests pursued by the controller.
Data Subjects further have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados) or the Spanish Data Protection Agency (Agencia Española de Protección de Datos), as applicable, if they consider that their personal data has been processed unlawfully.
To exercise the rights described above, EDPR may be contacted in writing through the Compliance Department at C/ Serrano Galvache, No. 56, Edificio Olmo, 6th Floor, 28033 Madrid, Spain, or by email at complianceofficer@edpr.com.
6. Security Measures
Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of natural persons, which may vary in likelihood and severity, we use our best efforts to implement appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk.
However, it remains the User’s responsibility to ensure that the devices and equipment used to access the Website are adequately protected against malware, computer viruses and worms.
Furthermore, the User should be aware that, without the adoption of appropriate security measures (for example, secure browser configuration, up-to-date antivirus software, use of a firewall and avoidance of software from untrusted sources), the risk of personal data and passwords being accessed by unauthorised third parties is increased.
7. Changes to the Privacy Policy
EDPR reserves the right to amend this Privacy Policy at any time.
Any such changes shall be posted on the Website and/or communicated to Data Subjects through the contact details provided.
Last updated: 15 June 2026