PRIVACY NOTICE

This communication provides you with information about the processing of Personal Data when registering as an ENGIE Supplier in Portugal.

1. Purpose of processing

o The processing has the following objectives:

 Allow the Supplier to be registered in ENGIE’s database;

 Enable ENGIE to conduct a preliminary risk assessment regarding third parties acting on its behalf under Article 18 of the General Corruption Prevention Regime (Decree-Law 109-E/2021 of December 9);

 Allow the Supplier to submit proposals in the scope of tenders promoted by ENGIE;

 Enable the processing of personal data to fulfill pre-contractual and contractual obligations.

2. Who is responsible for data processing

o The data controller is the legal entity of ENGIE in Portugal that offers the commercial opportunity to the Supplier.

3. Location of processing

o The information collected is processed to fulfill the legal obligation of the data controller, notably Article 18 of the General Corruption Prevention Regime, as well as to execute a contract to which the data subject is a party or for pre-contractual measures at the request of the data subject.

o By registering, you declare that the Personal Data provided is true, accurate, complete, and not misleading. Additionally, you authorize the data controller to take all reasonable measures to verify the Personal Data provided by you at any time during the tender process, whenever allowed within the local legal context.

4. What Personal Data we collect from you

o The categories of Personal Data collected in this processing are as follows:

 Name, surname ;

 Professional information (position, email address) ;

 Citizen card.

5. How long we keep your Personal Data

o Your data is stored for 12 months after the last connection to your profile.

Página 2 de 2

6. Who are the recipients of your Personal Data

o The data will be used by ENGIE’s Procurement department in Portugal.

o Access to Personal Data will be based on the principle of “need to know”. Your Personal Data may also, for example, be accessed by ENGIE IT employees and their subcontractors as part of their portal maintenance function.

7. Safeguards and Transfers

o Your Personal Data may be transferred outside the European Union for application maintenance purposes by ENGIE IT subcontractors. These transfers are protected by Standard Data Protection Clauses. A copy can be obtained by sending a request to protecao.dados@engie.com.

8. Your rights

o In accordance with the General Data Protection Regulation, you can exercise your rights of access, rectification, or deletion of your data. You also have the right to object, limit, and portability of your data.

o To exercise your rights, you are invited to send your request to protecao.dados@engie.com. The data controller may ask for proof of identity (such as a copy of the citizen card) to be attached to your request.

o The data protection officer can be contacted by sending an email to protecao.dados@engie.com.

o If you consider, after contacting us, that your rights are not being respected, you can file a complaint with the National Data Protection Commission.