ADP // 2021 Universal Registration Document

SOC I AL , ENV I RONMENTAL AND SOC I ETAL RESPONS I B I L I TY I NFORMAT I ON

OPERATING IN AN EXEMPLARY MANNER

CORRUPTION RISK MAPPING In addition to the ethics and compliance risk included in the Group’s mapping, a corruption risk mapping is carried out every two years to identify potential scenarios and define preventive actions (last financial year in 2020). The action plans formalised in 2020 were monitored by the Ethics Department in 2021. DEFINITION AND DIFFUSION OF POLICIES, RULES AND METHODS In 2022, the Ethics and Compliance programme will be four years old. During this deployment phase, Groupe ADP has focused on developing the ethics and compliance culture at all levels within the Company. Initiated at the end of 2017, the Ethics and Compliance programme has made it possible to set benchmarks on best practices for employees, in particular through the implementation of a code deployed in seven languages and procedures (gifts and invitations, conflicts of interest, sponsorship, assessment of third parties, international sanctions/embargoes, etc.). 2021 enabled the Group to strengthen the third-party assessment process with the acquisition of a tool. There are currently four levels of assessment activated according to the type of project and to the risk related to countries and third parties. In addition to the ethical culture that creates the right reflexes, the third-party assessment procedure makes it possible to prevent risks related to investment projects. A milestone in 2021, ADP International, a subsidiary of Groupe ADP, signed on 4 January 2022 a transactional agreement with the International Finance Corporation (IFC), the main development institution within the World Bank Group. It is part of an out-of-court settlement negotiated by ADP International under which the Company assumes responsibility for practices considered fraudulent and collusive that occurred, from 2013 and in 2015, during the tender procedures organised for the award of the concessions of the Zagreb airports in Croatia and of Antananarivo and Nosy Be in Madagascar, the construction of which was partially financed by the IFC. Under this agreement, ADP International, as well as its subsidiaries, is no longer authorised, for a period of 12 months from this date, to take part in projects financed by the World Bank Group (with a probationary period of 12 additional months). This exclusion only concerns ADP International and the companies it controls - and therefore does not include ADP SA and its other subsidiaries such as TAV Airports. While this exclusion provided an opportunity to update and expand the Ethics and Compliance programme, Groupe ADP has defined an ambitious training and awareness-raising plan since its inception (see below). THE WHISTLE-BLOWING SYSTEM Available since 1 October 2018 to Group and supplier employees, the whistle-blowing platform (https://alert.groupeadp.fr/ entreprises) meets the requirements of the Potier law (duty of vigilance) and the Sapin II law (fight against corruption). The whistle-blowing system is accessible to all Group employees and those of our suppliers via an outsourced and secure platform. It allows everyone to ask questions or report problems. The processing of alerts is governed by a charter and an internal investigator is dedicated to Ethics and Compliance matters. Between the end of 2018 and 2021, the Group processed 43 admissible alerts resulting in 19 investigations, 16 recommendations and seven sanctions.

addition to these contacts, 20 intermediaries are appointed within the support departments at the level of the parent company to promote the various ethics and compliance practices and thus prevent the related risks. This network also contributes to the implementation of best practices covering aspects such as the reporting of gifts and invitations and conflicts of interest every year. The programme is monitored in the Group’s different bodies: Executive Committee, Social and Economic Committee, Board of Directors (and its Audit and Risk Committee). The Ethics and Compliance action plan is validated every year by the Executive Committee, the Board of Directors and its Audit and Risk Committee. At the same time, the CSR Committee of the Board reviews actions relating to the dissemination of the ethics and compliance culture within the Group based on the results of the ethics climate barometer. Risks related to ethics and compliance are described in the Risk Management chapter. They are co-managed by the Ethics Division and the Legal and Insurance Division. Aéroports de Paris is also a member of Transparency International and the Cercle Éthique des Affaires , which helps it look at best practices and feed into discussions on ethics and compliance within the Group. Personal data processing complies with regulations (the General Data Protection Regulation or GDPR and the Data Protection Act). Regulatory requirements are taken into account from the design stage of projects (Privacy by Design) and by default throughout the life of the processing (Privacy by Default). ADP - SA has appointed a Data Protection Officer (DPO) and correspondents (PDC) in each department who are the DPO’s real intermediaries. A Group data protection policy has been defined, implemented and monitored. It is based on the Group Information Systems Security Policy and the general data protection policy. In 2021, a charter governing the application of the data protection policy was created and provided to all employees. A GDPR compliance management platform has been deployed. It includes the processing register. Group methods have been put in place (e.g. data protection impact analysis method, methodology for conducting IS projects that takes into account the protection of personal data). Stakeholders are informed how their data is processed. A centralised ADP SA procedure has been implemented to handle requests to exercise rights. A data violation management procedure has been implemented. A penalty and crisis management system is in place to deal with data violation cases. MANAGEMENT SETTING AN EXAMPLE As ethics and compliance firstly require a change in culture rather than a change in procedures, the Ethics and Compliance programme attaches considerable importance to management setting an example, awareness-raising and training, as well as understanding employees’ perceptions. The ethics climate barometer measures the spread of this ethics and compliance culture. Groupe ADP held a first ethics day dedicated to the prevention of corruption on 9 December 2021, which resulted in the broadcasting of videos of executives in order to recall the challenges and embody the “Tone from the top”. This day was also an opportunity to offer Paris employees a conference on these topics.

4

229

AÉROPORTS DE PAR I S / UN I VERSAL REG I STRAT I ON DOCUMENT 202 1