ADP // 2021 Universal Registration Document

SOC I AL , ENV I RONMENTAL AND SOC I ETAL RESPONS I B I L I TY I NFORMAT I ON 4 OPERATING IN AN EXEMPLARY MANNER

rules (rules of procedure, employment contract, etc.). An e-learning course has been deployed for all employees and persons in key data protection positions are invited to in-person training on the requirements of the GDPR which they must comply with and/or for which they must ensure application in their daily activities. Standard clauses are provided for inclusion in contracts, agreements and tenders (to be completed, if necessary, with the assistance of the Legal and Insurance Department). Any service provider accessing sensitive information is also subject to confidentiality (contract clause, NDA, rules of procedure where applicable, etc.). Stakeholders are informed how their data is processed. A centralised ADP SA procedure has been implemented to handle requests to exercise rights. A GDPR compliance management platform (ARIEL) has been deployed; in particular, it includes the processing register. Group methods have been put in place (e.g. data protection impact analysis method, methodology for conducting IS projects that takes into account the protection of personal data). A data violation management procedure has been implemented. A penalty and crisis management system is in place to deal with data violation cases. At Group level, the Group Personal Data Protection Policy defines Groupe ADP’s commitments to protect the Personal Data of its stakeholders and ensure compliance with regulations in this area. It establishes the organisation put in place for this purpose (one DPOmust be appointed in each company concerned). It specifies the principles and rules to guarantee adequate protection of personal data used in the context of the Group’s activities. Preservation of employment The crisis in the air transport sector, due to the Covid-19 pandemic, and the very sharp decline in traffic have considerably slowed down Groupe ADP’s activity. Traffic forecasts do not indicate that activity will reach 2019 levels again for several years. Preserving jobs and skills as much as possible remains a key issue, even if the Company has had to implement a certain number of measures to reduce activity and control costs, in particular the payroll. These measures consist of a voluntary departure plan - partly offset by a significant recruitment plan - and a salary adjustment plan (see HR section ** of this report). In addition, to enable the employees affected by partial activity to preserve their employability and to receive training, the Company has had recourse to the State-funded National Employment Fund ( Fonds national de l’emploi - Formation) to offer them specific training (languages, office automation, management, personal development, personal effectiveness, communication). In 2021, the system was built around longer training courses that could take place until the end of 2022 (airport operations, management of people and activities, personal development, communication, legal, and the environment - sustainable development). For the other companies in the Group, the objective of maintaining employment has also underpinned the policies and decisions implemented as part of the State measures to protect employment and the measures taken by companies to help their employees during the crisis. However, given the persistence of the crisis, staff reductions were required in 2021.

An ADP SA entity is dedicated to the protection of the Group’s employees abroad: ◆ it is present throughout the process, from the approval of the launch of a mission, to its monitoring during implementation, to the post-mission debriefing for the most sensitive destinations; ◆ it formulates recommendations on security, health, information protection, ethics and compliance, etc. for missions to countries at risk; ◆ it ensures the training and awareness of employees before their departure; ◆ it may be required to deploy additional security measures if necessary; ◆ it also ensures country monitoring and ongoing communication (and specific monitoring for at risk and high-risk countries); ◆ it organises and controls the performance of security audits in the countries where it operates. And where applicable, it organises and manages the international crisis system. Expatriates and seconded staff are regularly informed of the risks related to their country, in terms of health, the situation and the local environment. Following the restrictions due to Covid-19, for example, employees began to return to their workplaces, following the periods of remote work. The Group’s entities have implemented the government measures specific to each country for their employees. TAV Airports also has procedures designed to ensure the safety of employees abroad and is developing them in coordination with Aéroports de Paris. Special procedures were implemented for travel during the Covid period, in close coordination with As part of the Group’s activities, ADP may be required to process a certain amount of personal data: employees, customers/ prospects, passengers, partners, service providers, etc. The processing and storage of this data naturally calls for a certain number of actions intended to prevent possible breaches of security resulting, accidentally or unlawfully, in the destruction, loss, alteration or unauthorised disclosure of data of a personal nature transmitted, stored or otherwise processed, or unauthorised access to such data. ADP SA has appointed a Data Protection Officer (DPO) and liaison officers (PDC) in each department. Only the necessary data are collected, processed and stored securely and in accordance with the regulations (GDPR and French Data Protection Act). A Group data protection policy has been defined, implemented and monitored. It is based on the Group’s Information Systems Security Policy and the general information protection policy. In 2021, a charter governing the application of the data protection policy was created and provided to all employees. Regulatory requirements are taken into account from the design stage (Privacy by Design) and by default throughout the life of projects (Privacy by Default). Group employees are made aware of the protection of personal data, and the rules of procedure govern the application of these policies by employees. Employees are subject to confidentiality occupational physicians. Protection of personal data

238

AÉROPORTS DE PAR I S / UN I VERSAL REG I STRAT I ON DOCUMENT 202 1