This privacy policy is applicable to and informs web users and other interested parties about the processing of personal data that may be collected within the framework of their contractual or corporate relationship with companies in the BME Group or via the websites of BME Group companies.

DATA CONTROLLER AND CONTACT DETAILS

For the purposes of this privacy policy, the BME Group company with which the data subject has a contractual, corporate or similar relationship that requires the processing of their personal data will be considered the Data Controller. The companies that make up BME Group and may fulfil this role are:

Without prejudice to the above addresses, BME Group companies can be contacted at info@grupobme.es

DATA PROCESSED

BME Group will process the personal data (e.g. name, surname, email, telephone, etc.) that data subjects may provide within the framework of the relationship via the different channels enabled by the various companies (e.g. website, email, contact channels, etc.) or as a consequence of their contractual or corporate relationship with any BME Group company.

Furthermore, BME Group uses cookies to collect user data while the data subjects are browsing their website (such as the type of browser being used, operating system or IP address), in order to improve their browsing and manage the portal effectively. More detailed information on this may be obtained in the website cookies policy.

PURPOSES OF AND LEGAL GROUNDS FOR THE PROCESSING

BME Group will process personal data in order to properly manage, develop and execute the relationship with the data subjects, as well as for any additional procedures that may be derived from the same. The purposes for which BME Group will process collected data include the following:

• To address requests for information and other requests made by the data subjects themselves via the enabled channels, such as the email provided on the website. The legal grounds for this processing are based on the consent provided by the data subject by submitting the data.

• To assess candidatures and information provided for participation in recruitment processes, based on the legal grounds of the consent provided by the data subject through their participation.

• To manage registration and attendance at corporate actions offered and organised by BME Group or its partners. The legal grounds for this processing are based on the consent provided by the data subject through registering.

• To formalise registration, enrolment, participation, submission of documents and training material, as well as other procedures derived from the relationship with the data subject as a student at Instituto BME in order to provide the requested courses, based on the legal of the consent provided by the student through registering and the legitimate interests of BME Group in maintaining the relationship.

• To manage relationships, contracts and billing with suppliers necessary for the provision of BME Group services and activities, based on the legal grounds of performance of a contract in place with them.

• To send communications, newsletters and information on BME Group campaigns, products and services based on the consent provided by the data subject in their request and, where applicable, on the legitimate interest of BME Group in keeping them informed in the framework of the relationship.

• To comply with the requirements of the CNMV, administrative and/or judicial authorities and the legal obligations of BME Group, based on the legal grounds of fulfilment of the legal obligations required of companies.

• To guarantee the health and safety of BME Group staff, stakeholders and facilities through the installation of video surveillance and access control systems and more, based on legal grounds of legitimate interest and public interest, where applicable, in guaranteeing security.

• Maintenance of the contractual relationship with members and clients and provision of the services offered by any BME Group company.

• Record and register telephone calls and electronic communications, legitimately in compliance with the legal obligations applicable to entities (among others: MiFID I and MiFID II Directive, MiFIR Regulation), as well as based on BME's legitimate interest in guaranteeing the quality of service, verifying the veracity and integrity of communications and for evidential purposes.

• Data collected through the use of cookies will be processed to ensure the effective operation of the website, based on the company's legitimate interest and the data subject's consent provided by accepting or rejecting the cookies.

Data subjects are informed of the need to provide all mandatory data identified as such in the framework of their relationship with BME Group in order to fulfil the above purposes. Failure to provide the mandatory data may make it impossible to fulfil these purposes.

STORING DATA

The data subject's personal data is kept for the time strictly necessary to effectively fulfil the stated purposes and, in any case, only if it is suitable, adequate and pertinent for the purpose for which it was collected.

In particular, and in any cases where the data subject has given their consent, BME Group will keep the personal data until the data subject withdraws their consent or objects to this. The withdrawal of the data subject's consent will not affect the legitimacy of the data processing carried out by BME Group up until that time, and it will be completely legal until the date the consent is withdrawn.

In relation to storing information regarding browsing data and cookies, more information can be obtained in our cookies policy.

The provisions of this section are without prejudice to the possibility that, for BME Group to comply with its legal obligations, the data may be duly blocked after consent is withdrawn, rights are exercised or the intended purpose is achieved in order to deal with any responsibilities or requirements derived from the relationship with the data subject.

INTERNATIONAL DATA TRANSFERS AND RECIPIENTS

The data collected from data subjects by BME Group will not be disclosed to third parties, except where legally obliged or required in order for the existing relationship to be properly fulfilled. Notwithstanding the above and based on the legitimate interest of BME Group, the data may be disclosed for internal administrative purposes to SIX GROUP SERVICES Ltd., BME Group's parent company located in Switzerland, a country declared to have an adequate level of protection.

Furthermore, without prejudice to the transfers mentioned in the cookies policy and if used for activities run by BME Group service providers located outside the European Economic Area, the data subject's data may be subject to international transfer to the United States, among other places, and BME Group will adopt adequate security measures to guarantee the protection and confidentiality of the dame.

EXERCISING RIGHTS

At any time, the data subjects may exercise the following rights recognised by current data protection regulations:

• Right of Access: allows the user to know what information is being stored, where it was obtained, who it has been disclosed to and what purposes it has been processed for.

• Right to Rectification: allows the user to rectify any erroneous or outdated data.

• Right to Erasure: allows the user to request that processing of their data stop.

• Right to Restriction of Processing: allows the user to restrict processing of their data, but in such a way that it is kept for some later purpose (a legal claim, for example).

• Right to Data Portability: allows the user to obtain a copy of their data in electronic format and, in certain circumstances, to request that it be communicated to another service provider.

• Right to Object: allows the user to object to the legitimate interest of BME Group and request that processing of their data stop.

• Right to Withdraw Consent, at any time, regarding the processing of their personal data, without this affecting the legitimacy of the same.

These rights may be exercised by the data subject by sending their request to the addresses of the BME Group companies stated above, or via email to protecciondedatos@grupobme.es, indicating what right they wish to exercise and providing their national ID or similar documentary proof of identity. They can also contact the BME Group data protection officer at the above address.

If the data subject is not satisfied with the response to the exercising of their rights, they may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.

SECURITY MEASURES

BME Group has adopted the appropriate technical and organisational measures to guarantee an adequate level of security for the personal data processed, guaranteeing the confidentiality, integrity and availability of the same at all times, and preventing it from being lost, altered, processed or accessed without authorisation.

AMENDMENTS TO THE PRIVACY POLICY

BME Group reserves the right to amend this privacy policy, always pursuant to the terms allowed by current Spanish legislation and communicating any amendments to the data subjects by publishing them on the website, or via any other means of communication or dissemination it considers appropriate. The data subjects undertake to check this policy for any changes or amendments to its content.

Date updated: January 2021.