AZORA CAPITAL, S.L., makes this Privacy Policy available to the users of the website located in the URL www.azora.com (the “Website”), in order to provide information about how your personal data is processed and protect your privacy and information.

AZORA CAPITAL, S.L requests that users spend a few minutes carefully reading this Privacy Policy.

1. INTRODUCTION

AZORA CAPITAL, S.L., is an entity with registered office in calle Villanueva 2B, Escalera 1, Planta SM, 28001 Madrid, with Tax Identification Number B84777465, registered in the Madrid Company’s Registry, in Volume 23756, Page 224, Page M-415362 (hereinafter, together with its subsidiaries and managed companies, “Azora Group”).

This Privacy Policy applies to Azora Group’s Website and to interactions with Azora Group through that website, email, or other contact methods and channels made available at any given time for communication and the collection of user data, including those available at the entity’s facilities.

Azora Group may change whole or part of this Privacy Policy when necessary. If any changes are made, you will be notified through the website or by other means, in order to find about the new Privacy terms and conditions. By continuing to make use of the functionalities made available by Azora Group after having been notified of these changes you will state your agreement with them, except for those cases in which your consent is required.

2. WHO IS THE CONTROLLER FOR THE PROCESSING OF YOUR PERSONAL DATA?

The controller for the processing of your personal data is Azora Group. To guarantee adequate management of the processing of your data, Azora Group has appointed a Data Protection Officer, whom you may address for any matter that might arise and who can be contacted at the email address rslopd@azora.com.

3. FOR WHAT PURPOSES ARE YOUR PERSONAL DATA PROCESSED?

The personal data that you provide through the Website or other means, or when contacting Azora Group through any other channel, may be processed by Azora Group for the following purposes, depending on your interactions with Azora Group.

• Contacting, managing and processing enquiries and requests from users: The personal data of users who contact Azora Group through any of the contact channels made available by Azora Group for the purpose of submitting enqueries and/or requests will be processed for the purposes of maintaining communication between the parties, providing the information requested by users, delivering customer or user support services, and managing and handling the requests or enquiries submitted by the user through the channels enabled by Azora Group for this purpose.
• Sending commercial, promotional or advertising communications: Users' personal data may be processed by Azora Group for the purpose of sending them personalised commercial and advertising information about activities, products, services, offers, special promotions, as well as documentation of various kinds, by post, telephone or electronic means (e-mail, newsletter, SMS, messaging and other means of electronic communication).

You may object at any time to the processing of your data for advertising or promotional purposes by Azora Group using the channels provided for this purpose by Azora Group, as detailed further on in this Policy.

• Conducting the recruitment process: The personal data you provide through the ‘Talent’ section of the Website or by contacting Azora Group through other means, such as email, recruitment websites, or other channels, may be processed by Azora Group for the purpose of carrying out the recruitment process. This includes assessing your professional profile based on the information contained in your CV, as well as any information provided during the course of the recruitment process through interviews, group exercises, and email communications exchanged.

Azora Group maintains a centralised management of its recruitment processes; therefore your application may be considered in relation to any of the entities that form part of its corporate group. In the event that this involves the disclosure of you data to an entity other than the one to which you applied, you will be duly notified and informed of such data sharing.

• Managing and controlling physical access to Azora Group’s premises: Where applicable, the personal data collected through the form made available at the entrance to the premises will be processed for the purpose of managing and controlling physical access to Azora Group’s facilities, in accordance with the internal access control policy. In particular, such data will be used for the registration, identification, and monitoring of visitors, in order to ensure the security of the premises, personnel, and corporate information.

4. WHAT DATA ARE PROCESSED BY AZORA GROUP AND WHAT ARE THEIR SOURCES?

The data that Azora Group processes as a result of the interactions that you make through the Website or other channels come from the following sources:

• Data you provide by filling in the fields provided by Azora Group to manage communication with users and carry out other tasks, as well as any data you provide through any other means by which you communicate with Azora Group. ⁠
• Data generated as a result of the development, processing, and maintenance of the relationship established between the user and Azora Group.

Azora Group may process personal data of the following types, depending on the relationship established with the user:

• Identification and contact data (e.g., name and surname, email, postal address, telephone, etc.).
• Academic or professional data and/or employment details (e.g. data contained in the curriculum vitae).
• Other data types. Exclusively in the event that you provide other types of data in your interactions with Azora Group, these data will be processed by Azora Group, only if their processing is required for the purpose sought. Otherwise, the data will be erased without having been previously processed or stored by Azora Group.

5. WHAT IS THE LEGAL BASIS FOR THE PROCESSING OF YOUR DATA?

Azora Group processes the personal data you provide in accordance with the following legal bases, depending on the type of data provided and the interactions you have with Azora Group.

• The processing of your data for the purpose of "Contacting, managing and processing enquiries and requests from users" is based on the need to execute a contract between the user and Azora Group to which the data subject is a party or for the application of pre-contractual measures at the request of the latter; that is, in the management of your own request, in maintaining contact between the parties and, where appropriate, in the provision of the service that you requested.

• Likewise, the processing of your data for the purpose of "Sending commercial, promotional or advertising communications” is based on the user’s consent.

• The processing of your personal data for the purpose of “Conducting the recruitment process” is based on the implementation of pre-contractual measures or the intention to enter into a contract.

• Furthermore, the processing of your data for the purpose of “Managing and controlling physical access to Azora Group’s premises” is based on Azora Group’s legitimate interest in ensuring the security of its premises, property and staff, as well as in controlling physical access to them, in accordance with its internal access control policy.

Azora Group hereby informs you that it will only process your personal data for the purposes based on your consent in cases where you have given your consent to each specific processing operation, using the methods obtaining consent made available by Azora Group.

6. WITH WHOM ARE YOUR DATA SHARED?

Your data may be disclosed to other companies within Azora Group that perform functions such as, amongst others, management, supervision, human resources management, regulatory compliance monitoring or auditing. The purpose of this data disclosure is to facilitate the management and processing of the relevant procedures established by law, as other companies within the group may be the commercial entities required to handle the enquiry or proceed with the employment contract. The legal basis for this data disclosure is Azora Group’s legitimate interest of in organizing the human and technical resources of its business group.

Your data will not be disclosed to other third parties, unless expressly required by law or with your consent.

7. HOW LONG IS YOUR DATA KEPT?

Azora Group will keep your personal data for as long as required for the provision of the service requested and/or to achieve the intended purpose of the processing.

Subsequently, provided that you have not exercised your right to erasure, your data will be retained for the statutory periods applicable in each case, taking into account the type of data and the purpose of the processing.

In any case, you may request detailed information about the data retention periods applied at Azora Group by contacting the Data Protection Officer, who can be contacted at rslopd@azora.com.

8. WHAT PERSONAL DATA SHOULD YOU PROVIDE?

When personal data are obtained through a form made available to the user, you must provide at least the data specified as mandatory, in the form in question. If you do not provide at least the information deemed necessary, Azora Group will be unable to properly manage the service, enquiry, action or matter in question

9. WHAT DO YOU NEED TO ENSURE WHEN PROVIDING YOUR PERSONAL DATA?

You must ensure that the information provided is true, accurate, complete, and up-to-date, and you shall be liable for any direct or indirect loss or damage that may arise as a result of a breach of this obligation.

Should you provide data belonging to a third party, you warrant that you have informed that third party of all the aspects of this Privacy Policy and obtained their consent to provide their data for the relevant processing purpose. All of this must be done prior to providing a third party’s data via the Website or any other means made available to the user.

You must be older than 18 to provide your personal data. Users who provide data to Azora Group represent and warrant that they are older than 18 and are entirely responsible for this statement.

10. WHAT MEASURES ARE TAKEN TO PROTECT YOUR PERSONAL DATA?

In response to Azora Group’s commitment to ensuring the security and confidentiality of your data, the security measures required by current data protection legislation have been implemented and the necessary technical and organizational safeguards to prevent the loss, misuse, alteration, unauthorised access, and theft of the personal data provided have been put in place. However, please bear in mind that security measures on the internet are not impregnable.

11. WHAT ARE YOUR RIGHTS OVER YOUR PERSONAL DATA?

Azora Group informs you that you have the following rights over your personal data:

• Accessing your data: You have the right to receive the confirmation of whether personal data affecting you is being processed or not and the right to access your data to find which personal data concerning you is being processing.
• Requesting the rectification or erasure of your data: Under certain circumstances, you have the right to rectify inaccurate personal data that concern you, and that are processed by Azora Group, as well as the right to request the erasure of your data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• Requesting the limitation of the processing of your data: Under certain circumstances, you will have the right to request the restriction of the processing of your data, in which case only the data for which you have requested the restriction of processing will be retained for the exercise or defence of claims.
• To the portability of your data: Under certain circumstances, you will have the right to receive the personal data that concern you and that you have provided to Azora Group, in a commonly used structured format that is automatically read, as well as to their transfer by Azora Group to another controller.
• Objecting to the processing of your data: Under certain circumstances and for reasons connected to your specific situation, you will have the right to object to the processing of your data, in which case, it will no longer be processed unless it is necessary to continue to do so for compelling legitimate reasons or for the exercise or defence of possible claims.

You also have the right to withdraw any consent you have given for the processing of your data, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

You may exercise your rights in the form of a written document identified with the reference "Data Protection", which must be transmitted to calle Villanueva 2B, Escalera 1, Planta SM, 28001 Madrid or rslopd@azora.com.

In the event that the request is not complied with, a complaint may be lodged with the Data Protection Officer at the following e-mail rslopd@azora.com or with the competent supervisory authority.

12. CHANGES TO THE PRIVACY POLICY

The Website Privacy Policy may be updated from time to time. You are therefore advised to review this policy each time you access the Website so that you are adequately informed about how your personal data is processed and how your privacy and information is protected.

Last updated: April 2026.