Universal Registration Document 2022

SOC I AL , ENV I RONMENTAL AND SOC I ETAL RESPONS I B I L I TY I NFORMAT I ON DEVELOP A CULTURE OF RESPONSIBILITY AND ETHICS FOR THE BENEFIT OF ALL OUR STAKEHOLDERS

Employee listening system The Ethics Committee noted that, even though the health crisis, and the resulting air transport crisis, are less significant today, many still feel the need to discuss what was experienced during this period, which involved numerous transformations for Groupe ADP. An employee listening project was launched at the end of 2022 in order to collect, in an anonymous form and on a voluntary basis, employee stories and testimonials. “Whether we like it or not, the crisis marks a before and an after that are now part of the Group’s identity. A collective needs to tell its story to understand and share what has been experienced, what has worked, what has been difficult, what remains to be built. Without story there is no memory and without memory there is no history. Writing a story means regaining a foothold in reality”(Marc Grassin, Philosopher, Doctor of Medical Ethics, Vice-Chairman of the ADP Ethics Committee). The Ethics Committee understood that this crisis, which hit the Group’s employees first, was very complex and could lead to a different understanding of certain fundamentals, perhaps by turning the page on certain previous models. We must undoubtedly reinvent a relationship with work around a meaning, a purpose, values and, therefore, shared ethics. This survey is an opportunity for employees to express their experiences, their fears, their expectations and their ideas. The objectives are multiple: ◆ to keep track of a trying period for the Company and its employees to enrich our collective identity; ◆ to help us fully accept this period so that we can collectively start again on solid and renewed foundations; ◆ to learn lessons on which to capitalize if a new crisis occurs tomorrow; ◆ to enable new employees to better understand the history, identity and values of the Group they have just joined and thus facilitate the construction of a new collective. These testimonials will be shared collectively in 2023 with all employees in the form of an anonymised compendium. Protection of personal data As part of the Group’s activities, ADP may be required to process a certain amount of personal data: employees, customers/ prospects, passengers, partners, service providers, etc. The processing and storage of these data naturally call for a certain number of actions intended to prevent possible breaches of security resulting, accidentally or unlawfully, in the destruction, loss, alteration or unauthorised disclosure of data of a personal nature, or unauthorised access to such data. Aéroports de Paris has appointed a Data Protection Officer (DPO) and liaison officers (PDC) in each department. Only the necessary data are collected, processed and stored securely and in accordance with the regulations (GDPR and the French Data Protection Act). A Group data protection policy has been defined, implemented and monitored. It is based on the Group’s Information Systems Security Policy and the general information protection policy. In

2021, a charter governing the application of the data protection policy was created and provided to all employees. Regulatory requirements are taken into account from the design stage (Privacy by Design) and by default throughout the life of projects (Privacy by Default). Group employees are made aware of the protection of personal data, and the rules of procedure govern the application of these policies by employees. Employees are subject to confidentiality rules (rules of procedure, employment contract, etc.). An e-learning course is being re-deployed for all employees and persons in key data protection positions are invited to in-person training on the requirements of the GDPR, which they must comply with, and/or for which they must ensure application in their daily activities. Standard clauses are provided for inclusion in contracts, agreements and tenders (to be completed, if necessary, with the assistance of the Legal and Insurance Department). Any service provider accessing sensitive information is also subject to confidentiality (contract clause, NDA, rules of procedure where applicable, etc.). Stakeholders are informed how their data is processed. A centralised ADP SA procedure has been implemented to handle requests to exercise rights. A GDPR compliance management platform (ARIEL) has been deployed; in particular, it includes the processing register. Group methods are put in place ( e.g. impact analysis method) and indicators are shared by the various entities. The methodology for conducting IS projects takes into account the protection of personal data. A data violation management procedure has been implemented. A penalty and crisis management system is in place to deal with data violation cases. At Group level, the Group Personal Data Protection Policy defines Groupe ADP’s commitments to protect the Personal Data of its stakeholders and ensure compliance with regulations in this area. It establishes the organisation put in place for this purpose (one DPO must be appointed in each company subject to the GDPR). It specifies the principles and rules to guarantee adequate protection of personal data used in the context of the Group’s activities. Preservation of employment These elements are detailed in the Chapter entitled: “Collective and individual adaptation of resources to strategic orientations, including optimization of employment costs, and support for transformations” in the Section: “Giving the Group and its employees the means to carry out transformations necessary for its sustainability and attractiveness, in accordance with its social and environmental responsibility strategy” and in the Chapters: “Building a long-term relationship of trust with the regions and local players” and “Making the regions the main beneficiaries of airport activities (training, integration and employment)” of the Section: “Acting for the attractiveness of our regions, at the service of all residents, employees and communities of our airports.”

4

305

AÉROPORTS DE PAR I S / UN I VERSAL REG I STRAT I ON DOCUMENT 2022