Data Protection Information – “Into the Forest” Conference

Data Controller: Jerónimo Martins, SGPS, S.A. (legal entity 500 100 144)

Hereinafter referred to as Jerónimo Martins or Data Controller.

Purposes of Processing, Legal Basis, and Retention Periods

The personal data (name, job, company/organization, and email address) will be processed for the following purposes:

1. Sending invitations, based on Jerónimo Martins’ legitimate interest in communicating relevant events and initiatives, promoting engagement and the relationship with stakeholders.

2. Event management: registration, participation control, and the sending of information related to the conference. The data is processed on the basis of the contractual obligation established with data subjects at the time of registration. This data will be retained until the user’s deletion from the platform, which occurs after two years of inactivity. For further details, please consult the Platform’s Data Protection Policy.

3. Online participation management, including providing access to the live streaming platform and sending conference-related information. Personal data is processed on the basis of the contractual obligation established with participants at the time of registration and will be retained for a period of one year, after which it will be securely deleted.

4. Email communications from Jerónimo Martins Group’s Corporate Responsibility area, based on the data subject’s consent. Data will be retained until the subscription is cancelled.

In the case of registrations for in-person participation, data will also be processed for:

5. Meal service management, collecting information regarding guests’ food restrictions, based on consent. This personal data will be deleted within a maximum of 30 days after the event takes place.

6. Institutional communication and dissemination. During the Conference, participants’ image may be captured as part of the event’s live streaming, which will remain available on various online platforms after its conclusion. Images may also be recorded in video or photograph for institutional dissemination purposes, based on consent. The purpose will be pursued by the Data Controller and, for situations provided for in the “Communication of Personal Data” paragraph below, by the Jerónimo Martins Group companies, of which the Data Controller is a part, through the promotion of the activity, individually or together with other similar or related activities. Personal data will also be stored for the purpose of maintaining the Data Controller's historical and rolling records, for which there is a corresponding legitimate interest. Appropriate security measures will be implemented, as stipulated by law.

   Personal data collected may be freely reproduced in photographs, videos or other internal or external communication material produced by the Data Controller or by the companies to which the respective personal information is provided, pursuant to the terms stipulated below, individually or together with other images and/or voice recordings. Such images and/or voice recordings may be used and adapted in any way and disclosed in any territory, using the internal and external means of dissemination available to the aforementioned entities, or which such entities use, namely the intranet, in-house magazines, newsletters and apps, corporate websites, social media and external media produced and edited by third parties. Personal data will be stored as long as these channels exist, and may be used for institutional promotion and integrated into a historical archive, for the same periods of time.

Data Subject’s Rights and How to Exercise Rights

Under current legislation, personal data subjects are guaranteed the right to access, rectify, oppose the processing, portability, deletion, and limitation of the processing of their personal data. Whenever the sole condition for the legitimacy of processing is the consent of the owner, they may withdraw such consent at any time, without compromising the lawfulness of the processing carried out up to that date.

Data subjects may exercise any of the aforementioned rights, within the limits stipulated by applicable law, through an e-mail to comunicacao@jeronimo-martins.com.

Data subjects also have the right to lodge a complaint with the Supervisory Authority in Portugal (CNPD).

With regard to image processing, if the data subject does not consent to the collection of their image, they should request an identifier from the support services to ensure that their data is not captured during the event.

Security Measures

In order to ensure the security of the personal data it processes, the Data Controller has implemented the technical and organizational security measures deemed necessary for processing activities.

Communication of Personal Data

The personal data collected may be shared with companies belonging to the Jerónimo Martins Group and reproduced, adapted, or reused by them for the processing purposes identified above.

Within the scope of the aforementioned processing purposes, the Data Controller may also use other companies belonging to the Jerónimo Martins Group or external partners and service providers, namely for the development, maintenance, and hosting of information systems, and communication agencies for content management and production, ensuring, in all cases, the appropriate security measures for the protection of the personal data in question. The personal data being processed may be transferred to entities located in countries outside the European Economic Area, while maintaining the commitment to uphold the appropriate security measures required by law.

In cases where personal data is reproduced in external media, it may be shared in periodicals produced and edited by third parties, and on platforms and social networks, which have their own Privacy Policies.

Data Protection Officer

Jerónimo Martins has appointed a Data Protection Officer, who can be contacted for clarification of any questions regarding the information contained in this document via the following e-mail address: dpo.portugal@jeronimo-martins.com.

Version: v.23092025