Cellnex Telecom S A : 2023 Human Rights Due Diligence

Human Rights

Due Diligence and

Assessment

Process

April 2024

TABLE OF CONTENTS
1. INTRODUCTION	3
2. OUR APPROACH	3
2.1. Challenges	4
2.2. Why is this important?	4
2.3. Our commitments	5
2.3.1. Human Rights Policy	5
2.3.2. Committee of Ethics and Compliance	5
2.3.3. Code of Ethics	6
2.3.4. Whistleblowing Channel	6
2.3.5. Other corporate policies	6
2.4. Parties involved in the process	8
2.5. Methodology	8
2.5.1. Due Diligence	8
2.5.2. Risk Impact Assessment	11
3. OUR RISK RESPONSE	14
3.1. Community	14
3.1.1. Privacy, Cybersecurity, and use of technology	14
3.1.2. Partners, suppliers, and contractors	15
3.1.3. The Digital Divide and social contribution	15
3.2. Labour	15
3.2.1. Work conditions and Remuneration	15
3.2.2. Health and Safety	16
3.2.3. Diversity, inclusion, equality and non-discrimination	16
3.2.4. Modern slavery and child labour	17
3.2.5. Freedom of association and collective bargaining	17
3.3. Anti-Corruption and Bribery	17
3.3.1. Anti-Corruption and Transparency	17
3.4. Environment	18
3.4.1. Environment	18
4. MAIN CONCLUSIONS AND FINDINGS	19

2

1. INTRODUCTION

Cellnex is dedicated to upholding Human Rights in its daily operations and across its global value chain, integrating this commitment as a fundamental aspect of its core company values and standard conduct to ensure legitimate business practices. By embracing various international frameworks, Cellnex adopts a robust approach to mitigating risks to individuals associated with its products and services. This commitment is particularly valuable as it prompts regular reviews and decision-making processes concerning products and services with widespread applicability across diverse private, public, and individual stakeholder groups.

'Human Rights Due Diligence is seamlessly integrated

within Cellnex's ESG

agenda'

In 2019, Cellnex solidified its dedication to embedding human rights into core business operations by adopting a Corporate Human Rights Policy, subsequently updated in 2022 in alignment with Due Diligence principles. This roadmap guides Cellnex in advocating for and disseminating Environmental, Social, and Governance (ESG) policies and best practices rooted in the United Nations (UN) principles.

Since 2021, Cellnex has incorporated Human Rights Due Diligence into its ESG agenda, aiming to deliver an ethical approach and valuable insights to its stakeholders and rights-holders.

2. OUR APPROACH

The evident link between human rights and Cellnex's daily commercial activities underscores the importance of integrating human rights considerations into every aspect of Cellnex's operations to uphold ethical standards and create a positive societal impact. The Group adheres to international Human Rights guidelines, including the UN Universal Declaration of Human Rights, the UN Guiding Principles on Business and Human Rights (UNGPs), the Ten Principles of the UN Global Compact, and the UN Sustainable Development Goals (SDGs). These frameworks aim explicitly to enhance human rights. Cellnex reflects these commitments and guidelines in its Human Rights Policy, placing specific emphasis on the ICT sector's alignment with SDG 8: Decent Work and Economic Growth.

Identifying and monitoring ESG risks within the company's operations and supply chain is of paramount importance to Cellnex, enabling the proactive management of legal liabilities and ensuring effective compliance in the realm of human rights. To this end, Cellnex has conducted a Due Diligence and a Human Rights Impact Assessment (HRIA) in accordance with the Guidelines for the Information and Communication sector. The technology (ICT) sector adopts an inter-sectoral Human Rights Business Approach (HRBA) at the infrastructure level1.

For the third consecutive year, Cellnex has carried out a comprehensive Human Rights Due Diligence and Risk Impact Assessment Evaluation, followed by a management review process. Cellnex's Due Diligence emphasizes three commitments:

1 https://www.humanrights.dk/publications/human-rights-due-diligence-internet-infrastructure

3

2.1. Challenges

Cellnex encounters risks stemming from emerging human rights challenges in its day-to-day operations, spanning employment practices, the procurement of services, and operational methods with potential societal ramifications, impacting customer privacy, freedom of expression, children's rights, and discrimination, among others, all further exacerbated by digitalisation. While striving to enhance quality of life, equality, and employment conditions, Cellnex acknowledges its responsibility for potential adverse effects on individual human rights.

Focusing specifically on the ICT (Information and Communication Technology) sector, another main challenge for Cellnex involves the complex and diverse legal frameworks that fluctuate in the countries where the Group operates, and the absence of international mandatory regulations on human rights, which may lead to situations of uncertainty.

2.2. Why is this important?

The HRIA2 is the process by which Cellnex gathers the basic information the Group needs in order to identify which human rights risks can be avoided, mitigated, and/or remedied. Identifying the human rights claims of right-holders and the corresponding human rights obligations of duty-bearers is the starting point to understanding how to translate Cellnex's human rights commitments into practice. Cellnex does this by modelling the impact landscape across the global value chain and integrating stakeholder needs and expectations throughout different company departments. Through this assessment process, Cellnex fosters shared responsibility for addressing potential impacts, aligning its commitments with international and regional due diligence recommendations and guidelines.

In 2023, Cellnex sought to proactively improve upon previous analyses by incorporating inputs from the recent European Sustainability Reporting Standards (ESRS) Gap Analysis. This exercise provided a holistic view of the organisation's operations, identifying overlaps and gaps in human rights considerations within the broader context of sustainability. The combined approach enables Cellnex to identify and mitigate risks more effectively, ensuring that human rights considerations are adequately addressed within the broader framework of ESG risks. In this context, oversight of the Human Rights due diligence process falls under the purview of the Risk Management department, working in tandem with the Sustainability department. Together, they oversee the involvement of various company departments and are tasked with advocating, assessing, and reporting on the implementation of the Human Rights Policy at both local and global levels. This reaffirms Cellnex's dedication to upholding human rights in its business practices.

2 https://www.humanrights.dk/tools/human-rights-impact-assessment-guidance-toolbox

4

2.3. Our commitments

The actions of every individual associated with Cellnex shape both the present and future trajectory of the company. Therefore, the group has established its own Human Rights Policy, Committee of Ethics and Compliance, Code of Ethics, and Whistleblowing Channel, alongside a comprehensive set of policies that underscore the commitment to human rights and steer all company activities.

Cellnex is steadfast in its commitment to upholding internationally recognized human rights and preventing the occurrence or exacerbation of human rights risks. This dedication is evidenced by aligning with key frameworks such as the International Bill of Rights and the International Labour Organisation's (ILO) Declaration on Fundamental Principles and Rights at Work. The company proactively addresses any human rights risk events it is involved in or may become involved in by continually enhancing its efforts to promote and respect these rights.

2.3.1. Human Rights Policy

The cornerstone for addressing human rights resides in Cellnex's Human Rights Policy. This document formalises Cellnex's dedication to respecting and promoting human rights throughout its business operations and value chain, encompassing partners, employees, and other rights-holders. It utilises key international standards as a reference point.

Cellnex confirms its commitment to protect and respect universally recognized Human Rights within the Group's sphere of influence, and to mitigate and rectify any harm that may be caused. These general guidelines establish a framework for action, representing a minimum standard for conducting the company's operations.

The Policy takes as a reference the main international standards to which it is committed and which it adopts as a regulatory framework for the limits within which the company's activities must be carried out:

• UN International Bill of Human Rights
• ILO's eight fundamental conventions
• Guiding Principles of the UN Global Compact
• UN Guiding Principles on Business and Human Rights
• OECD Guidelines for Multinational Enterprises
• The United Nations Convention on the Rights of the Child and Business Principles

2.3.2. Committee of Ethics and Compliance

The Board of Directors and Management of Cellnex Telecom are dedicated to cultivating a robust culture of compliance, ethics, and integrity across all activities of the Cellnex Group. This commitment extends to members and professionals within the Group, as well as representatives, suppliers, and other third parties acting on its behalf.

In this context, the Committee of Ethics and Compliance is tasked with actively promoting business ethics and integrity and ensuring the efficient operation of Cellnex's compliance system. The committee possesses extensive authority and operates independently in carrying out its responsibilities.

5

2.3.3. Code of Ethics

Cellnex's Code of Ethics serves as the cornerstone regulation governing the Cellnex Group, establishing overarching guidelines for conduct that must be adhered to. Aligned with the Group's culture, no internal regulations of companies within the Cellnex Group may contradict its provisions.

Together with other rules, regulations, and policies forming the Group's ethical and compliance framework, the Code of Ethics outlines the values, commitments, and standards expected to be upheld by all individuals subject to it and stakeholders of the Cellnex Group. This framework respects both human rights and specific labour rights.

2.3.4. Whistleblowing Channel

Cellnex's Whistleblowing Channel is a communication tool accessible to anyone subject to its Code of Ethics, as well as any other third party. This platform enables individuals to report, in good faith and without fear of reprisal, any violations of current legislation and/or internal regulations they observe within Cellnex.

The Cellnex Group has introduced this reporting channel to foster a strong culture of integrity and ensure the highest levels of independence and confidentiality for potential whistleblowers. The management of the Whistleblowing Channel is outsourced to an independent third party expert.

2.3.5. Other corporate policies3

• RISK MANAGEMENT POLICY: For Cellnex, understanding and effectively managing the company's risks are of utmost importance. Cellnex has a Global Risk Management Policy approved by the Board of Directors that sets out the group-level risk strategy. This Policy outlines the fundamental principles and commitments concerning risk management within the organisation, its communication to stakeholders, and its gradual integration into all operational systems and processes of the Cellnex Group. Compliance with this Policy is obligatory for all companies within the Cellnex Group. With the approval of the Policy, two initiatives were launched to reinforce the company's commitment to the integral management of risks: the creation of the Global Risk Committee and the creation of the Risk Management department.
• ESG POLICY: Cellnex's commitment to ESG principles is a top priority for the Group and a central element of its corporate strategy. The ESG Policy outlines fundamental guidelines and action plans concerning Cellnex's ESG strategy, facilitating the formalisation and specification of ESG principles within the organization, their communication to stakeholders, and their gradual integration into all operational processes of the Group. Sustainability forms a cornerstone of Cellnex's business model, particularly in the collaborative management of telecommunications infrastructures. The ESG-based value creation model is actualized through the ESG Master Plan 2021-2025, which serves as a framework for implementing the Group's ESG strategy across all countries of operation. The ESG Master Plan underwent a mid-term review in 2023, in order to update the actions for 2023-2025.
• ENVIRONMENT AND CLIMATE CHANGE POLICY: Sustainability and addressing climate change stand as strategic priorities and universal commitments that must permeate every action and activity undertaken by Cellnex. The dedication to creating sustainable value for stakeholders is integral to the company's business ethos. Cellnex's Board of Directors adopted the Environment and Climate Change Policy in 2021, which embodies the principles that promote sustainable development. With the goal

3 All corporate policies are available on the corporate website: https://www.cellnex.com/investor-relations/corporate-governance/#shareholders-investors-corporate-policies

6

of raising the company's level of responsibility, the Policy includes binding principles and commitments to the operations of all business units. The Policy was updated in 2023 and aims to strike a balance between profitability, social development, and mitigating environmental risks.

• EQUITY, DIVERSITY, AND INCLUSION POLICY: This Policy sets out the guidelines and action points concerning Equity, Diversity, and Inclusion (EDI), enabling the realisation and reinforcement of diversity within Cellnex's framework. It also establishes methods for communicating these principles to stakeholders and implementing them across all company entities. Recognising people as Cellnex's most valuable asset, the company prioritises diversity, equality of opportunities, non-discrimination, and workplace inclusion as key and strategic factors.
• INFORMATION SECURITY POLICY: Information is a highly valuable asset for Cellnex, and it is imperative to ensure its confidentiality, integrity, and availability in line with internationally recognized standards for Information Security Management in telecommunications infrastructure provision to operators, broadcasters, public administrations, and corporations. This Policy establishes the principles and action plans for Information Security, dictating how Cellnex will manage and safeguard its information and services. Additionally, it outlines strategies for communicating these measures to stakeholders and implementing them across all companies and functional areas of the Group.
• OCCUPATIONAL HEALTH AND SAFETY POLICY: Ensuring a safe and healthy work environment is paramount for Cellnex, underpinning its overarching goal to safeguard the welfare of all personnel involved in its operations. This entails implementing comprehensive measures aimed at identifying, mitigating, and managing occupational hazards, promoting proactive safety practices, providing adequate training and resources, and fostering a culture of continual improvement and accountability in matters of health and safety. This Policy lays down Cellnex's fundamental principles and action strategies in the realm of Occupational Health and Safety, reflecting the company's commitment to prioritising the protection of life and the physical well-being of individuals.
• PERSONAL DATA PROTECTION POLICY: In today's information society, personal data holds immense significance. The protection of personal data serves as a legal response to the challenges posed by technological advancements, aiming to mitigate potential negative impacts on individuals' rights and freedoms. Recognising the importance of compliance with applicable legislation concerning personal data processing across all its entities, the Cellnex Group has a Personal Data Protection Policy. This Policy outlines the general principles and guidelines that the organisation advocates for throughout its operations to ensure that personal data handling aligns with legal requirements.

7

2.4. Parties involved in the process

The current Human Rights Due Diligence document also establishes a shared framework for comprehending activities, guidance, and recommendations across the project's focal areas. The Due Diligence process has been conducted as an extension of the company's corporate risk update. The tracking and management of these risks will be closely aligned with the corresponding monitoring system.

Considering the assessment is a cross-cutting project and requires the collaboration of various parties, the process counts on the participation of the following 11 functional areas within Cellnex:

2.5. Methodology

To identify and evaluate pertinent risk events and ascertain the nature and scope of human rights risks, the methodology draws inspiration from the HRBA, a working methodology grounded in internationally recognised human rights standards such as the UN Guiding Principles Interpretive Guide and the OECD Due Diligence Guidance for Responsible Business Conduct. The objective of this assessment is to establish a framework that steers Cellnex's efforts in understanding its potential human rights impacts, with the aim of advancing, safeguarding, and fulfilling human rights and democratic obligations in practice. This involves integrating the frameworks, standards, and principles of the international human rights system into Cellnex's development plans and processes.

The evaluation exercise has been divided into two different phases: the Due Diligence process and the Risk Impact Assessment.

2.5.1. Due Diligence

Guidance for understanding the material topics

The initial phase, Immersion, involves gathering data on Cellnex and identifying risk events while considering the commitments and principles outlined in Cellnex's Corporate Human Rights Policy. This phase also entails assessing potential infringements on human rights and responding to the company's commitment to its employees, suppliers, community, and other key rights-holders. Human rights risks, both current and potential, have been thoroughly evaluated across the entirety of Cellnex's value chain. Cellnex may be directly or indirectly implicated in human rights risk events such as human

8

trafficking, child labour, and community displacement. Consequently, these factors must be taken into account when assessing operations, locations, legal regulations, and potential risks within the supply chain.

Concerning the framework criteria used for the evaluation, they encompass establishing terms of reference and developing a baseline, assessing prioritization, and managing current, potential, and possible risks and opportunities. Additionally, policies for remedial actions have been outlined to prevent, mitigate, and address previously identified impacts, particularly within the supply chain and through business relationships.

Identification of risk landscape and vulnerable groups

The connection between Cellnex's daily operations and Human Rights, especially those pertaining to Cellnex's key rights-holders, is indisputable, therefore necessitating a holistic and systematic approach. This reaffirms the obligation and responsibility to ensure that Cellnex's operations do not affect the rights of individuals.

The evaluation is based on the list of the 35 Human Rights included in the International Finance Corporation (IFC) Human Rights Impact Assessment and Management Guide4 (labour conditions, economic and social well-being, civil and political rights, security, non-discrimination, rights of communities and indigenous peoples, etc.), the UN Guiding Principles, and the Ten Principles of the UN Global Compact.

The identification process has consisted of:

• Defining the current and potential risk events applicable to Cellnex's activity, as well as identifying the primary and secondary human rights that could be violated.
• Identifying key rights-holders in throughout the entirety of the value chain that may be affected by the aforementioned risk events (e.g. employees, local and indigenous communities, suppliers, and customers, among others).
• Including each risk event within the scope of Cellnex's commitments defined in the Group's Human Rights Policy.

As a result of this process, 20 risk events have been identified and assessed in 2023. This number represents an increase in risk events from 2022's risk assessment. This is due to the increased segregation of risk events that was applied during this year's evaluation, in addition to the assessment's alignment with the Corporate Sustainability Reporting Directive (CSRD) / ESRS requirements (see more detailed information regarding these updates in section 2.5.2. Risk Impact Assessment).

Risk events

The main categorisation of the risk events has been determined using the four pillars of the UN Global Compact5 as inspiration, which constitutes a value system for the company and a principle-based approach to business practices. Even though this classification draws inspiration from the UN Global Compact, there is some variation in the nomenclature and conceptualisation of the pillars - the first pillar focuses on Community instead of Human Rights, as human rights is considered to be an overarching topic that encompasses all of the pillars. By incorporating the Ten Principles of the UN Global Compact under the umbrella of the company's risk strategy, Cellnex is agreeing to operate with

1. https://www.ifc.org
2. https://www.unglobalcompact.org/

9

a fundamental responsibility to adhere to community rights, labour protections, environmental regulations, and anti-corruption policies.

Various aspects of due diligence controls, including responsibilities, a human rights-based approach, management channels, and the integration of potential mitigation and remediation action plans, have been thoroughly examined for each of the pillars.

Community

As a wireless telecommunications infrastructure operator and service provider, Cellnex could be regarded as a potential contributor to risk events that could impact not only clients but also other key rights-holder groups within its value chain.

The Community Pillar ensures Cellnex's commitment to promoting non-discrimination, transparency, freedom of expression, and responsible utilisation of technological resources, among other pertinent issues. It also aims to encompass the risk events that do not fall under the other three pillars.

Labour

The HRIA identified a general need for further capacity-building for management personnel in relation to the working environment, particularly to address harassment. This includes, but are not limited to, good hiring practices, employee complaint mechanisms, and diversity and inclusion commitments. The repercussions of neglecting these rights encompass the erosion of labour rights, the perpetuation of modern slavery, the fragmentation of social cohesion and communities, personal, local, and national insecurity, the compromise of public health, limited access to public services, and unequal treatment in people management.

The Labour Pillar upholds and honours the freedom of association and expression in the workplace, ensuring accessibility to information, data protection, security, and health. Additionally, it encompasses the effective acknowledgment of the right to collective bargaining, the eradication of child labour, and the elimination of employment discrimination.

10