1. PURPOSE OF THE WHISTLEBLOWING CHANNEL
Following the entry into force of Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combating corruption, the culture of compliance in private entities is strengthened by protecting whistleblowers who report known violations in the workplace or professional context.
In this regard, GTA Villamagna Abogados, SLP has established a specific channel through which Company personnel can report any irregularities they become aware of, freely, without fear of reprisal, and with guaranteed confidentiality.
Furthermore, a corresponding protocol has been developed establishing the appropriate mechanisms to ensure respect for the rights of the person reported, including those recognized in personal data protection regulations.
2. SCOPE OF APPLICATION
The Internal Information System (whistleblowing channel) applies to all individuals who are part of the Company, whether managers or employees, as well as any other person associated with the Company who may become aware of any breach of legal regulations or the entity’s internal rules.
3. KEY ASPECTS ASSOCIATED WITH THE WHISTLEBLOWING CHANNEL
3.1. DUTY TO REPORT
Anyone who has reasonable knowledge of any type of act or event that could constitute an illegal act or an act contrary to the legal system must report it through the whistleblowing channels established for this purpose, which have been made available to all individuals who work for or under the supervision and direction of the Company.
Complaints must contain, at least, (i) a description of the reported events, (ii) the evidence on which the complainant’s suspicion is based, and (iii) the identity of the accused, if the person responsible for the reported event is known.
Complaints must be accompanied by all supporting evidence available to the complainant.
If the complaint is made through a personal interview, a written summary must be prepared and signed by the complainant. If, for any reason, the complainant refuses to sign the summary, the verbally reported events may still be investigated by the Systems Manager.
3.2. REPORTABLE EVENTS
The Complaint Channel should be understood as a tool for reporting irregularities or non-compliance. Therefore, it should not be used indiscriminately, but only for the purposes for which it was designed.
The reported incidents must focus on conduct, breaches, or irregularities that may contravene the Company’s principles and values, or constitute an illegal act or a violation of applicable regulations. Specifically, they must comply with Article 2 of Law 2/2023, of February 20, which regulates the protection of whistleblowers and combats corruption.
4. WHISTLEBLOWER’S RIGHTS REGARDING COMMUNICATIONS MADE THROUGH THE WHISTLEBLOWING CHANNEL
Throughout the whistleblower process, the following rights will be guaranteed:
a) Right to protection during the investigation
All individuals who file a whistleblower complaint will be provided with appropriate protection in accordance with the internal protocol guidelines of the whistleblowing channel.
b) Prohibition of retaliation
Under no circumstances will the whistleblower be subject to retaliation, even if the subsequent investigations determine that there has been no violation of applicable regulations, provided that the whistleblower did not act in bad faith.
By way of example only, and not as a limitation, some actions that may be considered retaliation include:
- Change of job position, change of workplace location, salary reduction.
- Demotion or denial of promotions.
- Negative evaluations or references regarding work performance.
- Suspension, dismissal, termination, or equivalent measures.
- Imposition of disciplinary measures, reprimands, or other sanctions, including reductions in rest periods or vacations.
- Intimidation, harassment, discrimination, or unfavorable treatment.
- Physical or moral harm, or damage to reputation, including on social media.
- Anonymous disclosure of information, identifying the complainant so that they suffer hostility in the workplace.
- Defamation proceedings outside the workplace.
- Invoking the existence of a confidentiality clause between the complainant and the Organization to sanction the complainant for breach of said clause.
c) Right to receive information
The complainant will be informed, once the complaint has been reviewed, whether it is deemed admissible for further investigation.
Once the investigation is complete, the complainant must be informed of the planned follow-up measures, as well as the outcome of the investigations.
d) Right to choose between internal and external channels
The complainant may choose the reporting channel they deem most appropriate, either through internal channels or external channels (competent authorities and/or institutions, bodies, or agencies of the European Union).
e) Right to limited information
During the complaint filing process, the complainant may not be asked for any information that is not strictly necessary for processing the complaint. Subsequently, no information may be requested or retained that is not strictly necessary for the investigation.
In any case, and without prejudice to their rights under data protection regulations, the complainant will be given the opportunity to verify, correct, and accept the transcript of the conversation by signing it.
The information provided by the complainant may not be used for purposes other than the investigation.
f) Right to anonymity
The complainant who submits a complaint through the Whistleblowing Channel may remain anonymous, and this anonymity is guaranteed throughout the process. Including identifying information is optional for the complainant.
g) Right to confidentiality and data protection
The complainant’s identity will be kept confidential and may not be disclosed without their express consent to any person other than personnel authorized to receive and process complaints, with the exceptions established by EU law or Spanish regulations in the context of investigations carried out by the authorities or during legal proceedings.
Personal data provided as a result of filing a complaint through the reporting channels will be processed in accordance with the General Data Protection Regulation (EU) 2016/679, and Organic Law 3/2018 of December 5, on Data Protection and Guarantee of Digital Rights, and other applicable regulations, as well as in accordance with the Company’s internal data protection documentation, which has been provided to all users and outlines their rights and obligations regarding data protection.
Furthermore, if the complaint is made by telephone or in person, the complainant will be informed that the communication will be recorded and will be informed about the processing of their personal data.
(h) Right to receive a response within a reasonable time
The complainant will receive an acknowledgment of receipt of their complaint within a maximum of seven calendar days from its receipt by the organization, unless the body responsible for the investigation considers that such an acknowledgment could compromise the protection of the complainant’s identity.
The time limit for data processing and investigation may not exceed three months from the date of receipt of the report or, if no acknowledgment of receipt was sent to the reporting party, three months from the expiration of the seven-day period following the report, except in cases of particular complexity that require an extension, in which case it may be extended for up to a maximum of three additional months, in accordance with applicable regulations.
i) Right to erasure of data
Three months (or six months, in the case of an extension of the investigation period) have elapsed since the data was entered, it must be erased from the Reporting System, unless its purpose is to retain it to document the operation of the System or it may be used to initiate legal proceedings or investigations by the competent authorities.
5. RIGHTS OF THE ACCUSED PERSON REGARDING COMMUNICATIONS MADE THROUGH THE COMPLAINT CHANNEL
Throughout the complaint process, the accused person will be guaranteed the following rights:
a) Right to protection during the investigation
The accused person will be afforded full protection of their rights, as any employee. No disciplinary or legal measures will be applied until the veracity of the reported facts has been verified, the relevant evidence has been gathered, and the investigation has concluded. The presumption of innocence of the affected individuals will be respected at all times.
b) Right to receive information
The accused person must be informed of the ongoing investigation so that, in the event of allegations of misconduct, they can exercise their right to defense and present any arguments that may prove their innocence.
In cases where disclosing information about the investigation process poses a significant risk to the ability to conduct an effective investigation, notification to the accused may be delayed while such risk exists. The objective is to prevent the destruction or alteration of evidence by the accused.
c) Right to confidentiality and protection of personal data
Throughout the investigation, the accused will be guaranteed the right to confidentiality of their personal data in order to prevent any dissemination of information that could affect their reputation.
Personal data will be processed in accordance with the General Data Protection Regulation (EU) 2016/679, and Organic Law 3/2018 of December 5, on Data Protection and Guarantee of Digital Rights, and other related regulations in force, as well as in accordance with the Company’s internal data protection documentation, which has been provided to all users and outlines their obligations and rights regarding data protection.
d) Right to a transparent investigation
The accused person shall have the right to an investigation based on the objective analysis of the evidence gathered, guaranteeing an effective and transparent investigation.
6. IMPOSITION OF DISCIPLINARY MEASURES
If the investigation conclusively establishes that the investigated facts are true and are linked to irregular or illegal conduct, the accused person may be subject to sanctions in accordance with internal regulations, labor law, and other applicable civil and commercial obligations.
The facts may also be brought to the attention of the relevant judicial authorities if deemed necessary.
If the accused person is a third party with whom there is no employment relationship (supplier, sales agent, or business partner), the applicable sanctions shall be limited to the commercial sphere (such as: limitation of activities or unilateral termination of the contract), without prejudice to the aforementioned notification to the competent judicial authorities, if applicable.
7. REPORTING FALSE OR BAD-FAITH ALLEGATIONS
Reporting channels must be used responsibly and appropriately. Reporting false information with malicious intent and morally dishonest behavior constitutes a breach of the good faith that must govern working relationships within the Company and may result in disciplinary action.
If, after due analysis, it is determined that the reported facts are manifestly false and that the complaint was submitted with malicious intent and bad faith, (i) the complaint will be dismissed, documenting the reasons for dismissing the case, thus concluding the investigation; and (ii) the appropriate disciplinary measures will be proposed and applied.
8. INVESTIGATION PROCEDURE FOR THE WHISTLEBLOWING CHANNEL
The internal procedure that governs the entire lifecycle of a complaint, from its initial submission to its resolution, with the aim of verifying the veracity of the reports, the proper collection of evidence, and guaranteeing the rights of both the complainant and the accused, is divided into the following two phases:
Investigation Phase: This phase includes the initial receipt and evaluation of the complaint, the investigation of the reported events, and the collection of evidence that validates the reported events.
Conclusion Phase: This phase includes the analysis of the evidence and proof provided, and the subsequent adoption of appropriate measures.
8.1. INVESTIGATION PHASE
8.1.1. Communication and Receipt of the Complaint
The complainant must comply with the requirements of the “Duty to Report,” and therefore must include, at least, (i) a description of the events being reported, (ii) the evidence on which the complainant’s suspicion is based, and (iii) the identity of the accused, if the person responsible for the reported act is known, as well as any supporting evidence available to the complainant.
The complaint must be submitted individually. If several people are aware of the same event or circumstance that must be reported, each of them must do so individually through one of the reporting channels.
The analysis of the information and any documentation provided by the complainant may result in one of the following outcomes:
Admission of the complaint: The described events are reportable and may constitute an act contrary to the law.
Inadmissibility of the complaint: The described facts are of a different nature than those covered by the applicable regulations, and therefore the complaint will either be filed or referred to the most appropriate department for handling.
In both cases, the complainant must be informed of the decision made and the reason for filing or accepting the complaint, except if the Whistleblowing Channel has been misused and it is not necessary to inform the complainant of the most appropriate department to handle their report.
8.1.2. Investigation
Once the complaint has been evaluated and accepted, the designated person, acting with due guarantees of confidentiality, will proceed to open an investigation file on the complaint, complying with the requirements of the internal protocol.
The purpose of the investigation file is to ensure maximum traceability of the investigation process, should the complaint be requested by any competent judicial authority.
In the event of any incompatibility being found with the person designated for the investigation, another person will be appointed to avoid potential conflicts of interest.
8.2. RESOLUTION PHASE
Once the evidence has been gathered and analyzed, the investigation phase is closed, and decisions are made regarding the analyzed communication. The investigator will propose the measures to be adopted.
In this regard, a document summarizing the investigation phase and the measures ultimately adopted will be submitted to the governing body.
Based on this, the governing body may adopt the following measures:
Complaint dismissed. If the investigation of the reported facts reveals no breach of contract, the complainant and the accused will be informed of this decision, along with the reasons supporting it.
Complaint upheld. If the reported facts are proven to be true, the actions supporting this conclusion must be detailed. The corresponding sanctions or disciplinary measures will be adopted in accordance with the Company’s internal regulations, labor law, and all other civil and commercial obligations incurred by the employee, without prejudice to any criminal liability that may arise from the commission of offenses.
In all cases, the complainant and the accused will be informed to offer them the opportunity to defend themselves.
9. CONFLICT OF INTEREST
If the complaint directly affects individuals who may actively participate in its management and investigation, or any member of the Board of Directors, they will be automatically excluded throughout the investigation and analysis process until its resolution, as well as, where applicable, from the resolution of the proceedings through the adoption of appropriate measures, in order to avoid any type of conflict of interest or incompatibility, and thus guarantee the objectivity and independence of the actions.
The excluded person will be obliged to maintain the utmost confidentiality of the complaint, and direct or indirect access to any information about the identity of the complainant and the ongoing investigation process will be prohibited.
10. DATA PROTECTION
In accordance with current legislation on the protection of personal data, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Organic Law 3/2018 of 5 December on the Protection of Personal Data, the following additional considerations are taken into account:
a) Duty to provide information regarding the protection of personal data.
The personal data collected from employees and third parties within the framework of the Whistleblowing Channel will be processed solely for the purpose of handling complaints and, if necessary, investigating the veracity of the reported events, thus complying with the legal requirement established in Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, specifically with the provisions of Article 24.
The personal data of the complainant, as well as that of employees and third parties, must be stored in the whistleblowing system only for the time strictly necessary to decide whether to initiate an investigation into the reported events.
Pursuant to Articles 12 to 18, inclusive, of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights, data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent. Notwithstanding the foregoing, the accused person’s right of access will be limited to their own personal data. Given the confidential nature of the reporting channel, they will not have access to data concerning the identity of the complainant. Furthermore, this right will be recognized provided that it does not constitute a fraudulent exercise of said right, or that doing so does not seriously jeopardize the outcome of the investigation.
b) Principle of Proportionality
The personal data collected within the framework of the Reporting Channel:
Will be limited to that which is strictly and objectively necessary to process the reports and, if applicable, to verify the veracity of the reported facts.
Will be processed at all times in accordance with applicable data protection regulations, for legitimate and specific purposes related to any investigation that may arise as a result of the report.
Will not be used for incompatible purposes.
Will be adequate and not excessive in relation to the aforementioned purposes.
c) Security measures
All necessary measures will be taken to preserve the identity and guarantee the confidentiality and security of the data of the individuals affected by the information provided, especially the identity of the person who reported the facts to the entity, if they have been identified in accordance with the regulations on the protection of personal data.
