Internal Information System and Defense of the Informant

Reportable facts:

The Whistleblower Channel should be understood as an instrument that allows the communication of behaviors that may constitute non-compliance or irregularities that may go against the interests of the European Union or may constitute an unlawful act or a breach of applicable regulations.

Rights of the whistleblower:

The whistleblower will have the following guaranteed rights:

Right to anonymity: The whistleblower who submits a report through the Whistleblower Channel may maintain anonymity regarding their identity, guaranteeing the same during the process. It is optional for the whistleblower to include data that allows their identification through the enabled complaint form.
Right to confidentiality: Both the content of the report and the identity of the whistleblower will be confidential, and cannot be revealed without their express consent to anyone other than the competent personnel to receive and process the reports, with the exceptions established by the European Union law or state regulations in the context of investigations carried out by authorities or in the course of judicial proceedings.
Prohibition of retaliation: The whistleblower will be protected against reprisals, even if the investigation carried out verifies that there has been no breach of the interests of the Union or applicable regulations, provided that they have not acted in bad faith.
Right to choose: The whistleblower may choose the most appropriate channel for the report, being able to use internal or external (competent authorities) reporting channels.
Right to receive information: The whistleblower has the right to be informed of the status of their report as well as the results of the investigations.
Right to limited information: The whistleblower will not be obliged to provide data that is not strictly necessary to process the report, and subsequently, data that is not strictly necessary for the investigation cannot be requested or retained. The information provided cannot be used for purposes other than the investigation. In the event that the data is transmitted to a third party to investigate the report (for example, a law firm or external auditor), both the whistleblower and the reported party must be informed beforehand. However, such consent will not be necessary when the transfer is authorized by law. Personal data processed as a result of submitting a report through the FNMT-RCM Whistleblower Channel will be processed in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679, and Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, and other related regulations in force.
Right to exercise data protection rights: The whistleblower will have the right to exercise the rights conferred by personal data protection legislation.
Right to receive a response within a reasonable period: The whistleblower will receive an acknowledgment of receipt of their report within a maximum period of seven days from its receipt, except when the whistleblower expressly requests otherwise or when the body in charge of the investigation considers that such acknowledgment may compromise the protection of the whistleblower's identity. The deadline for data processing and investigation cannot exceed three months in accordance with current regulations.
Right to deletion of data: After three months from the introduction of the data, it must be deleted from the reporting system, except when the purpose is to preserve evidence of the functioning of the Compliance System model or when legal proceedings or investigations by competent authorities derive from it.

Imposition of disciplinary measures:

If it is duly verified during the investigation that the investigated facts are true and linked to irregular or unlawful conduct, the whistleblower may be subject to sanctions in accordance with labor legislation and other civil and commercial obligations that the member of the company's staff, company personnel, or person linked to it may have contracted.

The facts may also be made available to competent authorities if they may constitute a offense.

In the event that the whistleblower is a third party with whom a labor relationship is not maintained (supplier, commercial agent, candidate, etc.), applicable sanctions will be limited to the commercial sphere, without prejudice to the communication of the facts to competent authorities.

Communication of false or bad faith reports:

The Whistleblower Channel must be used responsibly and appropriately. The communication of false facts, with a malicious and morally dishonest attitude, constitutes a breach of good faith that should preside over work relationships or in the commercial sphere.

If, after the appropriate analysis, it could be concluded that the reported facts are manifestly false and that the report has been submitted with a malicious and bad faith attitude: (i) the report will be archived, documenting the reasons that led to the file being closed, ending the investigation work; (ii) said circumstance will be transferred to the HR Director so that, in coordination with the Compliance Committee, disciplinary measures are proposed in accordance with the current Collective Agreement; and (iii) the proposed sanction will be communicated in writing to the Management Committee or, if applicable, to the Board of Directors, who will decide on the disciplinary action to be applied to the malicious whistleblower.

Whistleblower Channel Investigation Procedure:

The internal procedure for managing reports will consist of the following phases:

Initial phase:

If the whistleblower chooses to use the internal Whistleblower Channel, they will have to fill out the complaint form that is available.

The report must be individual. In case several people have knowledge of the same fact or circumstance that must be communicated, each of them must do so individually through the Whistleblower Channel.

The contents required in the communication form are as follows:

Email
Identification of the reported party (unless the report is made anonymously)
Description of the facts through a free field.
Before formalizing the report, the communication must be confirmed by entering a verification text using a CAPTCHA code in order to prevent any false registration within the reporting channel.

It is important that the whistleblower provides sufficient detail about the facts, behaviors, or suspicious activities, so that the Compliance Committee or the Compliance Officer can carry out a preliminary analysis of the content, even allowing the sending of attached files or documents related to the reported facts.

The company must acknowledge receipt of the report to the whistleblower within a maximum period of 7 days. The company may ask the whistleblower to provide additional information if necessary. For example:

Location of the office where the facts occur
Description of the irregularity/section of the procedure on which clarification or interpretation is desired
Time when it occurs
Categorize if it is punctual or recurrent
Identification of the person(s) responsible
Identification of the whistleblower
Detail how the irregularity was discovered
Documentation attached to the report (evidence or indications)
Relevant comments
Evidence or indications: In the case of a report, the circumstances of the same must be detailed and evidence or indications that support it must be attached, together with the identification of other possible witnesses or workers who may have had knowledge of the facts.

If 30 days elapse without obtaining a response to the request, it will be considered that the whistleblower has waived their intention to file a report, except in cases categorized as critical.

Instructive phase:

Opening of the investigation procedure:

Assignment of a risk level to each report, which may be: LOW, MEDIUM, HIGH or CRITICAL
Recording of the date of the report and scheduling of the deadline for resolution
Development of the investigation and collection of evidence or indications
Preparation of a report/record or the investigative actions carried out by the instructor

The deadline for resolution will not exceed 3 months from the acknowledgment of receipt or, if no acknowledgment of receipt was sent to the whistleblower, three months from the expiration of the seven-day period after the report was made.

Exceptionally, the period may be extended to 6 months when necessary due to specific circumstances of the case, in particular the nature and complexity of the object of the report, which may justify a long investigation.

Resolution phase:

The company will issue a Resolution that includes a documented and objective exposition of the facts, followed by a detailed exposition of the result of the investigative actions carried out.

The resolution must be communicated to the whistleblower and the reported party.

Three types of Resolutions are proposed:

Verification of the reported facts: Proposition of corrective measures
No verification of the reported facts: Closing of the case
- In this case, the whistleblower will be provided with clear and easily accessible information on external reporting procedures to competent authorities in accordance with Article 10 of the Whistleblowers Directive and, if applicable, to Union institutions, bodies or agencies.
- Referral of the investigation to another instance: Because it is a crime or because another institution or company is responsible for resolving the reported matter: for this, it may be necessary to request the personal data of the whistleblower in case they have reported anonymously, or obtain their permission to be able to reveal their identity to the authorities.