The purpose of this Ethics Channel Operating Policy (hereinafter, the "Policy") is to define and establish an ideal and effective operating model for the Internal Information System (hereinafter, the "Ethics Channel") of SANT DALMAI, S.A.U., adapted to the regulations on this matter (DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons reporting breaches of Union Law (hereinafter, "Whistleblower Directive") and Law 2/2023, of February 20, 2023, regulating the protection of persons who report regulatory and anti-corruption breaches (hereinafter, "Law on the protection of whistleblowers"), as well as the highest national and international standards in force (UNE-ISO 37002:2021 on Whistleblowing Management Systems). Guidelines), which allows you to receive and process:
This Policy establishes the procedure that regulates the operation of the Ethics Channel of SANT DALMAI, S.A.U., in such a way that it includes the issues related to the making of communications by the reporting persons, as well as the management and resolution of the same by the System Manager.
The purpose of this Policy is to guarantee a professional, confidential, impartial management and maximum protection of the rights of interested parties (including the rights recognised in the regulations on the protection of personal data) throughout the process of making, managing, processing, investigating and resolving communications made through the SANT DALMAI Ethics Channel. S.A.U.
In this regard, this Policy establishes three basic guarantees:
This Policy is applicable to all members of SANT DALMAI, S.A.U. (including employees and managers, shareholders and members of the Board of Directors, regardless of the position they hold within the organisation, the legal nature of their relationship and whatever their area of activity or hierarchical level). who have knowledge, in an employment or professional context, of any infringement set out in section 1 of this Policy.
Likewise, the provisions of this Policy will also be extended to third parties such as: business partners, collaborating companies, subcontractors, suppliers and other persons or entities that have a professional relationship with SANT DALMAI, S.A.U.
SANT DALMAI, S.A.U. guarantees the utmost confidentiality of the communications received through its Ethics Channel and of the data contained therein.
The identity of the person who reports an irregularity through the Ethics Channel will be considered confidential information and, therefore, will not be communicated to the person reported. In the same vein, the confidentiality of the identity of the person denounced shall be guaranteed.
Likewise, there is an express prohibition that the personal data contained in the communication and resulting from the research carried out be known to any person other than those expressly authorized. In this regard, specific confidentiality commitments will be signed with the people in charge of managing them.
Notwithstanding the foregoing, the data of the person making the communication may be provided to the administrative, judicial or public prosecutor's authorities, to the extent that they are required by such authorities as a result of any criminal, disciplinary or sanctioning procedure arising from the subject matter of the communication.
This transfer of data will always be carried out in full compliance with the legislation on the protection of personal data, requiring that in any case access by third parties to it is prevented.
When the communication is sent through reporting channels other than those established in this Policy or to members not responsible for its processing or to non-competent personnel, there will be an obligation on the part of the recipient of the communication to send it immediately to the System Manager, guaranteeing the confidentiality of the communication at all times. Failure to comply with this obligation will be classified as a very serious infraction, so SANT DALMAI, S.A.U. may adopt the appropriate disciplinary measures.
The procedures for processing, investigation and resolution and, in general, for the management of communications received through the SANT DALMAI, S.A.U. Ethics Channel will be governed by maximum objectivity and independence, and the corresponding mechanisms will be established in this Policy in order to avoid the occurrence of possible conflicts of interest.
All communications submitted through the Ethics Channel must be made in good faith. This means that, at the time of submission of the communication, the reporting person must have reasonable and sufficient grounds to believe that the information provided is true, truthful and contains possible violations.
In this sense, false or malicious communications or complaints may give rise to the corresponding sanctions by SANT DALMAI, S.A.U., without prejudice to the civil and even criminal liabilities that may arise.
3.4. PROHIBITION OF RETALIATION
SANT DALMAI, S.A.U. undertakes not to adopt any form of retaliation, threats of retaliation or attempts at retaliation, direct or indirect, against persons who, in good faith, have reported any irregularity through the Ethics Channel.
Retaliation should be understood as any act or omission that is prohibited by law, or that, directly or indirectly, entails unfavourable treatment that places the persons who suffer them at a particular disadvantage compared to another in the work or professional context, solely because of their status as informants.
Protection against retaliation also extends to individuals who report potential violations through the external reporting channels referred to in Section 6 of this Policy.
In addition to whistleblowers, the prohibition of retaliation set forth in this Policy also extends to the following individuals:
In the event that any member of SANT DALMAI, S.A.U., in contravention of the provisions of this Policy, directly or indirectly retaliates, it will be the organization itself that will take the necessary measures to stop the reprisals as soon as possible and, where appropriate, will take appropriate disciplinary measures against those responsible for them.
Likewise, this Policy will also guarantee the rights to privacy, to be heard, to be informed of the actions or omissions attributed to him/her, to defense, honor and the presumption of innocence of the persons subject to the investigation, as well as the right to access the file.
4.1.PRESENTATION OF PAPERS
4.1.1.AVAILABLE CHANNELS
Reporting persons may make communications through the channels provided for this purpose.
In this regard, SANT DALMAI, S.A.U. makes available the following channels to carry out the communications included in this Policy:
At the request of the reporting person, the communication may also be submitted through a face-to-face meeting with the System Manager, which, if applicable, must be carried out within a maximum period of seven (7) days from the request.
4.1.2. COMMUNICATION INFORMATION
The communication shall contain the following information:
If, after evaluating the content of the communication, it lacks the minimum requirements that are mandatory for its correct assessment, by the System Manager, the corresponding information and/or documentation will be requested from the reporting person through the means of communication indicated by the latter, proceeding to archive the communication, in case of not having the necessary information for the opening of the investigation phase.
4.2. MANAGEMENT AND RESOLUTION OF
COMMUNICATIONS 4.2.1RESPONSIBLE FOR THE SYSTEM
The Board of Directors is the competent body for the appointment, as well as the dismissal or dismissal, of the Head of the System, who, in turn, is responsible for the management and processing of communications that enter through the Ethics Channel of SANT DALMAI, S.A.U.
The person in charge of the system may be a natural person or a collegiate body that must delegate to one of its members (natural person) the powers of management and processing of investigation files.
Both the appointment and dismissal of the Head of the System will be notified to the Independent Authority for the Protection of Whistleblowers (A.A.I.) or, where appropriate, to the competent authorities or bodies of the Autonomous Communities.
In this regard, the Board of Directors of the parent company of the Disbase Group has appointed a natural person as System Manager to carry out the management and processing powers of the communications of the Ethics Channel, in all the companies of the Group.
The Head of the System shall act independently of the rest of the functions and hierarchical or functional subordination that, where appropriate, may exist, carrying out the necessary tasks under the premises of confidentiality, respect, independence, neutrality, impartiality, honesty and objectivity towards the persons affected by the communication in question, also ensuring that the procedure is carried out in accordance with the procedures and principles established herein Politics.
In the event that the System Manager has an incompatibility or conflict of interest with the event or persons that are the subject of the communication, he/she will refrain from participating in the management and processing of the communication and will therefore not have access to the information derived from the actions carried out in the management of the same. In this regard, the System Manager shall be replaced by another person designated and appointed by the Administrative Body or other competent body.
The main competencies of the System Manager in the field of management of the Ethics Channel of SANT DALMAI, S.A.U., are the following:
The System Manager will carry out these functions and powers independently and autonomously with respect to the rest of the organisation's bodies.
In order to carry out the above functions and competencies, and in those cases in which it is deemed necessary, the System Manager may be assisted by an external consultant or even delegate to the latter any of the above functions. In this sense, the System Manager must obtain a confidentiality agreement from the external collaborators involved in the management and resolution of the communication. In the same way, it will collect it from internal collaborators when it deems it necessary.
4.2.2.RECEPTION AND EVALUATION
Once a communication has been received through the Ethics Channel, the System Manager will proceed to register it in a Communications Record Book, assigning the communication an identification code.
The Communications Record Book is contained in a secure database (Information Management System) with access restricted exclusively to authorised persons, and all communications and information received through the Ethics Channel and during their processing will be recorded.
In each of the records of the communications recorded in the Communications Record Book, the following data shall be recorded:
The Register-Book shall not be public and only at the reasoned request of the competent judicial authority, by means of an order, and within the framework of a judicial proceeding and under the supervision of the latter, may all or part of its contents be accessed.
Once the communication has been received, within a maximum period of seven (7) calendar days following its receipt, the System Manager will send an acknowledgement of receipt of the communication to the reporting person, unless the person is anonymous; the complainant has opted out of receiving communications related to the investigation, or; that this may jeopardise the confidentiality of the communication.
If the reporting person accepts it, the possibility for the System Manager to maintain communication is expressly foreseen.
The System Manager will check the content of the communication. If documentation is missing or has any formal defect, it will make a request for information to the reporting person. Likewise, the Data Controller, if it deems it necessary, may request additional information from the reporting person regarding the communication made.
The System Manager must verify whether the communication exposes facts or conduct that are within the scope of application of this Policy and, therefore, whether it is admissible.
Once this preliminary analysis has been carried out, the System Manager, within a period that may not exceed ten (10) business days from the date of entry of the communication information in the Record Book, shall:
1. Admit the communication.
2. To dismiss the communication, in any of the following cases:
3. When the facts reported lack all plausibility.
4. When the facts reported do not constitute a violation of the assumptions established in this Policy.
5.When the communication is manifestly unfounded or there are, in the opinion of the System Manager, reasonable indications that it has been obtained through the commission of a crime.
In the latter case, in addition to the inadmissibility, the Public Prosecutor's Office will be sent a detailed account of the facts that are considered to constitute a crime.
6.Where the communication does not contain new and significant information on infringements compared to a previous communication for which the relevant proceedings have been concluded, unless there are new factual or legal circumstances justifying a different follow-up.
In these cases, the System Manager will notify the reporting person of the decision in a reasoned manner.
Likewise, communications in which the facts described are misleading and/or there is corroboration that the communication was made in bad faith, that is, with the intention of harming the organization or third parties related to it, will not be admitted.
1.Immediately forward the information to the Public Prosecutor's Office where the facts could constitute a criminal offence or to the European Public Prosecutor's Office (EPPO) if the facts affect the financial interests of the European Union.
2.Forward the communication to the authority, entity or body that is considered competent to process it.
The decision to admit, refuse or send the communication will be communicated by the System Manager to the reporting person within five (5) business days following the decision being made, unless the communication is anonymous or the reporting person has waived receiving communications.
The System Manager will also assess the advisability or need to adopt immediate measures to avoid further damage and, where appropriate, implement them.
4.2.3. PROCESSING AND INVESTIGATION
Once the communication has been admitted for processing, the System Manager, acting as an instructor, will carry out all the necessary actions, diligences and investigations aimed at verifying the plausibility of the facts of the communication, and may entrust this task to an external expert, if the circumstances so require.
Therefore, the veracity and accuracy of the information contained in the communication and, in particular, of the reported conduct will be checked, following at all times the principles established in this Policy and under a strict regime of confidentiality to respect the rights of the reporting person and the person under investigation.
During the investigation, the person under investigation shall be notified of the communication with a brief account of the facts established therein. This information may be made during the hearing of the person under investigation, if it is considered that its prior provision could facilitate the concealment, destruction or alteration of the evidence.
Without prejudice to the right to make written submissions, the investigation shall include, whenever possible, an interview with the accused person in which, always with full respect for the presumption of innocence, he or she shall be invited to present his or her version of the facts and to provide such evidence as he or she considers appropriate and relevant.
In order to guarantee the right of defence of the person denounced, he or she will have access to the file (without revealing information that could identify the person informing) and may be heard at any time. You will also be advised of the possibility of being assisted by a lawyer.
In addition, the investigator will hold a hearing for all the persons concerned and possible witnesses and will carry out any steps he deems necessary (reviewing documentation, obtaining information from external sources, etc.). In this regard, all members of the organization are obliged to cooperate loyally in the research that is carried out. The testimony of witnesses and persons concerned shall be strictly confidential.
The researcher may gather all the information and documentation he/she deems appropriate from any area or department of the organization, in order to substantiate the investigation.
A written record shall be drawn up of all the investigative actions and, in particular, of the explanations/statements given by the persons who have taken part in the procedure for investigating the communication, (provided that their prior consent is obtained), which shall be duly signed by the persons involved in order to certify their content and that they conform to their statement. The content of this report will be incorporated into the Information Management System of SANT DALMAI, S.A.U. with the same guarantees of confidentiality as the rest of the file.
In the event that the presence of the person under investigation during the investigation period could compromise the conduct of the investigation or the strict observance of the guiding principles of the procedure established in this Policy, at the proposal of the investigator, the person under investigation may be granted paid leave to be absent from his or her job. without loss of remuneration, in order to ensure that the necessary research activities are carried out without interference that could be detrimental to it. Paid leave will be granted for the time necessary to carry out the appropriate research work, and may in no case be extended beyond the duration of the investigation process.
External legal counsel shall be allowed to be present at hearings/statements of affected parties, interested parties, witnesses, etc., if the investigator deems it appropriate.
In all investigation proceedings, special attention shall be paid to compliance with the principles contained in this Policy and the confidentiality, impartiality, as well as the rights to privacy, defence, honour and presumption of innocence of the persons under investigation shall be guaranteed. Likewise, the procedure will be transparent and will guarantee the right to information of the persons involved in it.
4.2.4. TERMINATION AND COMMUNICATION
Once all the investigation actions have been concluded, the System Manager will prepare and issue a report containing at least the following content:
Once the Report has been issued, the System Manager will adopt one of the following decisions:
The maximum period for responding to the investigation actions may not exceed three (3) months from the receipt of the communication, except in cases of special complexity that require an extension of the period, in which case, it may be extended, by decision of the System Manager, up to a maximum of another three (3) additional months.
The proposed resolution will be sent to the Administrative Body or competent body, which must adopt and execute the final resolution.
Whatever the decision, it will be communicated to the reporting person within five (5) working days of the decision being made, unless they have waived it or the communication is anonymous, as well as to the rest of the affected parties.
In the event that the resolution issued concludes that a member of SANT DALMAI, S.A.U. has committed an irregularity, the disciplinary, administrative or judicial proceedings that are legally appropriate will be initiated.
Likewise, if, as a result of the investigative measures, other facts are noticed that could constitute new irregularities allegedly committed by the same or different persons of the investigated, the investigator will propose the opening of a new file, or if it is related to what has been instructed in the file that is being carried out, the extension of the investigative file, if it considers it more appropriate.
When it is determined that the reported conduct constitutes an infringement in labour matters, SANT DALMAI, S.A.U. may adopt the appropriate measures in accordance with the applicable disciplinary regime and, specifically, with the provisions of the applicable Collective Bargaining Agreement and the Workers' Statute.
Without prejudice to the fact that the mandatory labour regulations applicable at all times will be observed in all cases, to the extent that it allows it, in order to assess the seriousness of the conduct, for the purposes of the graduation of the sanctions to be imposed, the following criteria may be considered, among others:
Notwithstanding the adoption of disciplinary measures, when the facts may constitute an offence, the corresponding information shall be immediately forwarded to the Public Prosecutor's Office. In the event that the facts affect the financial interests of the European Union, it will be referred to the European Public Prosecutor's Office.
5. DATA PROTECTION AND RETENTION
1. DATA CONTROLLER
In compliance with the provisions of the General Data Protection Regulation and the Data Protection Law, we inform you that the personal data that, where appropriate, may be included in the communication, will be integrated into a file owned by SANT DALMAI, S.A.U. for processing.
SANT DALMAI, S.A.U. is committed to maintaining strict protection of privacy, security and data retention, as detailed in our policies, procedures and internal regulations in this area. In this regard, these rules shall also apply with respect to all personal data relating to communications made in accordance with this Policy.
2. DATA COLLECTION
In the processing of communications (making and researching them) carried out in accordance with this Policy, SANT DALMAI, S.A.U. collects the following personal data:
3. PRESERVATION OF THE IDENTITY OF THE REPORTING PERSON AND OTHER AFFECTED PERSONS
SANT DALMAI, S.A.U. will preserve the identity and guarantee the confidentiality of the data corresponding to the affected persons and to any third party mentioned in the information provided, especially the identity of the reporting person if identified. In this regard, the person to whom the facts related in the communication refer will in no case be informed of the identity of the informant.
In this sense, whoever submits a communication has the right not to have their identity revealed to third parties. The identity of the reporting person may only be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or punitive investigation.
These disclosures will be subject to safeguards set forth in applicable law. In particular, it will be passed on to the reporting person before revealing his or her identity, unless such information would jeopardise the investigation or legal proceedings.
4. DATA RETENTION
SANT DALMAI, S.A.U. will keep a record of all communications received. These records and the personal data they contain will be kept confidential in the Information Management System. Records will not be kept longer than necessary and in any event for as long as necessary to comply with any applicable legal requirement at any given time.
SANT DALMAI, S.A.U. will keep the personal data of the complainant for the time necessary to decide on the appropriateness of initiating an investigation into the facts or conduct reported and, once decided, they will be deleted from the Ethics Channel, being able to be processed outside the system to investigate the facts for the time necessary to make a decision. Once the investigation of the communication has been completed and the appropriate actions have been taken, where appropriate, the data of those complaints that have been processed will be kept duly blocked in order to comply with the corresponding legal obligations in each case.
Personal data will be deleted from the Ethics Channel within a maximum period of three (3) months from the receipt of the communication, unless the purpose of the storage is to provide evidence of the operation of the system, and may continue to be processed outside the Ethics Channel in the event that the investigation of the complaint has not been completed. for as long as necessary. Under no circumstances may the data be kept for a period exceeding ten years.
In the event that it is decided not to proceed with the complaint filed, the information may be kept in anonymised form.
5. ACCESS TO DATA
Access to the personal data contained in the Ethics Channel will be limited, within the scope of its powers and functions, exclusively to:
1. The System Manager and whoever manages it directly.
2. The external advisor involved in the investigation, with whom the corresponding confidentiality agreements will be signed.
3. The head of human resources of SANT DALMAI, S.A.U. or the duly designated competent body, only when disciplinary measures could be taken against an employee.
4. The person in charge of the legal services of SANT DALMAI, S.A.U., if it is appropriate to adopt legal measures in relation to the facts reported in the communication.
5. The data processors that may be appointed.
6. PURPOSE OF PROCESSING
Only personal data that are strictly necessary for the purposes of managing, processing and investigating communications relating to the commission of irregularities are processed, as well as carrying out the necessary actions for the investigation of the reported facts, including, where appropriate, the adoption of the corresponding disciplinary or legal measures.
Personal data will not be used for a purpose other than that indicated.
7. RIGHTS OF DATA SUBJECTS
Interested parties, at any time and under the terms provided for by the applicable regulations, may exercise the following rights with respect to their personal data: access, rectification, deletion (right to be forgotten), limitation of processing, opposition; portability, decision on automated processing, information and complaints.
In the event that the person to whom the facts related in the communication relate exercises the right to object, it will be presumed that, in the absence of proof to the contrary, there are compelling legitimate grounds that legitimise the processing of their personal data.
If they deem it appropriate, data subjects may also lodge a complaint with the competent data protection authority.
8. INFORMATION ON DATA PROTECTION AND EXERCISE OF RIGHTS
Persons who wish to do so can obtain more information about the processing of their personal data by contacting SANT DALMAI, S.A.U. through the following emaillopd@disbasegrup.com.
6. EXTERNAL INFORMATION CHANNELS
Informants may, alternatively, send their communication directly, or after sending the communication through the Ethical Channel of SANT DALMAI, S.A.U., to the public authorities through the external information systems enabled by the Independent Authority for the Protection of Informants (A.A.I.) or the corresponding regional authorities or bodies (in the case of Catalonia, before the Anti-Fraud Office of Catalonia), in accordance with the terms established in Title III of the Law on the Protection of Whistleblowers.
7. BREACH
This Policy is mandatory for all members of the organization. Failure to comply with this will be an infringement of the same and SANT DALMAI, S.A.U. will adopt the appropriate disciplinary measures, in accordance with labour legislation and the Sanctioning Regime contained in the applicable Collective Bargaining Agreement, without prejudice to other liabilities that the non-compliant person may have incurred.
8. APPLICABLE REGULATIONS
UNE-ISO 37301:2021 on Compliance Management Systems. Requirements with guidance for use.
9. ENTRY INTO FORCE, VALIDITY AND REVISION
The entry into force of this Policy shall take place at the same time as the date of approval, modification or updating of this document and shall be in force until it is repealed.
This Policy must be reviewed periodically in order to detect possible weaknesses or points for improvement, proceeding to update and/or improve what is established therein.
Extraordinarily, this Policy will be reviewed and, where appropriate, modified, when there are significant circumstances of a legal, organisational or any other nature that justify its immediate adaptation and/or updating.