INTERAL's whistleblower channel

Start

Step 1/5 Categorize concern

To facilitate the further handling of your submission, please help us to categorise it as best as possible.

In which category does your submission best fit?

Competition

Consumer protection

Corporation tax

Environmental Protection

Financial interests of the Union (expenses, income collection and funds)

Food safety

Prevention of money laundering

Product safety

Protection of personal data and privacy

Public health

Security of networks and information systems

Sexual or gender-based harassment

Transportation security

Workplace or discriminatory harassment

Others

Do you suspect any of the following people?

CFO

CIO

Delegate for Occupational Risk Prevention

HR Director

Managing Director

Plant Manager

Purchasing Manager

Quality Director

R&D Director

Transformation Director

I am not aware of any involvement of these persons

I have read the Terms of use and agree to them in accordance with the notice.

Information

Step 2/5 Personal information

If you prefer not to give your personal details, you can do so by indicating that you want the report to be anonymous.

What is your relationship with the company being reported?

Do you wish to report anonymously?

Yes

This channel requires the whistleblower's identification data are mandatory.

The selected category requires the identification data to be mandatory

First name

Last name

Following the email validation policy, you must validate this email before filing the report.

Contact telephone number

This channel is confidential. Your personal data will not be shared. If someone from the organisation needs to know your data, they will request it through the channel and they will only be able to see it if you authorise it.

Details

Step 3/5 Detailed information

Describe in as much detail as possible the event you wish to report, giving as much information and attaching evidence, if available.

Indicate which person or persons are the subject of the report

First and last name

Position

Have you discussed this with any member of management?

Yes

I do not remember

Are there any witnesses? Please indicate their names.

First and last name

Position

Tell us what you want to report in detail

Would you like to attach any additional documents?

Image (png, jpg, gif), Audio (wav, mp3), Video (ogg, mp4, mov, avi, wmv, mpg, mpeg) or PDF document up to 20Mb. Attention! If you report anonymously, make sure that the attachments do not include information in the content or metadata that could identify you.

Confirm

Step 4/5 Confirmation

As the last step of the process, you must indicate a secret code that only you will know. This password, together with the identification code that we will give you at the end of the process, will be the only way to follow the progress of your submission

Password

Password confirmation

Email address validation

According to the validation policy of this channel, we must validate the indicated email address. To do so, we will send you an email with a validation email with a code that you must indicate in the following field.

Verification code check received

Finish

Step 5/5 Finalize

You have now entered all the information necessary to start the report management process.

The information is ready to initiate the process of determining accountability. The persons or facts reported will be investigated and the resulting actions will be taken.

The whistleblower undertakes that the information provided in this submission is true. Otherwise, the company reserves the right to take legal action against the whistleblower.

This is the last form in the process. When you click on Send, the investigation will begin and the resolution of your claim will be shown on the platform within a maximum period of 3 months.

I have read the Data Protection and Consent Notice and agree to the processing of my personal data in accordance with the provisions of this notice.

Terms of Use

In compliance with the Law on Services of the Information Society and Electronic Commerce, as well as in compliance with current regulations on data protection, it is reported that the owner of the website ithikios.com and canaldenunciasanonimas.com and all its subdomains ( hereinafter, "the Web") is DIGITAL PRODUCTS DEVELOPMENT SL (hereinafter, ithikios), registered in the Mercantile Registry of Barcelona, with CIF B02767010, and with registered office at c / Mont Blanc 17, Sant Cugat del Valles, Spain.

ithikios is the owner of all rights to the Website. The simple access, navigation and use of the Website attributes the condition of user of the same (hereinafter, the "User") and implies the acceptance of this clause of terms and conditions. The information available through this website is not subject to contract and may be modified without prior notice.

ithikios will not be held responsible for problems arising from the consultation or use of this Website. To this end, access is obliged to comply with this, having to act in accordance with current Law, good faith and public order and, refraining from using the Website in a way that could prevent or impair its proper functioning.

This service can only be used to send complaints or inquiries to companies that have contracted the service with ithikios, guaranteeing confidentiality and anonymity (if the user so chooses), regarding the personal data of the complainant.

Conditions for the user

As a user, you are obliged to make correct and lawful use of the platform.
You will use the platform for the purposes it has been designed for, and in no case will you use it for purposes contrary to the law.
The ithikios channel / canaldenunciasanonimas is not an emergency service. In case of emergency contact local authorities.
You must fill in all the information defined as mandatory in order to be able to send it.
Reflect and review the information you send to ensure that if you do not want it, you do not reveal your identity.
You will be able to choose between sending the communication indicating your contact details or without indicating them. In both cases, the platform will provide you with a unique identification number and a password. It is important that you write them down in a safe place, only with them will you be able to check the status of the communication. If you lose them, you will not be able to access it again. For security reasons, ithikios will not be able to provide access to lost codes.
If the organization proves that there has been bad faith when making the report, it reserves the right to take legal action if the complainant has been identified.
You will be able to download a certificate issued by ithikios in which you will have all the information that has been sent to the company, as well as the result once the investigation is completed.
The Complainant expressly understands and agrees that ithikios will not be responsible for any direct or indirect, anticipated or unforeseen damage, interest or loss, including, among others, moral damage resulting from the use or inability to use this service.
The Complainant is responsible for the veracity of the information communicated, assuming the consequences of having acted in bad faith or sent false information or documentation.
You will be liable for any loss or damage of any kind that ithikios may suffer, directly or indirectly, as a result of improper use of the product, a breach of the terms and conditions of use or a breach of the law in force on your part.

Data protection and consent to INTERAL

This Privacy Policy (hereinafter, the " PRIVACY POLICY ") regulates the collection and processing of personal data by the entities identified below and which are part of the INTERAL Business Group, through the complaints channel that, in compliance with their legal obligations, these entities make available to data subjects (hereinafter, the " COMPLAINTS CHANNEL" ) and which is integrated into the internal information system (hereinafter, the " INTERNAL INFORMATION SYSTEM ").

1. Who is responsible for the processing of your data?

Your personal data will be processed, on a co-responsibility basis, by the following entities (hereinafter, the " DATA CONTROLLERS "):

- INTERAL, S.A. , an entity with registered office in Lezo (Gipuzkoa), Pol. Industrial 103, Sagasti Urune Kalea, 34, registered in the Mercantile Register of Gipuzkoa, volume 1095, page 1, sheet SS-2174 and with tax identification number A20031126 .

- ALINTER ALIMENTACION, S.A.U. , an entity with registered offices in Funes (Navarra), Polígono Bodega Romana, Parcela 4.1, registered in the Mercantile Register of Navarra in volume 1621, page 130, sheet NA-32159 and with tax identification number A71087167 .

2. What kind of data do we process?

Through the INTERNAL INFORMATION SYSTEM, the following categories of data are processed by the DATA CONTROLLERS:

§ Identifying, professional and contact details of the informant (e.g. name, surname, position or connection with the organisation, postal and/or e-mail address, telephone number, etc.), provided that the informant has provided them voluntarily and has not chosen to report anonymously.

§ Voice, in case of verbal complaints and/or personal interviews with persons called to participate in the framework of the investigation of reported facts.

§ Identification and professional data of the person(s) to whom the facts related in the information received in the COMPLAINTS CHANNEL refer (e.g. name, surname(s), position or link with the organisation, etc.).

§ Identification, professional and contact details of third parties who must collaborate in the framework of the investigation which, where appropriate, is initiated as a result of the information received in the COMPLAINTS CHANNEL (e.g. name, surname, position or connection with the organisation, postal and/or e-mail address, telephone number, etc.).

§ Facts covered by the information received in the COMPLAINTS CHANNEL.

Personal data which are not manifestly relevant to the processing of specific information will not be collected in any case and, if collected accidentally, will be deleted without undue delay.

If special categories of personal data are processed, it shall be ensured that they are strictly necessary, on the understanding that such processing is lawful in view of an essential public interest (Law 2/2023 of 20 February on the protection of persons who report regulatory offences and the fight against corruption).

3. For what purposes do we process the data and on what grounds?

The purpose of the processing of personal data through the INTERNAL INFORMATION SYSTEM will be to attend to and manage the information provided through the COMPLAINTS CHANNEL and, where appropriate, to investigate the facts reported, all on the basis of compliance with the legal obligations that must be observed by those DATA CONTROLLERS (Law 2/2023 of 20 February on the protection of persons who report regulatory offences and the fight against corruption).

4. To whom do we disclose data?

Access to the data contained in the INTERNAL INFORMATION SYSTEM shall be limited, within the scope of their competences and functions, to (i) the person responsible for the INTERNAL INFORMATION SYSTEM; (ii) the person responsible for Human Resources of the DATA CONTROLLER to whom the information provided refers, when disciplinary measures are to be taken against an employee; and (iii) the person responsible for the Legal Department of the said DATA CONTROLLER, when legal measures are to be taken in relation to the facts reported.

Personal data may only be communicated to third parties (e.g. Judicial Authority, Public Prosecutor's Office or Administrative Authority), when it is necessary for the adoption of corrective measures in the DATA CONTROLLER to which the information provided refers or, where appropriate and when applicable, in any of the other DATA CONTROLLERS, or for the processing of the sanctioning or criminal proceedings that, where appropriate, may be necessary.

In any case, the identity of the informant (when he/she has identified him/herself) shall be confidential and, consequently (i) under no circumstances shall it be communicated to the person/s to whom the facts reported refer; and (ii) it may only be communicated to the Judicial Authority, the Public Prosecutor's Office or the competent Administrative Authority within the framework of a criminal, disciplinary or sanctioning investigation.

International transfers of the processed data are envisaged through the INTERNAL INFORMATION SYSTEM.

5. How long will we keep the data?

The personal data processed will only be kept by the COMPLAINTS CHANNEL for the time necessary to decide whether to initiate an investigation into the reported facts.

If it is established that the information provided or part of it proves to be untrue, it shall be deleted immediately, unless such untruthfulness could constitute a criminal offence, in which case it shall be kept for as long as necessary during the legal proceedings.

In any case, after 3 months have elapsed since the receipt of the communication without any investigation having been initiated, it shall be deleted from the COMPLAINTS CHANNEL, unless it is necessary to keep it in order to leave evidence of the functioning of the INTERNAL INFORMATION SYSTEM. Communications that have not been followed up may only be recorded in anonymised form.

In the case of communications that have been processed, personal data shall be kept for the time necessary for the development of the corresponding investigation. In any case, the period of conservation of such data may not exceed 10 years.

6. What rights do stakeholders have?

The applicable data protection legislation grants data subjects a series of rights relating to their personal data which they may exercise during the processing thereof. These rights are indicated below:

§ Access to your data : the right to access your data to find out what personal data concerning you we are processing.

§ Request rectification or deletion of your data : the right to rectify any inaccurate personal data concerning you that are processed by us or to request their deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected.

§ Request the limitation of the processing of your data : you have the right to ask us to limit the processing of your data, in which case we inform you that we will only keep them for the exercise or defence of claims as provided for in the applicable data protection regulations.

§ Oppose the processing of your data : the right to oppose the processing of your data in which case, we will stop processing them unless, for compelling legitimate reasons, or the exercise or defence of possible claims, they must be kept.

In the event that the data subject exercises his/her right to object to the processing of his/her data, it will be presumed, as established by the applicable regulations, that there are compelling legitimate reasons that legitimise the processing of his/her data, and it will be necessary to reject his/her request.

You may exercise these rights by sending a written request to the e-mail address [email protected] . Your requests in this regard will be handled in a coordinated manner and on behalf of all those DATA CONTROLLERS by INTERAL, S.A.

Notwithstanding the above, you will retain the right to exercise your rights against any of the DATA CONTROLLERS, for which purpose, you may contact them at the postal addresses indicated in Section REF _Ref160524302 \r \h \* MERGEFORMAT 1 08D0C9EA79F9BACE118C8200AA004BA90B02000000080000000E0000005F005200650066003100360030003500320034003300300032000000 above.

Finally, it should be noted that data subjects have the right to lodge a complaint with the competent Supervisory Authority (in the case of the DATA CONTROLLERS , the Spanish Data Protection Agency), especially when they have not obtained satisfaction in the exercise of their rights. You can contact this Authority through its website: www.aepd.es .

7. Security measures

The INTERNAL INFORMATION SYSTEM of the DATA CONTROLLERS has technical and organisational measures in place to preserve the identity and guarantee the confidentiality of the data corresponding to the persons concerned and to any third party mentioned in the information provided, especially as regards the identity of the informant (where the latter has identified himself/herself).

The COMPLAINTS CHANNEL does not allow metadata or IP addresses to be obtained, ensuring that, in the event of having opted for anonymous reporting, the reporter cannot be identified.