ENG
Handicap

Whistleblower Channel Privacy Policy


FOR WHAT PURPOSES WILL WE USE THE DATA?


1. Management and processing of communications or information received.


To process complaints, reports, or information regarding potential regulatory violations, breaches of the Code of Ethics, improper conduct, violations of labor law, safety, data protection, or other actions contrary to current regulations.


2. Verification, analysis, and assessment of the reported facts.

Take the necessary steps to verify the accuracy of the information provided,
assess the situation, gather evidence, and determine whether to initiate disciplinary, corrective, or internal improvement proceedings.


3. Implementation of corrective or disciplinary measures.

To allow for the implementation of internal measures, disciplinary actions, preventive measures, sanctions, or protective measures
against conduct that has been substantiated.


4. Ensuring the confidentiality and integrity of the system.

Ensure the confidentiality of the whistleblower’s identity, the identities of those involved, and all information processed by
by implementing technical and organizational security measures.


5. Notification to the relevant authorities, as appropriate.


Handle communications with public agencies, judicial authorities, law enforcement agencies, the Spanish Data Protection Agency (AEPD), or other regulatory bodies when legally required or necessary
for the investigation.


6. Registration, filing, and retention of the complaint.

Maintain a secure, encrypted record of the information received and retain it for
the periods required by law (up to 3 months in the system, unless it is blocked or transferred to
another legal system).


WHAT ARE THE LEGITIMATE BASES FOR PROCESSING?

Compliance with a legal obligation (Law 2/2023, dated February 20, regulating
the protection of individuals who report regulatory violations and the fight against
corruption).

In some cases, the complainant's consent, if they provide optional personal information.

WHAT TYPE OF DATA WILL WE USE?

  • Identifying information about the complainant (unless anonymity is requested): first name,
    last name, contact information.
  • Information related to the reported incidents.
  • Information about the individuals involved (alleged offender or witnesses).
  • Any other information provided in the form or communication.


The channel allows users to file complaints anonymously.

All information will be treated with the utmost confidentiality, and technical
and organizational measures will be taken to ensure the protection of the identity of the whistleblower and the individuals
involved.


To whom can we disclose the complainant's information?

  • The person in charge of the Internal Reporting System or the team designated to manage the
  • channel.
  • Legal advisors or external consultants, as needed for the investigation.
  • Competent administrative or judicial authorities, if applicable.


HOW LONG WILL WE RETAIN THE DATA?

The data will be retained for a maximum of 3 months from the date the complaint is received at
, unless retention is necessary to demonstrate the system’s proper functioning or
to document the actions taken. After this period, the data will be deleted or
anonymized.