Ethical channel operating policy

The purpose of this Ethical Channel Operating Policy (hereinafter, the "Policy") is to define and establish an appropriate and effective operating model for the Internal Information System (hereinafter, the "Ethical Channel") of SANT DALMAI, S.A.U., adapted to the regulations in this matter (DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of October 23, 2019 on the protection of persons who report on breaches of Union law (hereinafter, "Whistleblower Directive") and Law 2/2023, of February 20, regulating the protection of persons who report on regulatory and anti-corruption infractions (hereinafter, "Law on the protection of whistleblowers"), as well as the highest national and international standards in force (UNE-ISO 37002: 2021 on Whistleblowing Management Systems. Guidelines), allowing for the receipt and processing:

On the one hand, communications related to breaches and/or practices contrary to the principles established in the Code of Ethics and the Policies, and Protocols of SANT DALMAI, S.A.U., as well as in the internal rules and procedures that develop them and in the other rules that are imposed by the regulatory framework of the organization and/or,

On the other hand, actions or omissions that may constitute infringements of European Union law or serious or very serious criminal or administrative offences of Spanish national law.

This Policy establishes the procedure that regulates the operation of the Ethical Channel of SANT DALMAI, S.A.U., in such a way that it includes the issues related to the realization of communications by the reporting persons, as well as the management and resolution of the same by the Head of the System.

The purpose of this Policy is to guarantee professional, confidential, impartial and maximum protection of the rights of interested persons (including the rights recognized in the regulations on the protection of personal data) throughout the process of realization, management, processing, investigation and resolution of communications made through the SANT DALMAI Ethical Channel, S.A.U.

In this regard, this Policy establishes three basic guarantees:

ensuring the protection of reporting persons;
ensuring that reporting persons are not retaliated against, and
Guarantee of the rights of the accused during the management and processing of communications.

SCOPE

This Policy applies to all members of SANT DALMAI, S.A.U. (including both workers and managers, as well as shareholders and members of the Board of Directors, regardless of the position or position they occupy within the organization, the legal nature of their relationship and whatever their area of activity or hierarchical level), who are aware, in a work or professional context, of any infringement established in section 1 of this Policy.

Likewise, the provisions of this Policy will also be extended to third parties such as: business partners, collaborating companies, subcontractors, suppliers and other persons or entities that have a professional relationship with SANT DALMAI, S.A.U.

PRINCIPLES OF THE ETHICAL CHANNEL
1. CONFIDENTIALITY

SANT DALMAI, S.A.U. guarantees the maximum confidentiality of the communications received through its Ethical Channel and the data contained therein.

The identity of the person who communicates an irregularity through the Ethical Channel will be considered confidential information and, therefore, will not be communicated to the person denounced. In the same sense, the confidentiality of the identity of the person denounced will be guaranteed.

Likewise, there is an express prohibition that the personal data contained in the communication and resulting from the investigation carried out are known by any person other than those expressly authorized. In this sense, specific confidentiality commitments will be signed with the people in charge of managing them.

Notwithstanding the foregoing, the data of the person making the communication may be provided to the administrative, judicial or public prosecutorial authorities, to the extent that they are required by such authorities as a result of any criminal, disciplinary or sanctioning procedure derived from the object of the communication.

This transfer of the data will always be carried out in full compliance with the legislation on the protection of personal data, demanding that in any case access by third parties to it is prevented.

When the communication is sent through complaint channels other than those established in this Policy or to members not responsible for its treatment or to non-competent personnel, there will be an obligation on the part of the recipient of the communication to send it immediately to the System Manager, guaranteeing its confidentiality at all times. Failure to comply with this obligation will be classified as a very serious infraction, so SANT DALMAI, S.A.U. may adopt the appropriate disciplinary measures.

1. INDEPENDENCE

The procedures for processing, investigation and resolution and, in general, for the management of communications received through the Ethical Channel of SANT DALMAI, S.A.U. will be governed by the utmost objectivity and independence, establishing in this Policy, the corresponding mechanisms in order to avoid the concurrence of possible conflicts of interest.

1. GOOD FAITH

All communications submitted through the Ethical Channel must be made in good faith. This means that, at the time of submission of the communication, the reporting person must have reasonable and sufficient grounds to believe that the information it indicates is true, truthful and contains possible infringements.

In this sense, false or malicious communications or complaints may give rise to the corresponding sanctions by SANT DALMAI, S.A.U., without prejudice to civil and even criminal liabilities that may arise.

1. PROHIBITION OF RETALIATION

SANT DALMAI, S.A.U. undertakes not to adopt any form of retaliation, threats of retaliation or attempts at retaliation, direct or indirect, against people who, in good faith, have communicated through the Ethical Channel any irregularity.

Retaliation should be understood as any act or omission that is prohibited by law, or that, directly or indirectly, involves unfavorable treatment that places the people who suffer them at a particular disadvantage with respect to another in the work or professional context, only because of their status as informants.

Protection against retaliation also extends to individuals who report potential breaches through the external reporting channels referred to in Section 6 of this Policy.

In addition to reporting persons, the prohibition of retaliation set forth in this Policy also extends to the following persons:

natural persons who, within the framework of the organisation in which the reporting person provides services, assist the reporting person in the proceedings;

natural persons who are related to the reporting person and who may suffer retaliation, such as co-workers or family members of the reporting person; and

legal persons, for which the reporting person works or with whom he maintains any other type of relationship in a work context or in which he holds a significant participation. For these purposes, it is understood that the participation in the capital or in the voting rights corresponding to shares or participations is significant when, by its proportion, it allows the person who holds it to have the capacity to influence the investee legal person.

In the event that any member of SANT DALMAI, S.A.U., in contravention of the provisions of this Policy, directly or indirectly retaliates, it will be the organization itself that will take the necessary measures to stop the reprisals as soon as possible and, when appropriate, will take disciplinary measures that are appropriate against those responsible for them.

Likewise, through this Policy, the rights to privacy, to be heard, to be informed of the actions or omissions attributed to him, to the defense, to the honor and to the presumption of innocence of the persons subject to the investigation, as well as the right to access the file will also be guaranteed.

OPERATION OF THE ETHICAL CHANNEL
1. PRESENTATION OF COMMUNICATIONS
  1. AVAILABLE CHANNELS

Reporting persons may make communications through the channels provided for that purpose.

In this sense, SANT DALMAI, S.A.U. makes available the following channels to be able to carry out the communications included in this Policy:

Email address: canaletico@disbasegrup.com
Via postal mail to the following address: Afores s/n, 17183 Sant Dalmai (Vilobí d'Onyar), Girona (to the exclusive attention of the System Manager (Ethical Channel) of DISBASE).

At the request of the reporting person, the communication may also be submitted through a face-to-face meeting with the System Manager, which must be carried out within a maximum period of seven (7) days from the request.

1. 1. COMMUNICATION INFORMATION

The communication shall contain the following information:

Identity of the reporting person (names, surnames and ID). Except in cases of anonymous communications. In this sense, the Ethical Channel of SANT DALMAI, S.A.U. allows communications to be carried out anonymously, without providing the identity of the reporting person.

Relationship with SANT DALMAI, S.A.U. (employee, supplier, shareholder, subcontractor, intern, etc.) and, where appropriate, position in SANT DALMAI, S.A.U.

Description as detailed and complete as possible of the conduct, event or alleged irregularity that is communicated.

Identity of the person denounced (name, surname and position), if the person responsible for the fact is known and the area in which the reported event occurred.

Indicia, explanatory explanations or evidence on which the information is based. All available evidence must be provided or indicate where and how to obtain it (e.g. witnesses, documents, records, etc.).

Approximate dates of the event of the events.

Where appropriate, means of communication (address, email, telephone or other) of the reporting person so that the System Manager can make notifications or communications.

If the content of the communication has been evaluated, it lacks the minimum requirements that are mandatory for its correct assessment, by the Head of the System, the corresponding information and / or documentation will be requested from the reporting person through the means of communication indicated by it, proceeding to the file of the communication, in case of not having the necessary information for the opening of the investigation phase.

1. MANAGEMENT AND RESOLUTION OF COMMUNICATIONS
  1. RESPONSIBLE FOR THE SYSTEM

The Administrative Body is the competent body for the appointment, as well as dismissal or dismissal, of the Head of the System, who, in turn, is responsible for the management and processing of communications that enter through the Ethical Channel of SANT DALMAI, S.A.U.

The Head of the System may be a natural person or a collegiate body that must delegate to one of its members (natural person) the powers of management and processing of investigation files.

Both the appointment and dismissal of the Head of the System will be notified to the Independent Authority for the Protection of the Informant (A.A.I.) or, where appropriate, to the competent authorities or bodies of the autonomous communities.

In this sense, the Board of Directors of the parent company of the Disbase Group has appointed a natural person as Head of the System to carry out the powers of management and processing of communications of the Ethical Channel, in all the companies of the Group.

The Head of the System will act independently of the rest of the functions and hierarchical or functional subordination that, where appropriate, may exist, developing the necessary tasks under the premises of confidentiality, respect, independence, neutrality, impartiality, honesty and objectivity towards the persons affected by the communication in question, also ensuring that the procedure is developed in accordance with the procedures and principles established in this Politics.

In the event that the Head of the System has incompatibility or conflict of interest with the fact or persons object of the communication, he will refrain from participating in the management and processing of the communication and will not, therefore, have access to the information derived from the actions carried out in the management of the same. In this regard, the Head of the System will be replaced by another person designated and appointed by the Administrative Body or other competent body.

Competences of the System Manager

The main competences of the System Manager in the field of management of the Ethical Channel of SANT DALMAI, S.A.U., are the following:

Manage the Ethical Channel tool.
Receive communications made through the Ethical Channel.
Analyze the content of the communications received and decide on their admission to processing.
Determine the desirability or need to adopt immediate measures to avoid (stop or mitigate) further damage.
In the case of nominative reports (or, being initially anonymous, from the moment in which, where appropriate, the reporting person communicates his identity), he shall notify the reporting person of the receipt of the report (sending acknowledgement of receipt), unless this would jeopardise the confidentiality of the communication.
Ensure that appropriate measures are taken to prevent and avoid possible reprisals against the complainant.
Carry out the investigation / instruction of the facts internally in accordance with the rules and principles established in this Policy (or decide on the appropriateness of its instruction through an external expert manager).
Make a report on the result of the investigation carried out, showing if the facts communicated are considered accredited and propose the appropriate measures for the resolution of the fact, as well as, where appropriate, the disciplinary measures to be taken, always being able to delegate this power to another competent body.
Communicate to the interested persons (including the reporting person) the completion of the procedure.
Extend the resolution period for reasons of complexity.
Resolve doubts and queries that arise in relation to the Canal.
Keep the Complaints-Register Book updated.
Ensure that the necessary security of the Communications Information Management System is established, including the restriction of access to it.
Draft an annual report of presentation to the Management Body of the parent company of the Group on the activity carried out in relation to the Ethical Channel, which includes information regarding complaints received, complaints processed or rejected, queries made, etc.
Manage the storage of communication information in the Communications Information Management System.

The Head of the System will carry out these functions and competences independently and autonomously with respect to the rest of the organs of the organization.

For the performance of the above functions and competences, and in those cases in which it is deemed necessary, the System Manager may be assisted by an external consultant or even delegate to the latter any of the above functions. In this sense, the System Manager must obtain from the external collaborators, involved in the management and resolution of the communication, a confidentiality agreement. In the same way, it will collect it from internal collaborators when it deems it necessary.

1. 1. RECEPTION AND EVALUATION

Once a communication has been received through the Ethical Channel, the System Manager will proceed to register it in a Record Book of communications, assigning the communication an identification code.

The Record Book of communications is contained in a secure database (Information Management System) and restricted access exclusively to authorized persons, and it will record all communications and information received through the Ethical Channel and during the processing thereof.

In each of the registers of the communications recorded in the Communication-Register Book, the following data shall be contained:

Date of receipt.
Identification code.
Actions developed.
Action taken.
Closing date.

The Book-Register will not be public and only at the reasoned request of the competent judicial authority, by means of an order, and within the framework of a judicial procedure and under the supervision of the former, its contents may be accessed totally or partially.

Once the communication has been received, within a maximum period of seven (7) calendar days following its receipt, the System Manager will send an acknowledgment of receipt of the communication to the reporting person, unless it is anonymous; the complainant has opted out of receiving communications relating to the investigation or; this may jeopardise the confidentiality of the communication.

If the reporting person accepts it, the possibility of the System Manager maintaining communication is expressly foreseen.

The System Manager will check the content of the communication. If documentation is missing or has a formal defect, it will make a request for information to the reporting person. Likewise, the Responsible, if it considers it necessary, may request additional information from the reporting person regarding the communication made.

The System Manager must verify whether the communication exposes facts or behaviors that are within the scope of application of this Policy and, therefore, if it is admissible.

Once this preliminary analysis has been carried out, the System Manager, within a period that may not exceed ten (10) business days from the date of entry in the Record Book, the information of the communication, must:

1. Admit the communication.

1. Inadmissibility of communication, in any of the following cases:

When the facts reported lack all plausibility.

When the facts reported do not constitute an infringement of the assumptions established in this Policy.

When the communication is manifestly unfounded or there are, in the opinion of the Head of the System, rational indications of having been obtained through the commission of a crime.

In the latter case, in addition to the inadmissibility, a detailed account of the facts deemed to constitute a crime will be sent to the Public Prosecutor's Office.

Where the communication does not contain new and significant information on infringements compared to a previous communication in respect of which the relevant proceedings have been concluded, unless new factual or legal circumstances arise which justify a different follow-up.

In these cases, the System Manager will notify the reporting person of the decision in a reasoned manner.

Likewise, those communications in which the facts described are misleading and / or there is corroboration that the communication was made in bad faith, that is, with the intention of harming the organization or third parties related to it, will not be admitted.

1. Immediately send the information to the Public Prosecutor's Office when the facts could constitute a criminal offence or to the European Public Prosecutor's Office in the event that the facts affect the financial interests of the European Union.

1. Send the communication to the authority, entity or body that is considered competent for its processing.

The decision of admission, inadmissibility or referral of the communication will be communicated by the Head of the System to the reporting person within five (5) business days following the decision, unless the communication was anonymous or the reporting person had waived receiving communications.

The Head of the System will also assess the convenience or need to adopt immediate measures to avoid further damage and, where appropriate, execute them.

1. 1. PROCESSING AND INVESTIGATION

Once the communication has been admitted, the Head of the System, acting as instructor, will carry out all those actions, proceedings and investigations necessary and aimed at verifying the credibility of the facts of the communication, being able to entrust this task to an external expert, if the circumstances require it.

Thus, the veracity and accuracy of the information contained in the communication and, in particular, of the conduct communicated will be verified, following at all times the principles established in this Policy and under a strict confidentiality regime to respect the rights of the reporting person and the person investigated.

During the investigation, the person under investigation shall be notified of the communication with a brief account of the facts established therein. This information may be made in the hearing of the person under investigation, if it is considered that his previous contribution could facilitate the concealment, destruction or alteration of evidence.

Without prejudice to the right to make written submissions, the investigation shall include, whenever possible, an interview with the person denounced in which, always with absolute respect for the presumption of innocence, he will be invited to present his version of the facts and to provide such evidence as he considers appropriate and relevant.

In order to guarantee the right of defence of the person denounced, he will have access to the file (without revealing information that could identify the reporting person) and may be heard at any time. You will also be advised of the possibility of appearing with the assistance of a lawyer.

In addition, the investigator will conduct a hearing for all affected persons and possible witnesses and will take as many steps as he deems necessary (review of documentation, obtaining information from external sources, etc.). In this regard, all members of the organization are obliged to cooperate loyally in the investigation carried out. The intervention of witnesses and affected persons shall be strictly confidential.

The investigator may collect all the information and documentation he deems appropriate from any area or department of the organization, in order to substantiate the investigation.

A written record shall be drawn up of all investigative actions and, in particular, of the explanations/statements given by the persons who have intervened in the procedure of investigation of the communication, (provided that their prior consent is obtained), which shall be duly signed by the persons involved in order to certify its content and that it conforms to their statement. The content of this record will be incorporated into the Information Management System of SANT DALMAI, S.A.U. with the same guarantees of confidentiality as the rest of the file.

In the event that the presence of the person under investigation during the period of investigation could jeopardise the conduct of the investigation or the strict observance of the guiding principles of the procedure established in this Policy, at the proposal of the instructor, the person under investigation may be granted paid leave of absence from his or her post, without loss of remuneration, in order to ensure that the necessary research activities are carried out without interference that could be detrimental to it. Paid leave shall be granted for the time necessary for the performance of the appropriate investigative work, but in no case may it be extended beyond the duration of the investigation process.

Outside legal counsel shall be permitted at hearings/statements of affected parties, interested parties, witnesses, etc., if deemed appropriate by the investigator.

In any investigation procedure, special vigilance shall be exercised for compliance with the principles contained in this Policy and the confidentiality, impartiality, as well as the rights to privacy, defence, honour and the presumption of innocence of the persons under investigation shall be guaranteed. The procedure shall also be transparent and shall guarantee the right to information of the persons involved in it.

1. 1. RESOLUTION AND COMMUNICATION

Once all the investigation actions have been concluded, the System Manager will prepare and issue a report containing at least the following content:

A statement of the facts reported (descriptive information of the communication) together with the identification code of the communication and the date of registration.
Assessment of the content of the communication.
The actions carried out in order to verify the plausibility of the facts.
The conclusions reached in the investigation and the evaluation of the proceedings and the evidence that supports them.
Measures taken (if any).

Once the Report has been issued, the System Manager will adopt one of the following decisions:

Archiving of the file, which will be notified to the reporting person and, where appropriate, to the person concerned.

Proposal for resolution of the file and, where appropriate, the corresponding proposals for actions and / or proposal of disciplinary measures, always being able to delegate this last faculty to another competent body.

Referral to the Public Prosecutor's Office if, despite not initially appreciating indications that the facts could have the character of a crime, this is apparent from the course of the investigation. If the offence affects the financial interests of the European Union, it shall refer it to the European Public Prosecutor's Office.

Referral of the communication to the authority, entity or body considered competent for its processing.

The maximum period to respond to the investigative actions may not exceed three (3) months from the receipt of the communication, except in cases of special complexity that require an extension of the term, in which case, this may be extended, by decision of the System Manager, up to a maximum of three (3) additional months.

The proposed resolution will be sent to the Administrative Body or competent body, which must adopt and execute the final resolution.

Whatever the decision, it will be communicated to the reporting person within five (5) working days of the decision, unless he has waived it or the communication is anonymous, as well as to the rest of the affected parties.

In the event that the resolution issued concludes that a member of SANT DALMAI, S.A.U. has committed an irregularity, the disciplinary, administrative or judicial proceedings that legally proceed will be initiated.

Likewise, if, as a result of the investigative measures, other facts are noticed that could constitute new irregularities allegedly committed by the same or different persons from those investigated, the investigator will propose the opening of a new file, or if it is related to what was instructed in the file that was being carried out, the extension of the investigative file, if it considers it more appropriate.

1. 1. DISCIPLINARY MEASURES

When it is determined that the conduct reported constitutes an infraction in labor matters, SANT DALMAI, S.A.U. may adopt the appropriate measures in accordance with the applicable disciplinary regime and, specifically, with the provisions of the applicable Collective Agreement and the Workers' Statute.

Without prejudice to the fact that the mandatory labor regulations applicable at any time will be observed at any time, to the extent that it allows it, to assess the seriousness of the conduct, for the purposes of the graduation of the sanctions to be imposed, the following criteria may be considered, among others:

Degree of intentionality;
Failure to comply with prior warnings;
Recidivism;
Concurrence of several infractions in the same fact or activity;
Concurrence of concealment in the conduct carried out by the offender;
Concurrence of continuity in the conducts carried out by the offender;
The remedying of the breach that gave rise to the infringement on the offender's own initiative;
Reparation of damages caused by the infringing person;
Level of responsibility in the organization of the offender;
Magnitude of the economic damage resulting from the infringement;
Magnitude of any other non-economically assessable damage arising from the infringement;
Affectation to other employees or third parties;
Collaboration with the organization.

Notwithstanding the adoption of disciplinary measures, when the facts could be indicative of a crime, immediately the corresponding information will be sent to the Public Prosecutor's Office. In the event that the facts affect the financial interests of the European Union, it shall be referred to the European Public Prosecutor's Office.

DATA PROTECTION AND RETENTION
1. RESPONSIBLE FOR THE TREATMENT

In compliance with the provisions of the General Data Protection Regulations and the Data Protection Law, it is reported that the personal data that, where appropriate, may be included in the communication, will be integrated into a file owned by SANT DALMAI, S.A.U. for processing.

SANT DALMAI, S.A.U. undertakes to maintain strict protection of privacy, security and data conservation, as detailed in our policies and procedures and internal regulations in this matter. In this regard, these rules shall also apply with respect to all personal data relating to communications made in accordance with this Policy.

1. DATA COLLECTION

In the processing of communications (realization and investigation thereof) made in accordance with this Policy, SANT DALMAI, S.A.U. collects the following personal data:

Name, ID and contact details of the complainant (unless reported anonymously) and their status as an employee of SANT DALMAI, S.A.U.;

Name, ID and other personal data of the persons mentioned in the complaint (witnesses, possible offender, etc.), if you provide such information (description of their functions, contact details and participation or role in the events communicated);

1. PRESERVATION OF THE IDENTITY OF THE REPORTING PERSON AND OTHER AFFECTED PERSONS

SANT DALMAI, S.A.U. will preserve the identity and guarantee the confidentiality of the data corresponding to the affected persons and to any third party mentioned in the information provided, especially the identity of the reporting person in case he or she has identified himself. In this sense, the person to whom the facts related in the communication refer will not be informed in any case of the identity of the reporting person.

In this sense, whoever submits a communication has the right not to have his identity revealed to third parties. The identity of the reporting person may only be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the framework of a criminal, disciplinary or sanctioning investigation.

These disclosures will be subject to safeguards set forth in applicable law. In particular, the reporting person shall be disclosed before his or her identity is disclosed, unless such information would jeopardise the investigation or judicial proceedings.

1. DATA RETENTION

SANT DALMAI, S.A.U. will keep a record of all communications received. These records and the personal data they contain will be kept confidential in the Information Management System. The records will not be kept longer than necessary and in any case for as long as necessary to comply with any legal requirement of application at any time.

SANT DALMAI, S.A.U. will keep the personal data of the complainant for the time necessary to decide on the appropriateness of initiating an investigation into the facts or behaviors communicated and, once decided, they will be deleted from the Ethical Channel, being able to treat outside the system to investigate the facts for the time necessary to make a decision. Once the investigation of the communication has been completed and the appropriate actions taken, where appropriate, the data of those complaints that have been processed will be kept duly blocked to comply with the legal obligations that, in each case, correspond.

Personal data will be deleted from the Ethical Channel within a maximum period of three (3) months from receipt of the communication, unless the purpose of the conservation is to leave evidence of the operation of the system, and may continue to be processed outside the Ethical Channel in case the investigation of the complaint has not been completed, for as long as necessary. In no case may the data be kept for a period exceeding ten years.

In the event that it is decided not to proceed with the complaint filed, the information may be kept in anonymized form.

1. ACCESS TO DATA

Access to the personal data contained in the Ethical Channel will be limited, within the scope of its competences and functions, exclusively to:

1. The person in charge of the System and whoever manages it directly.

1. The external advisor involved in the investigation, with whom the corresponding confidentiality agreements will be signed.

1. The person in charge of human resources of SANT DALMAI, S.A.U. or the competent body duly designated, only when disciplinary measures could be taken against a worker.

1. The person in charge of the legal services of SANT DALMAI, S.A.U., if it is appropriate to adopt legal measures in relation to the facts related in the communication.

1. The data processors that may be appointed.

1. PURPOSE OF THE TREATMENT

Only personal data that are strictly necessary for the purposes of management, processing and investigation of communications relating to the commission of irregularities are processed, as well as carrying out the necessary actions for the investigation of the facts denounced, including, where appropriate, the adoption of disciplinary or legal measures, as appropriate.

Personal data will not be used for a purpose other than that indicated.

1. RIGHTS OF DATA SUBJECTS

Interested persons, at any time and in the terms provided by the applicable regulations, may exercise with respect to their personal data, the following rights: access, rectification, deletion (right to be forgotten), limitation of treatment, opposition; Portability, decision on automated processing, information and complaint.

In the event that the person to whom the facts related in the communication refer exercises the right of opposition, it will be presumed that, unless proven otherwise, there are compelling legitimate reasons that legitimize the processing of their personal data.

If they deem it appropriate, data subjects may also lodge a complaint with the competent data protection authority.

1. INFORMATION ON DATA PROTECTION AND EXERCISE OF RIGHTS

People who wish to do so can obtain more information about the processing of their personal data by contacting SANT DALMAI, S.A.U. through the following email lopd@disbasegrup.com.

EXTERNAL INFORMATION CHANNELS

The reporting persons may, alternatively, send their communication directly, or after sending the communication through the Ethical Channel of SANT DALMAI, S.A.U., to the public authorities through the external information systems enabled by the Independent Authority for the Protection of the Informant (A.A.I.) or the corresponding authorities or autonomous bodies (in the case of Catalonia, before the Anti-Fraud Office of Catalonia), in accordance with the terms established in Title III of the Law on the protection of reporting persons.

NONCOMPLIANCE

This Policy is a mandatory standard for all members of the organization. Its violation will imply an infringement of the same and SANT DALMAI, S.A.U. will adopt the disciplinary measures that are appropriate, in accordance with labor legislation and the Sanctioning Regime contained in the applicable Collective Agreement, without prejudice to other responsibilities in which the non-compliant person may have incurred.

APPLICABLE REGULATIONS

DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons reporting breaches of Union law ("Whistleblower Directive").

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("General Data Protection Regulation" - GDPR).

Article 31 bis paragraph 5 of the Spanish Criminal Code.

Law 2/2023, of 20 February, regulating the protection of persons who report on regulatory infractions and the fight against corruption. ("Law on the Protection of Reporting Persons").

Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights. ("Data Protection Law" – LOPD-GDD).

Circular 1/2016 of the Attorney General's Office, of January 22, on the criminal liability of legal persons in accordance with the reform of the Criminal Code carried out by Organic Law 1/2015.

UNE-ISO 37002:2021 on Whistleblowing Management Systems. Guidelines.

UNE-ISO 37301:2021 on Compliance Management Systems. Requirements with guidance for its use.

ENTRY INTO FORCE, VALIDITY AND REVISION

The entry into force of this Policy will take place at the same time as the date of approval, modification or update of this document and will be in force as long as it is not repealed.

This Policy must be reviewed periodically in order to detect possible weaknesses or points of improvement, proceeding to update and / or improve what is established therein.

Extraordinarily, this Policy will be reviewed, and where appropriate, modified, when significant circumstances of a legal, organizational or any other nature that justify its adaptation and / or immediate update.