Complaints Channel (Information Channel according to Law 2/2023 on whistleblower protection)

What is a Whistleblowing Channel?

The whistleblowing channel is one of the obligations established in Law 2/2023. It should be noted that the purpose of this Law is to provide adequate protection against reprisals that may be suffered by natural persons who report any of the actions or omissions that may constitute a reportable fact, as defined in the Law itself. To this end, various procedures for complaints are established, with the Whistleblowing Channel being one of the key points for this.

Which companies or entities are required to have a Whistleblowing Channel?

- If the company has 50 or more employees

- Regardless of the number of employees, if you are engaged in financial services, prevention of money laundering or terrorist financing, transportation security, or environmental protection.

- If it is a political party managed with public funds or a foundation dependent on one.

- If it is a public administration or public entity.

Who can report?

• a) persons who are public employees or employees under the direction of others;
• b) self-employed persons;
• c) shareholders, participants, and persons belonging to the administration, management, or supervision bodies of a company, including non-executive members;
• d) any person who works for or under the supervision and direction of contractors, subcontractors, and suppliers.

What can be reported?

In general, actions or omissions that may constitute a serious or very serious criminal or administrative offense. In any case, all serious or very serious criminal or administrative offenses that imply economic harm to the Public Treasury and/or Social Security, as well as any act of terrorism, against transportation security, or against the environment, shall be understood to be included.

Actions of the described type may be reported when there are reasonable grounds to believe that the information referred to is true at the time of communication or disclosure, even if they do not provide conclusive evidence.

Those who communicate or disclose the following are expressly excluded from the protection provided by this law:

1. a) Information contained in communications that have been rejected by an internal information channel
2. b) Information related to claims about interpersonal conflicts or that affect only the informant and the persons referred to in the communication or disclosure.
3. c) Information that is already fully available to the public or that constitutes mere rumors.

How can a complaint be made?

Any complainant can use the company's whistleblowing channel (preferably, according to Law 2/2023), or before the Independent Authority for Whistleblower Protection, A.A.I., or before the corresponding regional authorities or bodies.

The company's website explains how the company's whistleblowing channel works, as well as the requirements for accessing it, and the relevant whistleblower protection information that must be known.

What must a company do to implement a Whistleblowing Channel?

1. Establish the internal Information Channel (Whistleblowing Channel) that complies with all the requirements established in Law 2/2023 for said channel. This requirement is met by contracting Comandsign's Whistleblowing Channel.

2. Appoint an Information System Manager. This manager must be an executive who can perform their functions independently and autonomously from the other bodies of the entity or organization. They may not receive any instructions in their exercise and must have all the necessary personal and material resources to carry them out. When the nature or size of the entity's activities does not justify or allow the existence of an executive Information System Manager, it will be possible for the ordinary performance of the functions of the position or role to be combined with those of the Information System Manager, always trying to avoid possible situations of conflict of interest.

The Information System Manager will be responsible for carrying out all the actions planned for the reception and management of the complaints received.

3. Establish a procedure for managing information/complaints.

The procedure establishes the necessary provisions for the internal information system to comply with the requirements established in this law. The Comandsign system also provides the procedure to the company, so that the Information System Manager (the person who will internally manage the complaint) can fulfill their obligations.

The Comandsign Whistleblowing Channel guarantees compliance with the requirements applicable to the Whistleblowing Channel, in particular:

• Identification of the whistleblowing channel for potential whistleblowers, including on the company's website and in Comandsign, how the company's whistleblowing channel works, as well as the requirements for accessing it, and the relevant whistleblower protection information that must be known, and the right to use the external channel.
• Sending an acknowledgment of receipt of the communication to the informant, within seven calendar days of its receipt, unless this may jeopardize the confidentiality of the communication. The Comandsign system allows automatic acknowledgment of receipt communications to be established, so this obligation will be fulfilled without the need for voluntary action by the Manager.
• The Whistleblowing Channel allows for responses to investigative actions, automatically giving prior notice to the Manager to avoid missing the maximum deadlines established by the Law (it cannot exceed three months from the receipt of the communication).
• Maintaining communication with the informant and, if deemed necessary, requesting additional information from the informant.
• Establishment of the right of the affected person to be informed of the actions or omissions attributed to them, and to be heard at any time. This communication will take place at the time and in the manner deemed appropriate to ensure the successful completion of the investigation.
• Guarantee of confidentiality when the communication is sent through channels other than the established ones or to members of staff not responsible for its processing, who will have been trained in this matter and warned of the serious infringement of its breach, and also the establishment of the obligation of the recipient of the communication to immediately forward it to the Information System Manager.
• Requirement to respect the presumption of innocence and the honor of the affected persons.
• Compliance with the provisions on personal data protection in accordance with Title VI.
• Immediate referral of information to the Public Prosecutor's Office when the facts may constitute a crime. If the facts affect the financial interests of the European Union, they will be referred to the European Public Prosecutor's Office.

How does the Whistleblowing Channel work?

The Whistleblowing Channel, in compliance with the obligations established by the Law, allows the following actions by the complainant:

• The complainant's first access to the Comandsign Whistleblowing Channel can be made by email or phone, at the email address or phone number established and publicized for the company's Channel. From this first access and in any subsequent communications, the complainant can act by identifying their personal data (including the data to maintain all subsequent communications, such as phone number and/or email), or anonymously.
• In this first access, the complainant will be informed that communications can be made in writing or verbally, or both. In writing, the Comandsign system enables a system to write the complaint on the same platform, or it allows the complainant to send a self-written document (by postal mail or email). In both cases, Comandsign will securely and reliably record the documentation. It also allows verbal reception, by telephone or through a voice messaging system, recording in this case. It will also be informed that the complaint can be made through a face-to-face meeting, to be convened within a maximum period of seven days. If applicable, the informant will be warned that the communication will be recorded and informed about the processing of their data in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016.

In addition, those who communicate through internal channels will be clearly and accessibly informed about external information channels to the competent authorities and, where appropriate, to the institutions, bodies, or agencies of the European Union.

Verbal communications, including those made through face-to-face meetings, telephone, or voice messaging systems, must be documented in one of the following ways, with the prior consent of the informant:

• a) by recording the conversation in a secure, durable, and accessible format, or
• b) through a complete and accurate transcript of the conversation made by the staff responsible for processing it.

From the first contact of the complainant, Comandsign will send the company manager the data received in that first contact:

• Their identification, with the data provided by them (or information about their desire to be anonymous), as well as the data established with their consent for subsequent communications and acknowledgment of receipt.
• The content of the complaint received up to the time of notification to the manager, giving the manager access to this content through the Comandsign platform, where compliance with all the requirements applicable to the whistleblowing channel is guaranteed.

From this first communication, the Information System Manager can continue with all the actions of managing the complaint, or request Comandsign's support for this, both in terms of registering the actions being carried out and legal advice on the content of the complaint, through Comandsign's team of lawyers.

Comandsign Fees

150 €/year (+VAT), for companies that are already clients of other Comandsign options. In case of exclusive use of Comandsign as a Whistleblowing Channel, the price will be 200 €/year (+VAT)

Comandsign will carry out the following actions:

• It will make the Whistleblowing Channel available to the company, including the access means (phone and email for the use of the whistleblowing channel by whistleblowers), an IT platform for the management and registration of all actions of each case (information from the whistleblower, responses to the same, automatic notifications of any action taken to the company manager, configurable regarding the notification system and the desired deadlines by the manager). The manager will receive support for access to any of the records included in each case or to include any record that the whistleblower has sent to the company by any external means to Comandsign (a written letter sent by postal mail, for example, which will be incorporated as a record in the file within Comandsign to comply with the legal requirements for data retention and confidentiality)

Note: the access means can be configured to use the company's own phone and/or email.

At any time, the manager can request legal advice on any case. Each action will be budgeted at the time the need arises.