Type and press Enter.

Internal Information System Policy

Internal Information System Policy

Introduction

EMICELA, S.A. (hereinafter, EMICELA) has designed an Internal Reporting System in accordance with the provisions of Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption (hereinafter “Law 2/2023”).

Law 2/2023 establishes as its main objective that all entities required to comply with the standard must implement an internal information system, which implies the need for these companies to have one, or several, internal information channels.

Thus, EMICELA has enabled a whistleblower channel available to employees and third parties linked professionally or professionally with the entity (partners, suppliers, customers, etc.), so that they can report facts that may be constitutive of
serious or very serious criminal or administrative infractions, or other irregularities of which they have become aware and which contravene the company’s code of ethics or are contrary to the regulations applicable to the company.

This policy, therefore, is aimed at complying with all the requirements set forth not only in this standard, but also in all other standards that may also be related to it and to the activity of the organization itself.

Applicable Legislation

I. Law 2/2023, of February 20, 23, regulating the protection of persons who report regulatory violations and the fight against corruption.
II. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
III. Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights.
IV. Circular 1/2016, of January 22, on the criminal liability of legal entities pursuant to the reform of the Criminal Code made by Organic Law 1/2015.
V. Organic Law 10/1995, of November 23, 1995, of the Penal Code.

Definitions

Internal Information System: Set of procedures and tools for the management of internal communications that may involve a serious criminal or administrative infringement, or an infringement of European Union regulations.

Internal Information Channel: mechanism or instrument through which it is possible to report facts constituting a serious labor and criminal violation, or a violation of European Union regulations.

Informant: a person who reports any act or omission constituting a serious or very serious criminal or administrative offence or any other act or omission that may constitute an infringement of EU law.

Public Disclosure: Public disclosure shall be understood as the making available to the public of information on actions or omissions under the terms provided by law.

Retaliation: any acts or omissions that are prohibited by law, or that, directly or indirectly, involve unfavorable treatment that places the persons who suffer them at a particular disadvantage with respect to another in the labor or professional context, solely because of his or her
status as whistleblowers, or for having made a public disclosure.

Scope

This policy regulates the operation of EMICELA’s internal information system, whereby any person within the subjective scope of this policy who considers that certain non-compliances are occurring, may submit a complaint to EMICELA.
communication in order to make the facts known and take appropriate action.

The Internal Reporting System protects those who report infringements within the material scope of application of Law 2/2023, i.e. facts constituting an infringement of European Union law or a serious criminal or administrative offence, and
very serious. In addition, the same protection is provided to those who report other irregularities of which they have become aware and which contravene EMICELA’s code of ethics or are contrary to the regulations applicable to the company.

EMICELA’s whistleblowing channel is designed, established and managed in a secure manner, guaranteeing the confidentiality of the informant and any third party mentioned in the communication.

The Whistleblower Channel is a mechanism that is available to all the people who make up the Organization, as well as those who are considered by the organization as interested parties, including customers, suppliers and other third parties with whom it has a relationship of trust.
any type of relationship.

In any case, access to the whistleblower channel is guaranteed to all whistleblowers to whom law 2/2023 applies, who work in the private sector and who have obtained information on violations in a work or professional context.

Thus, this policy will be applicable to all interested parties defined by the Organization within the Spanish territory. The scope of application of the standard will be, in particular, on the following:

  • Workers.
  • Employees who have terminated their employment relationship with the organization.
    (former employees).
  • Self-employed.
  • Shareholders, participants and persons belonging to the administrative body,
    management or supervision of a company, including non-executive members.
  • Persons working for or under the supervision and direction of contractors,
    subcontractors and suppliers.
  • Volunteers, trainees, trainees in training periods, regardless of
    whether or not they receive remuneration.
  • Individuals whose employment relationship had not yet begun, but who would have met
    of the facts during the selection or pre-contractual negotiation phase.

    The protection measures also apply to the natural persons who assist the whistleblower, to the persons around the whistleblower who may suffer reprisals, as well as to the legal entities owned by the whistleblower.

    In the same sense, protection measures also include workers’ representatives to advise and support the whistleblower.

Objectives

This policy is aimed at determining the principles of action of the organization regarding the management of the internal information system in order to comply with the provisions of Law 2/2023, and to make available to all interested parties the appropriate channels to report any type of violation of which they are aware within the Organization or that may affect it.

The System implemented by EMICELA also has an internal complaint management procedure that complies with the principles of confidentiality and integrity of personal data and the information contained therein, in accordance with the requirements of
established by law 2/2023.

Responsible for the Internal Information System

The internal information system has an Ethics Committee, appointed by the Board of Directors of EMICELA, which will perform its functions independently, and must perform its functions autonomously from the rest of the EMICELA bodies.
administration of the entity, and may not receive instructions of any kind in the exercise thereof.

The System Manager assumes the functions derived from the implementation of the internal channel, and will be in charge of managing the complaints channel, receiving the communications made through said system, assigning the person who must manage the case, coordinating the investigation to which the complaint may give rise, proposing the imposition of the corresponding disciplinary sanctions, in addition to supervising the correct operation of the channel, complying at all times with the requirements established by the
Law 2/2023.

Business Principles

Transparency and Accessibility

This policy, the essential principles of the complaints channel management procedure, as well as access to the complaints channel enabled by EMICELA, will be published on the home page of its website, in an easily visible place.

Channels

The informant may choose the communication channel he/she considers most appropriate, from among all the channels that are part of the organization’s internal information system. Thus, the following internal channels are made available to informants:

  • Complaints Channel Tool:
    https://cybersecurity.telefonica.com/sandasgrc/?organization=4DBCCFC1-7663-4379-AC05-835CEB794A0D
  • If applicable, the forms for investigation of workplace harassment, sexual harassment, and discrimination of
    sex

    In addition to these internal channels, we inform you about the existence of other external channels to which you can address, which will be the following:
  • Labor Inspection.
  • Spanish Data Protection Agency (AEPD).
  • Independent whistleblower protection authority A.A.I., once established.
  • If applicable, the competent regional authorities or bodies, once they are constituted.
  • If applicable, before the institutions, bodies, organs or agencies of the European Union.

    For further information on the procedure to be followed, please contact the Head of the Internal Information System at the following e-mail address: canaldenuncias@emicela.es. If you wish to use this medium, your data will not be anonymized, please use the Whistleblower Channel Tool.

Guarantees and protection measures

Any person making use of the internal information channel shall be entitled to its protection under the following circumstances:
a) have reasonable grounds to believe that the information referred to is true at the time of communication or disclosure, even if they do not provide conclusive evidence, and that such information falls within the scope of the law.

b) the communication or disclosure has been made in accordance with the requirements of the law.

Acts constituting retaliation, including threats of retaliation and attempts to retaliate against persons submitting a communication, are expressly prohibited.

For this purpose and to guarantee the confidentiality of the informant, communication is allowed through the internal information channel anonymously.

The administrators of the complaints channel, as well as its control bodies, undertake to maintain due confidentiality in all actions and in relation to all persons involved.

The identity of the informant may only be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or disciplinary investigation.

At all times, respect for the rights of the persons to whom the facts refer shall be guaranteed, these are fundamentally the right to be informed of the investigative process being carried out and of the facts with which they are charged, the right to be informed of the facts of the case, the right to the
presumption of innocence, the right to defense and the right to honor.

Exemption from the obligation of secrecy

Persons communicating information about infringing acts or omissions or making a public disclosure shall not be deemed to have violated any restriction on disclosure of information, and they shall not incur any liability
of any kind in connection with such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to disclose an act or omission.

This measure will not affect criminal liabilities.

All this extends to the communication of information made by employee representatives, even if they are subject to legal obligations of confidentiality or non-disclosure of confidential information. All of the above, without prejudice to the specific protection rules applicable under labor regulations.

Whistleblowers shall not incur liability in respect of the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a criminal offense.

Publicity of the Internal Information System

All information relating to the use of the internal information channel, as well as the essential principles of the Internal Information System management procedure, shall be provided in a clear and easily accessible manner in a separate and easily identifiable section in the
Entity’s website.

Thus, this Policy, along with all others that make up the documentary system of the Internal Information System, will be fully available on the EMICELA website: https://emicela.com/.

Communication Obligation

Any person who, in the work or professional context, detects facts that may constitute serious or very serious criminal or administrative offenses, or who becomes aware of any of the conducts prohibited by the entity in its regulations.
internal, will have the obligation to communicate it through the Internal Information Channel implemented in the organization, which can be accessed through the aforementioned web page, through this link:
https://cybersecurity.telefonica.com/sandasgrc/?organization=4DBCCFC1-7663-4379-AC05-835CEB794A0D

Whistleblower Channel Operations

The Whistleblower Channel can be accessed through the entity’s web page, where the informant may not only report in writing the events that have occurred, but may also do so by means of a voice recording.

The Whistleblower Channel is unique to EMICELA, so the facts that are the subject of the communication will be associated with this company.

Any action aimed at preventing a communication from being made through the Whistleblower Channel will be sanctioned on the basis of the applicable labor and disciplinary regime.

Once the communication has been sent, it will be assigned an identification code through which the informant will be able to follow up on the status of his/her alert or query, and communicate, even anonymously, with the case manager. In addition, the informant
You will also receive a receipt of the communication made.

Once the communication is received, it will be determined whether or not to process it, in the event that the complaint is unfounded or does not provide sufficient information, it will not be admitted for processing.

In the event that the complaint has been admitted for processing, the analysis and verification of the facts reported will proceed and, if necessary, the collaboration of other areas of the company may be requested.
innocence of the affected persons.

Once the analysis of the reported facts has been concluded, the conclusions will be transferred to the competent area, which may result in the following:

  • The investigated fact does not imply any crime or infraction and therefore the case is closed.
  • The existence of the infraction is considered to be accredited, in which case, the affected area will be notified for disciplinary purposes.

Data Protection

Internal information systems, external channels and those receiving public disclosures shall not obtain data that would allow the identification of the informant and shall have appropriate technical and organizational measures in place to preserve identity and ensure the confidentiality of the information.
confidentiality of the data corresponding to the persons concerned and to any third party mentioned in the information provided, especially the identity of the informant in case he/she has been identified.

Access to personal data contained in the System shall be limited, within the scope of its competencies and functions, exclusively to:

  • The person in charge of the system and whoever manages it directly.
  • The person in charge of human resources, only when it could be appropriate to adopt
    disciplinary measures against an employee.
  • The person in charge of the legal services of the entity, should the adoption of
    legal measures in relation to the facts related to the communication.
  • The persons in charge of the treatment that eventually may be designated.
  • The Data Protection Officer.

No personal data shall be collected that is not relevant to the investigation of the facts and, if collected, shall be deleted without undue delay. Nor will special category data be collected, and if they are included by the complainant in the communication made through the Internal Information System, they will be immediately deleted, without the registration and further processing of the same.

The purpose of the processing of personal data will be the management and processing of the corresponding complaints received through the Complaints Channel and will not be used for other different or incompatible purposes.

The processing of data derived from the application of this policy will be strictly necessary to ensure compliance with this policy and, in any case, legitimized by the fulfillment of a legal obligation and/or in compliance with a mission carried out in the interest of the company.
public, ensuring the confidentiality of the informant’s data by keeping them anonymous, without disclosing them to third parties, unless their identification constitutes a necessary and proportionate obligation imposed by EU or national law in the context of a
investigation carried out by the national authorities or in the framework of a judicial process, in which case it shall be communicated to the authorities competent in the matter.

Where appropriate, the data will be communicated to a supplier who, acting as data processor, will ensure the proper management of the complaints received. The data will also be communicated to the competent authorities for criminal or administrative investigation.
to be carried out.

Your data will be kept for the time necessary to decide whether to initiate an investigation into the reported facts. After these periods have elapsed, they will be removed from the channel, but they may remain blocked when
is necessary to evidence the operation of the crime prevention model or when it may be required by the competent authority for the initiation of the corresponding investigation of the facts.

In any case, if three months have elapsed since the receipt of the communication and no investigation has been initiated, it must be deleted, unless the purpose of the conservation is to leave evidence of the operation of the system.

Complaints that have not been acted upon may only be recorded in anonymized form.

For more information about the treatment of your data or how to exercise your rights, please refer to our Privacy Policy.

Approval

This internal information system policy is subject to the approval of the Board of Directors of EMICELA, who will ensure its implementation, and will remain in force until its update, revision or repeal is agreed, being reviewed periodically or when a change occurs that requires it.