ETHICAL COMPLAINTS CHANNEL MANAGEMENT PROTOCOL

1.PURPOSE
The purpose of this Protocol is to determine the operations to be followed in order to manage the communications received through the Ethical Complaints Channel of INTERFLEX, S.L. (hereinafter "INTERFLEX"), in accordance with current legislation and internal corporate regulations.

2. DEFINITIONS
- Ethical Complaints Channel: communication channel that an organisation provides for people inside and/or outside the organisation to report breaches. 
- Whistleblower: a natural person who reports information on breaches obtained in the context of his or her activity. 
- Retaliation: any action or omission, direct or indirect, occurring in an employment context, which is motivated by an internal communication and which causes or is likely to cause unjustified prejudice to the whistleblower.
- System Manager: person responsible for the reception and management of communications received through the INTERFLEX Ethical Complaints Channel. 

3. WHAT CAN BE REPORTED?
The following may be communicated through the Ethical Complaints Channel:
(a) Any act or omission which may constitute an breach of European Union law, provided that:
•    It falls within the scope of the European Union acts listed in the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of Union law;
•    It affects the financial interests of the European Union; 
•    It affects affect the internal market, including breaches of EU competition rules and aid granted by States, as well as breaches relating to the internal market in connection with acts in breach of corporate tax rules or practices aimed at obtaining a tax advantage that would defeat the object or purpose of corporate tax law.
b) Actions or omissions that could constitute a serious or very serious criminal or administrative offence (e.g. sexual harassment). 
The Channel will be the preferred channel for reporting the actions or omissions listed above. In the event that a member of INTERFLEX verbally reports a breach to his or her superior, he or she must also bring the facts to the attention of the System Manager through the Ethical Complaints Channel. 
Failure to report a breach through the Ethical Complaints Channel could be understood as a breach of contractual good faith and as indiscipline or disobedience at work on the part of the employee in question, with disciplinary sanctions for such conduct in accordance with the applicable collective bargaining agreement and the Workers' Statute.  

4. WHO CAN MAKE A REPORT?
The Channel may be used by persons who have obtained information about breaches in an employment or professional context, including in any case: 
•    persons with the status of public employees or employees; 
•    self-employed persons; 
•    customers; 
•    shareholders, participants and persons belonging to the administrative, management or supervisory body, including non-executive members; and 
•    any person working for or under the supervision and direction of contractors, subcontractors and suppliers of INTERFLEX. 

It may also be used by persons who communicate or publicly disclose information on breaches obtained within the framework of an employment or statutory relationship that has already ended, volunteers, trainees, workers undergoing training (whether or not they are paid) and those whose employment relationship has not yet begun, in cases where the information on breaches has been obtained during the recruitment process or pre-contractual negotiation. 

5.    PROTECTION MEASURES

Persons who report or disclose breaches through the Ethical Complaints Channel are entitled to protection under the following circumstances: 
a) they have reasonable grounds to believe that the information provided is true at the time of communication or disclosure, even if they do not provide conclusive evidence, and that the information is within the material scope of application; or
b) The communication or disclosure has been made in accordance with the requirements of Law 2/2023, dated 20 February, regulating the protection of persons who report regulatory breaches and anti-corruption efforts.

Reporting / disclosing parties are excluded from the right to protection in the following cases: 
a) When the information contained in the communication has been rejected by the Channel because:
•    The facts are not in any way plausible;
•    The facts do not constitute a serious or very serious administrative offence or a criminal offence;
•    The claim is manifestly unfounded or there are reasonable grounds to believe that the information was obtained through the commission of an offence. (in the latter case, in addition to the inadmissibility, the facts constituting an offence shall be referred to the Public Prosecutor's Office) or, lastly, 
•    When the information does not contain significant new information on breaches in comparison with a previous communication in respect of which the relevant proceedings have been concluded, unless there are new circumstances justifying a different follow-up.  
b) Information related to complaints about interpersonal conflicts.
(c) Information which is already fully available to the public or which is mere hearsay. 
Any kind of retaliation against a whistleblower who decides to use the Ethical Complaints Channel in good faith will not be tolerated, and the misuse of the latter may only be sanctioned if it amounts to false or unfounded allegations and/or is done solely for the purpose of slandering, defaming or harming any third party. To this end, INTERFLEX reserves the right to take appropriate action against any person who retaliates against a whistleblower. 

Retaliation shall be understood to mean, by way of example:    

a) Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary employment contract after the probationary period, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotion and any other substantial modification of working conditions and failure to convert a temporary employment contract into a permanent one, where the employee had legitimate expectations that he/she would be offered a permanent job; unless these measures were carried out as part of the regular exercise of managerial powers under the relevant labour or public employee statute legislation, due to circumstances, facts or breaches that are proven and unrelated to the submission of the communication.

a) Damage, including reputational damage or economic loss, coercion, intimidation, harassment or ostracism.
c) Negative evaluation or references regarding work or professional performance.
d) Blacklisting or dissemination of information in a particular sectoral area which hinders or prevents access to employment or the contracting of works or services.
(e) Refusal or revocation of a licence or permit.
(f) Refusal of training.
(g) Discrimination or unfavourable or unfair treatment.

Any whistleblower who believes that some kind of retaliation has been taken against him/her as a result of having made a communication through the Ethical Complaints Channel must inform the System Manager, who will analyse the case and decide whether it is necessary to adopt appropriate measures to correct the situation. 
The prohibition of retaliation shall not preclude the application of disciplinary measures if it is established that a manifestly false communication has been made to the detriment of a third party.   

6. PROCEDURE OF ACTION

6.1.    Interposition 
Wherever possible, communication through the Channel should include:  
•    a detailed description of the events that occurred and how the whistleblower came to know of them; 
•    the date and place where the event occurred; 
•    the names and positions of the persons involved or elements that may allow their identification; 
•    the names of other persons who can provide information on the events reported; and 
•    reference to any documents that may confirm that the events reported occurred. 
 
6.2.    Reception and evaluation 
The INTERFLEX System Manager, Meritxell Boluda, is the person in charge of receiving and managing the communications received through the Ethical Complaints Channel, thus guaranteeing maximum independence and impartiality in the exercise of these functions, as well as the confidentiality of the information communicated. 
The whistleblower will receive acknowledgement of the receipt of their communication within no later than 7 calendar days from its arrival. 
Subsequently, the System Manager shall carry out a preliminary examination to verify the substance, sufficiency and plausibility of the facts reported, determining whether they may be considered as a "breach" that may be reported through the Channel, in accordance with the provisions of this Protocol, or whether the report should be rejected. 
In the event that the disclosure personally affects the System Manager and places him/her in a situation of conflict of interest, the System Manager shall abstain from participating in the process of handling the disclosure. A new manager will be appointed accordingly to deal with the case.   
If the report is found to contain formal or material defects, the whistleblower shall be given 10 working days to remedy the defect in question. On the other hand, if the System Manager believes that the information communicated is insufficient, he/she may ask the whistleblower to provide more within the aforementioned time period, detailing the specific aspects that should be expanded upon. 
Once the preliminary examination of the communication has been carried out via the drafting of a reasoned report, the System Manager:
(a) will accept the communication and:
•    the whistleblower shall be informed of the measures envisaged or taken to handle his or her report and of the reasons for such measures. 
(b) shall reject the communication as inadmissible and file it away immediately if:
•    the reported facts are not considered a "breach" that can be reported through the Ethical Complaints Channel;
•    the granted deadline has expired but the whistleblower has not complied with the requirements of the System Manager to rectify or expand the content of the communication;
•    the reported facts are already under investigation; or
•    the communication is considered irrelevant or irrelevant;
Once the communication has been accepted, the System Manager shall register it, recording the following points:
- Identifying number of the communication; 
- Date of receipt and acknowledgement of receipt; 
- Summary of the facts; 
- Final report of the internal investigation, if any; and 
- Resolution of the communication.
 
6.3. Internal investigation and resolution
Based on the outcome of the preliminary examination, the System Manager will determine whether it is necessary to initiate an internal investigation procedure or whether, on the contrary, the resolution of the communication does not require its adoption. 
In the event that an internal investigation is carried out, it shall include any measures deemed necessary to clarify the facts reported and to identify those responsible, while maintaining the formality of hearing the parties involved and respecting their fundamental rights at all times. This phase will include, but is not limited to, conducting interviews with the persons involved, gathering documentary and/or video evidence, verification of public records, among others. 
In any case, the person concerned shall be informed of the actions or omissions attributed to him or her, and shall have the right to be heard during the investigation process, and the contributions made by him or her shall be recorded in the minutes.  
The resolution of the communication shall take place within a reasonable period of time, which may not exceed three (3) months from the acknowledgement of receipt (extendable to six (6) months in the event of an especially difficult case). 
The decision made by the System Manager shall be communicated to both the reporting party and the affected party. If the reported facts are found to be punishable, and provided that the offending person is an employee of the organisation, the disciplinary sanction shall be applied in accordance with the provisions of the applicable collective bargaining agreement.  
If it is believed that the facts under investigation may constitute a criminal offence, the information shall be forwarded to the Public Prosecutor's Office immediately. If the facts affect the financial interests of the European Union, it will also be referred to the European Public Prosecutor's Office.
  
7. EXTERNAL INFORMATION CHANNEL. 
Any person may report the commission of any action or omission included in the second section of this document to the Independent Whistleblower Protection Authority (hereinafter, I.W.P.A.), or to the corresponding regional authorities or bodies.  
In this case, we are providing the following link to the Anti-Fraud Office of Catalonia which is the I.W.P.A. of the Autonomous Community of Catalonia, given that this is where INTERFLEX has its registered office : https://denunciesanonimes.antifrau.cat/#/?lang=es

8. CONFIDENTIALITY. 

Any person making a communication or public disclosure has the right to safeguard his or her identity.
If the identity of the whistleblower is disclosed, it may only be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or disciplinary investigation. In this case, the whistleblower shall be informed that his or her identity will be disclosed prior to disclosure, unless such information could jeopardise the investigation or judicial proceedings. 
It should be emphasised that if the whistleblower's communication is made through channels other than those established, or to members of staff who are not the persons responsible for processing such reports, the recipient must forward it to the System Manager as soon as possible, on a mandatory basis. Failure to comply with this measure may result in a very serious breach. 

9. PROTECTION OF PERSONAL DATA. 
The data processed will be kept only for the time necessary to decide whether to initiate an investigation into the reported facts. 

If it is proven that the information provided (or part of it) is false, it will be immediately deleted as soon as this circumstance becomes known, unless the lack of truthfulness may constitute a criminal offence, in which case the information will be retained for the necessary period throughout the legal proceedings.  

In any case, after three months have elapsed from the receipt of the communication with no investigation having been initiated, the data shall be deleted, unless the purpose of the storage is to leave evidence of the operation of the system. Communications that have not been followed up will be kept in an anonymised form, without the blocking obligation provided for in Article 32 of Organic Law 3/2018 dated December 5 being applicable.

• Data Controller: INTERFLEX, S.L. 
• Purpose: we use your data to deal with communications made through the Ethical Complaints Channel and to be able to issue a resolution.
• Legitimate basis: the processing is necessary for compliance with a legal obligation applicable to the Data Controller.
• Recipients: your data will be processed by the System Manager, the HR department (in the event that disciplinary measures may be taken against an employee), the legal services, any data processors appointed and the data protection officer.
The processing of the data by other persons, or even its transmission to third parties, shall be lawful when it is necessary for the adoption of corrective measures within the company or the processing of the sanctioning or criminal proceedings that, where appropriate, may be applicable.

•  Rights: You have the right to access, rectify, delete, oppose, limit and request portability of your personal data. In the event that the person to whom the facts related in the communication or to whom the public disclosure refers exercises the right to object, it shall be presumed, in the absence of proof to the contrary, that there are compelling legitimate grounds for the processing of his or her personal data.