WHISTLEBLOWER CHANNEL DATA PROTECTION POLICY

INFORMATION OR ENQUIRIES ABOUT REGULATORY BREACHES, NEGLIGENCE AND ILLEGAL OR UNETHICAL BEHAVIOUR:

INGENIERÍA DE PROTECIONES Y CONTROL, S.L. is responsible for the processing of personal data obtained within the framework of the Whistleblowing Channel. The personal data will be processed for the purpose of managing the Complaints Channel information system and specifically to manage, process and investigate all acts or omissions contrary to ethics, legality and the Code of Conduct and other internal corporate rules that make up the IPROCEL, as well as any other code to which the entity is adhered to, ensuring compliance and adopting the corresponding disciplinary or legal measures, and if applicable, the prosecution of criminal offences and the enforcement of criminal sanctions of the complaint received and the processing and resolution of the enquiry received.

Personal data will not be collected if it is manifestly not relevant to the processing of specific information or, if collected by accident, will be deleted immediately.

With regard to the personal data that may eventually be communicated through the Whistleblower Channel by employees of other companies of the group, the data controller, unless otherwise provided, shall be that company; IPROCEL shall be the data processor, according to the agreement to be signed between the two companies.

Reports submitted under this procedure may be anonymous, and the reporter need not be identified. Enquiries, however, may not be anonymous. Notwithstanding the foregoing, the personal data obtained on the occasion of the complaint and the internal investigation shall be treated confidentially and solely for the management and control of this procedure, applying the due guarantees and legally required privacy measures.

The legal basis for the processing of personal data is as follows:

• For the management of a complaint: Compliance with the legal obligations applicable to the data controller Article 6.1 c) RGPD, regarding the duty to have a complaints channel and in accordance with Article 24 of Organic Law 3 /2018 on Data Protection and guarantee of digital rights. Failing this, because it is necessary for the fulfilment of a public interest, article 61 ERGPD.
• To safeguard the legitimate interest of IPROCEL art. 6.1 f) RGPD, in order to be able to verify internal processes and protect the integrity of IPROCEL given that a query and its response may involve preventing an act or omission contrary to ethical compliance or legality.

Under no circumstances will IPROCEL carry out automated transfers based on the data submitted.

IPROCEL does not request or process any special categories of personal data such as, for example, information on health, racial or ethnic origin, religious and ideological convictions, trade union membership or sexual orientation. However, because there are free text fields in the form, you may voluntarily disclose such special categories, as well as personal data of third parties to which you refer in such communication.

In any case, and to the extent permitted by law, the data subject will not receive any data concerning the identity of the informants.

Access to the data is again limited to those within or outside IPROCEL who carry out the functions of internal control and management of the internal information system or to those in charge of the processing that may be appointed for this purpose. However, personal data may be communicated, if necessary, to interested third parties such as members of the internal information system team, employees of the organisation, external advisors or public authorities for the purposes of investigation and clarification of the facts reported, those responsible for the legal services for the determination of responsibilities, implementation of corrective actions and, where appropriate, the filing of legal and disciplinary actions required before the competent bodies in each case.

Without prejudice to the notification to the competent authority of facts constituting a criminal or administrative offence, only when disciplinary action against employees may be appropriate, access to the data shall be granted to staff with Human Resources management and control functions.

The data will be kept for the time necessary to decide whether to initiate an investigation into the facts reported. In any case, 3 months after the data have been entered, they will be deleted from the complaints system.

Complaints that have not been followed up may only be recorded in anonymised form. The rights of access, rectification, deletion and limitation of portability may be exercised under the terms specified in the current regulations by writing to C/ Mario César, 17, Las Palmas de Gran Canaria or to rgpd@iprocel.com attaching a photocopy of the DNIE indicating the specific right to be exercised. Likewise, in the case of considering that IPROCEL has not treated personal data in accordance with current regulations, it is possible to file a complaint with the Spanish Data Protection Agency (AEPD).

However, such rights shall not be exercised in the following cases:

• The exercise of the right of access by the data subject does not include the disclosure of the informant's identification data. The right of access to the information contained in the file shall be limited to that information relating to the personal data being processed, without the exercise of this right being understood to include data relating to the informant.
• The right of cancellation cannot be exercised by any participant during the course of the research.
• When these rights are exercised on the basis of a report related to the prevention of money laundering and terrorist financing, the provisions of Article 32 of Law 10/2010 of 28 April on the Prevention of Money Laundering and Terrorist Financing shall apply.

Persons who make a communication through any of the channels that make up the Complaints Channel represent and warrant that the personal data provided are true, accurate, complete and updated and shall hold IPROCEL or, where appropriate, the data controller harmless from any liability that may arise from the breach of such representations and warranties.