Internal Reporting System Policy
Whistleblowing Channel · GAMBASTAR, S.L.
1. INTRODUCTION
Spanish Law 2/2023 of 20 February on the protection of persons reporting regulatory infringements and the fight against corruption requires public and private organisations to establish internal channels designed to protect people who identify potential infringements in a work-related or professional context. Article 13 requires all public sector entities to have an internal reporting system, including public sector foundations under paragraph 1(f).
GAMBASTAR, S.L. (the COMPANY) undertakes to prevent retaliation, including threats and attempts, against anyone who reports in good faith acts or omissions contrary to that law, its Code of Ethics and Conduct or its internal rules and procedures.
2. GENERAL PRINCIPLES
This Policy sets out how the Company implements its Internal Reporting System and protects reporting persons under Law 2/2023.
1. The System is accessible to all persons within its scope, who can report regulatory infringements and corruption in writing, orally or in person.
2. The System Manager acts independently of other areas of the Company and ensures completeness, integrity, confidentiality, durable storage, protection from unauthorised access and respect for good faith.
3. The identities of reporting persons and people mentioned, and the handling of reports, are confidential. Anonymous reports may be submitted and processed.
4. Personal data of affected persons are protected under applicable law.
5. Communications are kept secret.
6. Reporting and affected persons are kept safe and protected.
7. Affected persons are entitled to the presumption of innocence and respect for their reputation.
3. SCOPE
a) This Policy applies to Company members, including current employees and collaborators, who report through its procedures:
• Acts or omissions that may constitute criminal offences or serious or very serious administrative infringements, including those against or causing financial harm to the Public Treasury or Social Security.
• Acts or omissions by Company members in a work or professional context that affect the reported person's professional relationship with the Company and breach its Code of Ethics or other internal rules.
• Acts or omissions that may breach European Union law.
b) The Policy also covers people outside the Company who obtained such information in a work or professional context:
• Anyone working for or under the supervision and direction of the Company, its contractors, subcontractors or suppliers.
• Former members whose employment or statutory relationship has ended.
• Volunteers and trainees, whether paid or unpaid.
• People whose employment has not begun, if they obtained the information during recruitment or pre-contractual negotiations.
4. INTERNAL REPORTING SYSTEM
The System is the preferred route for reporting acts or omissions covered by Law 2/2023. It consists principally of the channel receiving reports within this Policy, the System Manager and the procedure for handling reports.
5. ESTABLISHMENT OF THE INTERNAL REPORTING CHANNEL
The Whistleblowing Channel forms part of the System and is the preferred route for reporting conduct covered by section 3. It allows:
a) Written or oral reports, or both, under Law 2/2023.
b) A postal address, email address or safe location specified by the reporting person for receiving notices.
c) Submission and handling of anonymous reports.
d) Clear and accessible information for reporting persons about external channels run by competent authorities and institutions.
e) Receipt of other information outside section 3. Those reports and senders fall outside this Policy's scope and protection.
f) Confidential handling of reports sent through other channels or to staff not responsible for processing them. Staff must immediately forward such reports to the System Manager.
6. INTERNAL REPORTING SYSTEM MANAGER
1. The Manager may be a person or collegiate body, internal or external, meeting Article 8 of Law 2/2023.
2. Appointments to the collegiate body are notified to the Independent Whistleblower Protection Authority within ten days of designation under Article 8(3). Departures, resignations and their reasons are also notified within the same period where applicable.
3. In carrying out their duties, those responsible receive no instructions from superiors, are not subject to hierarchy within the collegiate body and cannot be removed for matters related to their legitimate participation in the System.
7. PERSONAL DATA PROTECTION
Processing arising from Law 2/2023 is governed by the GDPR and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD), in accordance with Law 2/2023.
The System prevents unauthorised access, preserves identities and protects the confidentiality of data of affected persons and third parties mentioned, with particular care for the reporting person's identity if disclosed.
That identity may only be disclosed to a judicial authority, the Public Prosecutor's Office or a competent administrative authority in a criminal, disciplinary or sanctioning investigation, subject to applicable safeguards.
Personal data that are not clearly relevant to a specific report are not collected. If collected by accident, they are erased without undue delay.
Reports that have not been acted on may be kept only in anonymised form. The data blocking requirement in Article 32 of the LOPDGDD does not apply.
8. PROTECTION OF THE REPORTING PERSON
Reporting persons qualify for the protections of Law 2/2023 when:
a) They have reasonable grounds to believe the information is true at the time of reporting or disclosure, even without conclusive evidence, and is within this Policy.
b) The report or disclosure complies with this Policy and Law 2/2023.
Protection expressly excludes people who report or disclose:
• Information in reports rejected by an internal channel or for the following reasons:
‐ The facts are wholly implausible.
‐ The facts do not constitute a legal infringement within this Policy.
‐ The report is manifestly unfounded or there are reasonable indications that the information was obtained through a crime.
‐ The report contains no new and significant information compared with an earlier report whose procedures have ended, unless new facts or legal circumstances justify a different follow-up.
• Information about interpersonal disputes or affecting only the reporting person and those named in the report or disclosure.
• Information already fully available to the public or consisting only of rumours.
• Information about acts or omissions outside this Policy.
9. PROTECTION OF AFFECTED PERSONS
During proceedings, affected persons have the right to the presumption of innocence, to defend themselves and to access the case file under Law 2/2023. They receive the same protection as reporting persons, including protection of their identities and confidentiality of the facts and data in the proceedings.
10. APPROVAL, ENTRY INTO FORCE AND PUBLICATION
This Policy takes effect upon approval by Company Management and will be published on the Company's corporate websites. It will be reviewed and updated whenever changes are needed.