Internal Reporting System Management Procedure
Whistleblowing Channel · GAMBASTAR, S.L.
1. PURPOSE
This procedure governs the steps taken by GAMBASTAR, S.L. (the COMPANY) when it receives reports covered by Spanish Law 2/2023 of 20 February on protecting persons who report regulatory infringements and combating corruption.
2. REFERENCE RULES AND LEGISLATION
• Law 2/2023 of 20 February, transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to personal data processing (General Data Protection Regulation or GDPR).
• Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).
3. SCOPE
The procedure applies throughout the Company and follows its Information Security Policy. It is binding on all permanent or temporary personnel, including external suppliers' personnel who use the Company's information systems.
4. DEFINITIONS
1. Reporting person. A natural or legal person who obtains information about infringements in a work or professional context and reports it to the Company, including those specified in Article 3(1) and (2) of Law 2/2023.
2. Affected person. A natural person alleged to have committed an infringement under Article 2 of Law 2/2023, including a person whose suspected involvement is identified during the investigation rather than in the original report.
3. Third party. A natural person who may know something about the reported infringement, including a direct or indirect witness, and can provide information to the proceedings.
4. Internal Reporting System. The Company's route for reporting acts or omissions under Article 2 of Law 2/2023, with the functions and content set out in Article 5(2). It includes the Internal Reporting Channel and the Information Management System.
5. Internal Reporting Channel. The channel set up to receive reports covered by this procedure, administered by the Company's System Manager.
6. Information Management System. The technology platform within the Internal Reporting System for managing, recording and preserving actions taken in response to reports covered by Law 2/2023.
5. RIGHTS AND GUARANTEES OF REPORTING PERSONS
In addition to other constitutional and legal rights, reporting persons are guaranteed the following:
a. To report anonymously and remain anonymous throughout the proceedings.
b. To report orally or in writing. For an oral report, they may check, correct and sign the transcript to accept it.
c. To designate a postal address, email address or safe place for messages from the System Manager.
d. To appear before the System Manager or delegated case officer on their own initiative.
e. To waive communication with the System Manager or delegated case officer and revoke that waiver at any time.
f. To have their identity protected. Without express consent it may be disclosed only to persons authorised to receive and handle reports, subject to exceptions under EU or Spanish law in official investigations or judicial proceedings.
g. To have their personal data protected.
h. To know the identity of the delegated case officer conducting the proceedings.
i. To have communications kept confidential.
j. To receive the protection and support provided for in Law 2/2023.
k. To complain to the Independent Whistleblower Protection Authority.
l. To be protected against retaliation even if the investigation finds no breach of applicable rules or the Company's Code of Ethics, provided they did not act in bad faith.
6. OBLIGATIONS OF REPORTING PERSONS
a. Have reasonable or sufficient grounds for believing the information is true. Generic reports, bad-faith reports or abuse of rights are prohibited and may give rise to civil, criminal or administrative liability.
b. Describe the facts or conduct in as much detail as possible and provide available documents or objective indications for obtaining evidence.
c. Refrain from reports made for purposes outside the Channel's remit, reports that violate third parties' rights to honour, image or personal and family privacy, and reports contrary to human dignity.
7. THIRD-PARTY RIGHTS
Third parties have the following rights. The support and protection measures under Law 2/2023 may be extended to them where possible.
a. To designate a postal address, email address or safe place to receive messages from the System Manager.
b. To appear before the System Manager or delegated case officer on their own initiative.
c. To have their identity protected. Without express consent it may be disclosed only to persons authorised to receive and handle reports, subject to exceptions under EU or Spanish law in official investigations or judicial proceedings.
d. To have their personal data protected.
e. To have communications kept confidential.
f. To be protected against retaliation.
8. RIGHTS OF AFFECTED PERSONS
The System Manager must safeguard the constitutional and statutory rights of affected persons, in particular:
a. To be informed as soon as possible of information affecting them.
b. To honour and privacy.
c. To the presumption of innocence and to use all lawful means of defence.
d. To be assisted by a lawyer.
e. To access the proceedings against them, subject to temporary restrictions needed to protect their outcome.
f. To know the identity of the delegated case officer.
g. To have their identity protected from anyone outside the System Manager's remit.
h. To have their personal data protected.
i. To have communications kept confidential.
9. INTERNAL REPORTING SYSTEM MANAGER
1. Management appoints the person or collegiate body referred to in Article 8 of Law 2/2023.
2. In exercising their powers, those responsible act independently, receive no instructions from other Company areas and are not subject to hierarchy within the collegiate body. They may not be removed for matters related to their participation in the System.
10. ACCESS TO PERSONAL DATA IN THE INTERNAL REPORTING SYSTEM
Access by Company personnel is limited to the following persons within their duties and powers, regardless of the professional responsibilities of those appointed to the collegiate body:
a) The System Manager or their delegate.
b) The person responsible for Human Resources, if disciplinary measures against a Company employee may be warranted.
c) The head of Legal, if legal measures concerning the reported facts may be warranted.
d) Any appointed data processors.
e) The Company's Data Protection Officer.
Other persons may process the data, or the data may be disclosed to third parties, when necessary for corrective measures within the Company or for applicable sanctioning or criminal proceedings.
11. PROCEDURAL TIME LIMITS
1. Investigations must be resolved within three months. In particularly complex cases the System Manager may extend this period, with reasons, by up to a further three months.
2. The period starts when the System Manager receives the report or, if no acknowledgement is sent, when the seven-day period after receipt expires. Periods in months run from date to date.
3. Periods stated in days are working days unless expressly stated to be calendar days. Saturdays, Sundays and public holidays are excluded from working-day calculations.
12. PERSONAL DATA PROTECTION
1. Processing under this procedure complies with Title VI of Law 2/2023.
2. The System must prevent unauthorised access, preserve identities and protect the confidentiality of affected persons and third parties named in the report, particularly the reporting person if identified. That identity may be disclosed only to a judicial authority, the Public Prosecutor's Office or the competent administrative authority in a criminal, disciplinary or sanctioning investigation, subject to applicable safeguards.
3. Personal data not clearly relevant to a report must not be collected. If collected accidentally, they must be erased without undue delay.
4. If no investigation has begun within three months of receipt, the report must be erased unless retained as evidence of how the System operates. Reports that are not acted on may be kept only in anonymised form. The blocking requirement in Article 32 of Organic Law 3/2018 of 5 December does not apply.
13. PROCEDURE
Receipt of information
Reports of infringements under Article 2(1) of Law 2/2023 and other information arising in this procedure are submitted orally or in writing using the electronic means provided by the Internal Reporting Channel on the Company's website. At the reporting person's request, a face-to-face meeting can be arranged within seven days.
With the reporting person's prior consent, oral reports made in person, by telephone or by voice messaging must be documented by a secure, durable and accessible recording or by a complete and accurate transcript prepared by responsible personnel. Subject to data protection rights, the reporting person may check, correct and sign the transcript to accept it.
Reports must include at least:
• The reporting person's identity, unless the report is anonymous.
• A description of the facts and, where appropriate, the rule concerned.
• The identity of the affected person or persons.
• The identity of any third parties who may provide relevant information.
• Whether the reporting person waives communication with the System Manager.
The reporting person may provide a postal address, email address or safe place for communications. Receipt is acknowledged within seven calendar days unless no contact method was provided or the reporting person waived communication with the System Manager or the delegated case officer.
Admission
Once the report is registered, the System Manager checks whether the facts or conduct fall within the personal scope of Article 3 of Law 2/2023. Within ten working days of registration, the Manager may:
a) Reject the report if the facts are wholly implausible, do not constitute a legal infringement under Law 2/2023, the report is unfounded or there are reasonable indications that it was obtained through a crime, or it contains no new and significant information compared with a previously concluded report unless new circumstances justify different follow-up. Where there are indications of a crime in obtaining the information, a detailed account of the facts is also sent to the Public Prosecutor's Office. Rejection is notified within five working days unless the report was anonymous or the reporting person waived communications.
b) Admit the report. Admission is notified within five working days under the same exceptions.
c) Immediately refer the information to the Public Prosecutor's Office if the facts indicate a possible criminal offence, or to the European Public Prosecutor's Office if the EU's financial interests are affected.
d) Refer the report to the authority, entity or body deemed competent to handle it.
Investigation
The investigation includes all steps needed to assess whether the reported facts are credible. The delegated case officer appointed by the System Manager conducts the investigation.
Within 15 days of admission, the affected person is informed of the proceedings and given a brief account of the facts. If notice could facilitate concealment, destruction or alteration of evidence, the officer may give reasons for extending the period until that risk has passed.
The affected person is never told the reporting person's identity or given access to the report itself. To exercise their defence, they may access the case file with identifying information removed, be heard at any time and appear with legal assistance. They must keep information from the file confidential and must not attempt to identify the reporting person or third parties, subject to applicable data protection obligations.
Conclusion
After the investigation, the System Manager sends a report to the Company's Managing Director containing at least:
a) The reported facts, case number, registration date and admission date.
b) Steps taken to assess the facts, including at least a summary of the affected person's submissions, any interview, documents supplied or obtained through third parties and other information supporting the decision.
c) The findings and an assessment of the steps taken and evidence supporting them.
d) The decisions taken.
The report is also notified to the affected person and to the reporting person if identified and if they have not waived communication with the System Manager.
The proceedings and any response to the reporting person must be completed within three months of entry in the Information Management System register, subject to the extension provided for in Article 9 of Law 2/2023.