Whistleblower channel

I. INTRODUCTION, PURPOSE AND APPLICATION

Act 2/2023 of 20 February, regulating the protection of persons reporting breaches of regulations and combating corruption (hereinafter, Law 2/2023) transposes into Spanish law Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

This policy applies to:

  • Tomás Gracia Grupo Empresarial, S.L., with tax identification number (CIF) B26798272 and registered office at Passeig Vilanova, 7, 8870, Sitges, Barcelona;
  • Tomás Gracia Construcciones, S.A., with tax identification number (CIF): A08428906
  • Tomás Gracia Instalaciones Industriales, S.L., with tax identification number (CIF): B25951807

Hereinafter collectively referred to as TOMÁS GRACIA.

The purpose of this Policy is to establish an internal channel for reporting potential regulatory breaches, breaches of internal policies and/or ethical violations, and to establish a whistleblower protection scheme, in compliance with Law 2/2023 of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible reprisals, individuals who, in a work or professional context, detect serious or very serious criminal or administrative breaches and report them through the mechanisms set out in this policy.

This Channel, therefore, is a mechanism that enables the company’s employees and other stakeholders to report any type of conduct that is illegal or contrary to our values and ethical principles, without fear of reprisals, thereby strengthening the culture of reporting, the integrity frameworks of organisations, and the promotion of a culture of reporting or communication as a mechanism for preventing and detecting threats to the public interest. In this way, we seek to promote a culture of transparency, integrity and accountability within our organisation, whilst protecting those employees who decide to make a report in good faith.

II. WHISTLEBLOWER CHANNEL

The organisation has established a whistleblower channel (hereinafter, the CII) as the preferred means of receiving information regarding acts or omissions that may constitute a serious or very serious criminal or administrative offence, and other actions provided for in Article 2 of Law 2/2023.

The channel is administered by the Head of the Internal Channel System (hereinafter, the RSII). Access to this channel shall be limited, within the scope of their powers and duties, to:

  1. The Head of the Internal Channel System.
  2. The administrator(s) delegated by the Head of the System.
  3. Managers designated to handle specific communications according to the relevant area.

The functions of these bodies, as appropriate, shall be:

  • Receiving, recording and managing communications received via the whistleblower channel.
  • Appointment of the person or team responsible for investigating the communications received.
  • Ensuring the protection of whistleblowers and the confidentiality of the reports received.
  • Assessing the veracity and credibility of the reports received.
  • Making decisions on the appropriate measures to be taken based on the results of the investigation.
  • Monitoring and periodically reviewing the communications management process and the company’s internal policy.
  • Preparing reports and recommendations for senior management on the communications received and the measures taken.

The CII must technically guarantee the confidentiality or, where appropriate, the anonymity of the whistleblower, in order to protect them against any leaks and subsequent reprisals to which they may be subjected.

III. SCOPE OF APPLICATION – WHISTLEBLOWERS

Any person who has an employment or professional relationship with TOMÁS GRACIA may use the internal reporting channel and benefit from the protection afforded by Law 2/2023 as a whistleblower, in order to report information regarding the acts or omissions described in Article 2 of Law 2/2023. This employment or professional relationship entails a relationship of dependency vis-à-vis the Independent Whistleblower Protection Authority (AAI), which makes special protection against possible reprisals necessary and appropriate.

In any event, for the purposes of Law 2/2023, the following are considered whistleblowers by this AAI:

  • Persons who are employees or workers in a subordinate position.
  • Self-employed collaborators (freelancers).
  • Shareholders, partners and persons belonging to the company’s administrative, management or supervisory body, including non-executive members.
  • Any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
  • Whistleblowers who publicly report or disclose information on breaches obtained in the context of an employment or statutory relationship that has already ended, volunteers, trainees and workers undergoing training, regardless of whether or not they receive remuneration, as well as those whose employment relationship has not yet commenced, in cases where the information on breaches was obtained during the recruitment process or pre-contractual negotiations.

It is important to note that reports made through the whistleblower channel must be made in good faith; that is, they must be supported by evidence and specific facts.

IV. SCOPE – REPORTABLE MATTERS

As regards the subject matter of the report, it follows from Law 2/2023 that the internal reporting channel may be used to report serious misconduct or alleged corruption which may constitute serious or very serious criminal or administrative offences relating to the organisation’s activities, which the whistleblower has observed or about which they have received information in the course of their work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such any information relating to:

  1. 1. Offences falling within the scope of the European Union acts listed in the annex to the aforementioned Directive relating to the following areas
    1. public procurement,
    2. services, products and financial markets, and the prevention of money laundering and terrorist financing,
    3. product safety and conformity,
    4. transport safety,
    5. environmental protection,
    6. radiation protection and nuclear safety,
    7. food and feed safety, animal health and animal welfare,
    8. public health,
    9. consumer protection,
    10. the protection of privacy and personal data, and the security of networks and information systems
  2. Which affect the financial interests of the European Union as set out in Article 325 of the Treaty on the Functioning of the European Union (TFEU).
  3. Which have an impact on the internal market, as set out in Article 26(2) of the TFEU, including infringements of European Union rules on competition and State aid, as well as infringements relating to the internal market in connection with acts that breach corporate tax rules or practices intended to obtain a tax advantage that undermines the object or purpose of the legislation applicable to corporate tax.
  4. Acts or omissions that may constitute a serious or very serious criminal or administrative offence. In any event, this shall be understood to include all serious or very serious criminal or administrative offences that result in financial loss to the Treasury and to the Social Security system.
  5. Breaches of labour law relating to health and safety at work reported by employees, without prejudice to the provisions of the relevant specific regulations.

The whistleblower must provide, as a minimum, a reference to the nature of the offence (subject matter or legislation breached: European Union law; criminal offence; or administrative offence); and a description of the facts being reported (relevant information about what occurred), in as much detail as possible, attaching any documentation they may have, where applicable.

Similarly, they may provide their full name and a contact telephone number, if they do not choose to make this report anonymously.

If you know the identity of the person responsible for the reported irregularity, or if you have already brought these facts to the attention of another body or organisation through an external channel, you may also provide this information.

V. REPORTING PROCEDURE

The information may be reported to the organisation anonymously. Otherwise, the identity of the whistleblower will be kept confidential and will be restricted to the knowledge of the RSII, managing directors or appointed managers. These members will carry out their duties independently and autonomously from the organisation’s other bodies and may not receive instructions of any kind in the performance of their duties, having at their disposal all the necessary human and material resources to carry them out.

The company undertakes to investigate all reports of possible infringements or breaches received via the internal reporting system. All reports will be investigated impartially and confidentially, and appropriate measures will be taken based on the results of the investigation to protect the whistleblower.

Information or reports shall be submitted via the internal reporting system using the dedicated online application, which can be found on the website: https://grupotomasgracia.com.

At the whistleblower’s request, the report may also be submitted in person at a meeting to be held within a maximum of seven days. Where applicable, the whistleblower will be advised that the meeting will be recorded and informed of how their data will be processed in accordance with the provisions of the GDPR and the LOPDPGDD. When submitting the information, the whistleblower must provide an address, email address or secure location for the purpose of receiving notifications, unless they expressly opt out of receiving any communication regarding actions taken by the RSII as a result of the information.

Once the information has been submitted, it will be recorded in the information management system by assigning an identification code. This will be stored in a secure database to which access is restricted exclusively to duly authorised RSII staff, and in which all communications received will be recorded with the following details:

  1. Date of receipt.
  2. Identification code.
  3. Actions taken.
  4. Measures taken.
  5. Date of closure.

Once the information has been received, within a period not exceeding 7 calendar days from such receipt, an acknowledgement of receipt will be sent to the informant, unless they have expressly opted out of receiving communications relating to the investigation. These communications will be processed within a maximum period of 3 months, except in cases of particular complexity requiring an extension of the deadline, in which case it may be extended for a further maximum of 3 months.

Once the information has been recorded, the RSII and their team will assess its admissibility in accordance with the material and personal scope set out in Articles 2 and 3 of Law 2/2023.

The company undertakes to inform the whistleblower of the status of the investigation and the measures taken, wherever possible and without compromising the whistleblower’s confidentiality and protection, and may request additional information regarding the facts reported through the channel.

Furthermore, the company undertakes to monitor all communications received and the measures taken to ensure the effectiveness of this policy and to continuously improve the process.

Any information shall be forwarded immediately to the Public Prosecutor’s Office where the facts may, on the face of it, constitute a criminal offence. Should the facts affect the financial interests of the European Union, the matter shall be referred to the European Public Prosecutor’s Office.

VI. PROTECTION OF WHISTLEBLOWERS

The company undertakes to protect individuals who report infringements or breaches, in accordance with Law 2/2023.

A. Acts constituting retaliation

Acts constituting retaliation, including threats of retaliation and attempts at retaliation against individuals who make a report in accordance with the provisions of the law, are expressly prohibited.

Retaliation is understood to mean any act or omission that is prohibited by law, or which, directly or indirectly, involves unfavourable treatment that places those subjected to it at a particular disadvantage compared with others in the workplace or professional context, solely because of their status as whistleblowers or because they have made a public disclosure.

For the purposes of Law 2/2023, and by way of example, the following are considered to constitute retaliation:

  1. Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including the non-renewal or early termination of a fixed-term employment contract once the probationary period has been completed, or early termination or cancellation of contracts for goods or services; the imposition of any disciplinary measure; demotion or refusal of promotion; and any other substantial change to working conditions; and the failure to convert a fixed-term employment contract into a permanent one, where the worker had legitimate expectations that they would be offered permanent employment; unless such measures were taken in the normal exercise of managerial authority under labour legislation or regulations governing the status of civil servants, on the basis of proven circumstances, facts or breaches, and unrelated to the submission of the communication.
  2. Damages, including reputational damage, or financial loss, coercion, intimidation, harassment or ostracism.
  3. Negative assessments or references regarding work or professional performance.
  4. Inclusion on blacklists or the dissemination of information within a specific sector, which hinders or prevents access to employment or the awarding of contracts for works or services.
  5. Refusal or revocation of a licence or permit.
  6. Denial of training.
  7. Discrimination, or unfavourable or unfair treatment.

Any person whose rights have been infringed as a result of their communication or disclosure, once the two-year period has elapsed, may request protection from the competent authority, which, in exceptional and justified circumstances, may extend the period of protection, following a hearing with the persons or bodies that may be affected. Any refusal to extend the period of protection must be justified.

Any administrative acts intended to prevent or hinder the submission of reports and disclosures, as well as those constituting retaliation or causing discrimination following the submission of such reports and disclosures under this Act, shall be null and void and shall give rise, where appropriate, to disciplinary or liability measures, which may include the payment of compensation for damages to the aggrieved party.

B. Measures to protect whistleblowers from reprisals

Persons who report information on the acts or omissions set out in Section FOUR, or who make a public disclosure in accordance with Act 2/2023, shall not be deemed to have breached any restriction on the disclosure of information and shall not incur liability of any kind in relation to such reporting or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to reveal an act or omission under that Act, without prejudice to the provisions of the specific protection rules applicable in the workplace. This measure shall not affect criminal liabilities.

The provisions of the preceding paragraph extend to the disclosure of information by workers’ representatives, even where they are subject to legal obligations of confidentiality or not to disclose confidential information. All of this is without prejudice, likewise, to the specific protection rules applicable in the workplace.

Measures to protect the whistleblower shall also apply, where appropriate, to:

  1. individuals who assist the whistleblower in the process;
  2. individuals who are connected to the whistleblower and who may suffer reprisals, such as the whistleblower’s colleagues or family members;
  3. legal entities for which the whistleblower works, with which they have any other type of relationship in an employment context, or in which they hold a significant interest.

For these purposes, a stake in the capital or in the voting rights attached to shares or holdings is deemed to be significant where, by virtue of its proportion, it enables the person holding it to exert influence over the legal entity in which the stake is held.

Whistleblowers shall not be held liable for the acquisition of or access to information that is communicated or disclosed publicly, provided that such acquisition or access does not constitute a criminal offence.

Any other potential liability of whistleblowers arising from acts or omissions not related to the communication or public disclosure, or which are not necessary to disclose an infringement under Act 2/2023, shall be enforceable in accordance with the applicable regulations.

In proceedings before a court or other authority concerning harm suffered by whistleblowers, once the whistleblower has reasonably demonstrated that they have communicated or made a public disclosure in accordance with Act 2/2023 and that they have suffered harm, it shall be presumed that the harm was caused as retaliation for reporting or for making a public disclosure. In such cases, it shall be for the person who took the prejudicial measure to prove that that measure was based on duly justified grounds unrelated to the report or public disclosure.

In legal proceedings, including those relating to defamation, copyright infringement, breach of confidentiality, infringement of data protection regulations, disclosure of trade secrets, or claims for compensation based on employment or statutory law, whistleblowers shall not incur liability of any kind as a result of communications or public disclosures protected by Act 2/2023. Such persons shall be entitled to raise, in their defence and within the framework of the aforementioned legal proceedings, the fact that they communicated or made a public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure was necessary to bring to light a breach under Act 2/2023.

The following persons are expressly excluded from the protection provided for by the Act: those who communicate or disclose:

  1. Information contained in communications that have been rejected by an internal reporting channel or for any of the reasons set out in the Act.
  2. Information relating to complaints about interpersonal conflicts or which affects only the whistleblower and the persons to whom the communication or disclosure refers.
  3. Information that is already fully available to the public or that constitutes mere rumours.
  4. Information relating to acts or omissions not falling within the scope of the Act.
C. Measures for the protection of the persons concerned

During the processing of the case, the persons affected by the report shall be entitled to the presumption of innocence, the right of defence and the right of access to the case file in accordance with the terms set out in Law 2/2023, as well as to the same protection established for whistleblowers, with their identity being protected and the confidentiality of the facts and details of the proceedings being guaranteed.

The Independent Whistleblower Protection Authority (A.A.I.) may, within the framework of the disciplinary proceedings it conducts, adopt provisional measures in accordance with the terms set out in Article 56 of Law 39/2015 of 1 October on the Common Administrative Procedure of Public Administrations.

D. Cases of exemption from or reduction of the penalty

Where a person who has participated in the commission of the administrative offence that is the subject of the report is the same person who reports its existence by submitting the information, and provided that such information was submitted prior to notification of the initiation of the investigation or disciplinary proceedings, the body competent to decide the case may, by means of a reasoned decision, exempt that person from the administrative penalty that would otherwise apply, provided that the following points are substantiated in the case file:

  1. That they had ceased to commit the offence at the time of submitting the report or disclosure and, where applicable, had identified the other persons who had participated in or facilitated it.
  2. To have cooperated fully, continuously and diligently throughout the entire investigation.
  3. You have provided truthful and relevant information, evidence or significant data to substantiate the facts under investigation, without having destroyed or concealed such information or disclosed its content to third parties, either directly or indirectly.
  4. To have made good the damage caused for which they are responsible.

Where these requirements are not met in full, including in the case of partial redress of the damage, it shall be at the discretion of the competent authority – following an assessment of the extent of the contribution to the resolution of the case – to reduce the penalty that would otherwise have been imposed for the offence committed, provided that the informant or the person making the disclosure has not previously been penalised for acts of the same nature that gave rise to the initiation of the proceedings.

The reduction in the penalty may be extended to the other participants in the commission of the infringement, depending on the degree of active cooperation in clarifying the facts, identifying other participants and remedying or mitigating the damage caused, as assessed by the body responsible for the decision.

Act 2/2023 excludes from the provisions of this paragraph the infringements set out in Act 15/2007 of 3 July on the Defence of Competition.

VII. CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data shall be carried out in compliance with Act 2/2023 of 20 February, regulating the protection of persons reporting regulatory infringements and combating corruption, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights, and Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of preventing, detecting, investigating and prosecuting criminal offences and enforcing criminal sanctions.

The personal data being processed, the documents provided and any other information contained in the report that includes personal information will be treated confidentially by those responsible for the channel, as well as by the administrators and any other managers, for the purpose of fulfilling the obligation to investigate and manage the report submitted, as well as to comply with the legal obligations set out in Act 2/2023 of 20 February, regulating the protection of persons reporting regulatory breaches and combating corruption.

The internal reporting system must prevent unauthorised access, protect the identity of, and ensure the confidentiality of, the data relating to the persons concerned and any third parties mentioned in the information provided, in particular the identity of the whistleblower should they have identified themselves. The identity of the whistleblower may only be disclosed to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation, and such cases shall be subject to the safeguards laid down in the applicable legislation.

If the information received contains special categories of personal data, which are subject to special protection, it shall be deleted immediately, unless the processing is necessary for reasons of substantial public interest in accordance with Article 9(2)(g) of the GDPR, as provided for in Article 30(5) of Law 2/2023.

In any event, no personal data will be collected unless its relevance to the processing of specific information is clear; if such data is collected accidentally, it will be deleted without undue delay.

Communications that have not been acted upon may only be retained in anonymised form, and the obligation to block data provided for in Article 32 of the LOPDPGDD shall not apply.

Access to personal data contained in the internal information system shall be restricted to:

  1. The Head of the Channel’s Internal System.
  2. The administrator(s) delegated by the person responsible for the system.
  3. The managers designated to process specific communications according to the relevant area.
  4. The data may be disclosed to the Legal Department, solicitors, judicial bodies and the State’s law enforcement agencies should any of the information received be deemed to constitute a criminal offence or a legal infringement of any kind.

Legal basis for processing: The processing of personal data, in the case of internal communications, shall be deemed lawful pursuant to the provisions of Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Article 8 of Organic Law 3/2018 of 5 December, and Article 11 of Organic Law 7/2021 of 26 May, where, in accordance with Articles 10 and 13 of that law, it is mandatory to have an internal information system in place. Where this is not mandatory, the processing shall be presumed to be covered by Article 6(1)(e) of the aforementioned Regulation. The processing of personal data in cases involving external communication channels shall be deemed lawful by virtue of the provisions of Article 6(1)(c) of Regulation (EU) 2016/679, Article 8 of Organic Law 3/2018 of 5 December, and Article 11 of Organic Law 7/2021 of 26 May.

Rights of the data subject: access, rectification, erasure, restriction, data portability and objection, free of charge, by email to: rosaduran@grupotomasgracia.com in the cases provided for by law.

Retention: The data will be retained for the period established by law for the processing of the case and for as long as necessary to bring legal proceedings or, if necessary, to provide evidence of the management of the channel. The data subject also has the right to lodge a complaint with the AEPD at www.aepd.es to request the protection of their rights.

VIII. COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will carry out regular training sessions and awareness-raising campaigns to foster a culture of integrity and transparency, and to inform employees and other stakeholders about the internal reporting system. It will also provide information on the rights and protections afforded to whistleblowers under Act 2/2023.

The company undertakes to disseminate this policy to all employees and stakeholders, and will update this internal reporting policy at least every three years and, where appropriate, amend it, taking into account the experience gained and the recommendations of the Competent Authority (AAI).

Sitges, 2 October 2026