Whistleblower channel

INTRODUCTION, PURPOSE AND APPLICATION

Law 2/2023, of February 20, regulating the protection of persons who report on regulatory infringements and the fight against corruption (hereinafter, Law 2/2023) transposes into the Spanish legal system Directive 2019/1937 of the European Parliament and of the Council, of October 23, 2019, on the protection of persons who report breaches of Union law.

This policy applies to Tomás Gracia, SA with Tax ID A08428906 and registered office at Passeig de Vilanova, 7, 08870, Sitges (Barcelona) and aims to establish an internal channel for the communication of possible regulatory infringements, breach of internal and/or ethical policies and establish a protection regime for the informant, in compliance with Law 2/2023, of February 20, regulating the protection of persons who report on regulatory infringements and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible retaliation, persons who, in a work or professional context, detect serious or very serious criminal or administrative offenses and communicate them through the mechanisms regulated in this policy.

This Channel, therefore, is a mechanism that allows the company’s employees, and other stakeholders, to communicate any type of illegal conduct or conduct contrary to our values and ethical principles, without fear of retaliation, strengthening the culture of information, the integrity infrastructures of organizations and the promotion of the culture of information or communication as a mechanism to prevent and detect threats to the public interest. In this way, it seeks to promote a culture of transparency, integrity and responsibility in our organization, while protecting those employees who decide to make a communication in good faith.

WHISTLEBLOWER CHANNEL

A whistleblower channel (hereinafter, the CII) has been created by the entity as the preferred channel for receiving information on actions or omissions that may constitute a serious or very serious criminal or administrative offense, and other actions provided for in Article 2 of Law 2/2023. The channel is under the administration of the Person Responsible for the Internal System of the Channel (hereinafter, the RSII). Access to this channel will be limited, within the scope of their powers and functions to:

  1. The Person Responsible for the Internal System of the Channel.
  2. The administrator(s) delegated by the person responsible for the system.
  3. Managers designated for the processing of certain communications according to the scope to which they correspond.

The functions of these bodies, as appropriate, will be:

  • Reception, registration and management of communications received through the whistleblower channel.
  • Designation of the person or team in charge of investigating the communications received.
  • Ensuring the protection of informants and the confidentiality of communications received.
  • Assessment of the truthfulness and credibility of communications received.
  • Decision-making on appropriate measures based on the results of the investigation.
  • Monitoring and periodic review of the communication management process and the internal policy of the company.
  • Preparation of reports and recommendations for senior management on the communications received and the measures adopted.

The CII must technically guarantee the confidentiality or, eventually, the anonymity of the informant, to protect them against any leak and subsequent retaliation of which they may be subject. Informants within the scope of the law can make their communications through the following means:

SUBJECTIVE SCOPE – INFORMING SUBJECTS

The internal information channel can be used and benefit from the protection granted by Law 2/2023 as informants by those persons who have a labor or professional relationship with the AEPD, to communicate information about the actions or omissions described in Article 2 of Law 2/2023. This labor or professional relationship, which entails a dependency on the AEPD, is what makes special protection against possible retaliation necessary and appropriate.

In any case, for the purposes of Law 2/2023, informants for this AEPD are considered to be:

  • Persons who have the status of employees or wage earners.
  • Collaborating self-employed (freelance).
  • Shareholders, participants and persons belonging to the administrative, management or supervisory body of the company, including non-executive members.
  • Any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
  • Informants who communicate or publicly disclose information about infractions obtained in the framework of a labor or statutory relationship already ended, volunteers, interns, workers in training periods regardless of whether they receive remuneration or not, as well as those whose labor relationship has not yet started, in cases where the information about infractions has been obtained during the selection or pre-contractual negotiation process.

It is important to highlight that communications made through the whistleblower channel must be in good faith, that is, they must be supported by evidence and concrete facts.

OBJECTIVE SCOPE – FACTS SUBJECT TO COMMUNICATION

Regarding the object of the information, it follows from Law 2/2023 that the internal information channel can be used to report serious misconduct or alleged corruption, which may constitute serious or very serious criminal or administrative offenses related to the activities of the entity, which the informant has observed or about which they have received information in the course of their work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such, information referring to:

1) Infringements that fall within the scope of application of the acts of the European Union listed in the annex to the aforementioned Directive relating to the following areas:

  • public procurement,
  • financial services, products and markets, and prevention of money laundering and terrorist financing,
  • product safety and compliance,
  • transport safety,
  • environmental protection,
  • radiation protection and nuclear safety,
  • food and feed safety, animal health and animal welfare,
  • public health,
  • consumer protection,
  • protection of privacy and personal data, and security of network and information systems.

2) Affecting the financial interests of the European Union as provided for in Article 325 of the Treaty on the Functioning of the European Union (TFEU).

3) Affecting the internal market, as provided for in Article 26(2) of the TFEU, including infringements of European Union rules on competition and State aid, as well as infringements relating to the internal market in relation to acts that infringe corporate tax rules or practices whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax legislation.

4) Actions or omissions that may constitute a serious or very serious criminal or administrative offense. In any case, all those serious or very serious criminal or administrative offenses that involve economic loss for the Public Treasury and for the Social Security shall be understood to be included.

5) Infringements of labor law in matters of occupational safety and health reported by workers, without prejudice to the provisions of their specific regulations.

The informant must provide at least the reference to the subjective scope of the infringement (matter or regulation infringed: European Union Law; criminal infringement; or administrative infringement); and a description of the facts subject to communication (relevant information about what happened), as detailed as possible, attaching the documentation they may have, if applicable. In the same way, they can provide their name and surname, and a contact telephone number, if they do not choose to make this communication anonymously. If they know the identity of the person responsible for the reported irregularity, or have brought these facts to the attention of another body or entity through an external channel, they may also provide this information.

COMMUNICATION PROCEDURE

Information can be communicated to the entity anonymously. Otherwise, the identity of the informant will be kept confidential and will be limited to the knowledge of the RSII, delegated administrators or appointed managers. These members will perform their functions independently and autonomously from the rest of the entity’s bodies and may not receive instructions of any kind in their exercise, having all the personal and material means necessary to carry them out.

The company is committed to investigating all communications made regarding possible infractions or non-compliance received through the whistleblower channel. All communications will be investigated impartially and confidentially and appropriate measures will be taken based on the results of the investigation aimed at protecting the informant.

Communication will be made through the internal information channel using the specific electronic application for this purpose, identified and accessible from the website: https://grupotomasgracia.com

At the request of the informant, the communication may also be presented through a face-to-face meeting that will take place within a maximum period of seven days. Where appropriate, the informant will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of the GDPR and the LOPDPGDD. When presenting the information, the informant must indicate an address, email, or safe place for the purpose of receiving notifications, unless they expressly waive the receipt of any communication of actions carried out by the RSII as a result of the information.

Once the information has been presented, it will be recorded in the information management system by assigning an identification code, which will be contained in a secure database with restricted access exclusively to RSII personnel, conveniently authorized, in which all communications received will be recorded with the following data:

  • Date of receipt
  • Identification code
  • Actions developed
  • Measures adopted
  • Closing date

Upon receipt of the information, within a period not exceeding 7 calendar days from said receipt, receipt will be acknowledged to the informant, unless they have expressly waived receiving communications relating to the investigation. These communications will be managed within a maximum period of 3 months except in cases of special complexity requiring an extension of the period, in which case it may be extended up to a maximum of another 3 additional months.

Once the information is registered, the RSII and its team will proceed to analyze the admissibility according to the material and personal scope provided for in Articles 2 and 3 of Law 2/2023. The company is committed to notifying the informant about the status of the investigation and the measures adopted, whenever possible and without compromising the confidentiality and protection of the informant. In addition, additional information may be requested regarding the facts communicated through the channel. Furthermore, the company is committed to monitoring all communications received and measures adopted to ensure the effectiveness of this policy and continuously improve the process.

Any information will be sent to the Public Prosecutor’s Office immediately when the facts could indicatively constitute a crime. In the event that the facts affect the financial interests of the European Union, they will be sent to the European Public Prosecutor’s Office.

PROTECTION OF INFORMANTS

The company is committed to protecting persons who report infractions or non-compliance, in accordance with Law 2/2023.

A) Acts constituting retaliation.

Acts constituting retaliation, including threats of retaliation and attempts of retaliation against persons who present a communication in accordance with the provisions of the law, are expressly prohibited.

Retaliation is understood as any act or omission that is prohibited by law, or that, directly or indirectly, involves unfavorable treatment that places the persons who suffer it at a particular disadvantage with respect to another in the work or professional context, only because of their status as informants, or for having made a public disclosure.

For the purposes of the provisions of Law 2/2023, and by way of illustration, retaliation is considered to be that adopted in the form of:

  • Suspension of the employment contract, dismissal or termination of the labor or statutory relationship, including the non-renewal or early termination of a temporary employment contract once the probationary period has passed, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotions and any other substantial modification of working conditions and the non-conversion of a temporary employment contract into an indefinite one, in the event that the worker had legitimate expectations that they would be offered indefinite work; unless these measures were carried out within the regular exercise of management power under labor legislation or regulation of the status of the corresponding public employee, due to documented circumstances, facts or infractions, and unrelated to the presentation of the communication.
  • Damages, including those of a reputational nature, or economic losses, coercion, intimidation, harassment or ostracism.
  • Negative evaluation or references regarding labor or professional performance.
  • Inclusion in blacklists or dissemination of information in a certain sector scope, which makes access to employment or the contracting of works or services difficult or prevents it.
  • Denial or cancellation of a license or permit.
  • Denial of training.
  • Discrimination, or unfavorable or unfair treatment.

A person who sees their rights harmed due to their communication or disclosure after the two-year period has elapsed may request protection from the competent authority which, exceptionally and in a justified manner, may extend the protection period, after hearing the persons or bodies that could be affected. The denial of the extension of the protection period must be motivated.

Administrative acts aimed at preventing or hindering the presentation of communications and disclosures, as well as those that constitute retaliation or cause discrimination after their presentation under this law, shall be null and void and shall give rise, where appropriate, to disciplinary corrective measures or liability, which may include corresponding compensation for damages to the injured party.

B) Measures for the protection of the informant against retaliation

Persons who communicate information on the actions or omissions included in section FOURTH, or who make a public disclosure in accordance with Law 2/2023, shall not be considered to have infringed any restriction on disclosure of information and shall not incur liability of any kind in relation to said communication or public disclosure, provided they had reasonable grounds to believe that the communication or public disclosure of said information was necessary to reveal an action or omission under said law, all without prejudice to the provisions of the specific protection rules applicable in the labor field. This measure shall not affect criminal liabilities.

The provisions of the preceding paragraph extend to the communication of information made by workers’ representatives, even if they are subject to legal obligations of secrecy or not to disclose reserved information. All this without prejudice, likewise, to the specific protection rules applicable in the labor field.

Informant protection measures will also apply, where appropriate, to:

  • Natural persons who assist the informant in the process
  • Natural persons who are related to the informant and who may suffer retaliation, such as co-workers or relatives of the informant
  • Legal entities for which they work or with which they maintain any other type of relationship in a work context or in which they hold a significant stake.

For these purposes, it is understood that participation in the capital or in the voting rights corresponding to shares or stakes is significant when, by its proportion, it allows the person who possesses it to have the capacity to influence the participated legal entity.

Informants shall not incur liability regarding the acquisition or access to information that is communicated or publicly disclosed, provided that such acquisition or access does not constitute a crime.

Any other possible liability of informants derived from acts or omissions that are not related to the communication or public disclosure, or that are not necessary to reveal an infringement under Law 2/2023, will be enforceable according to applicable regulations.

In proceedings before a court or other authority, relating to the damages suffered by informants, once the informant has reasonably demonstrated that they have communicated or made a public disclosure in accordance with Law 2/2023 and that they have suffered damage, it will be presumed that the damage occurred as retaliation for reporting or for making a public disclosure. In such cases, it will be up to the person who has taken the harmful measure to prove that the measure was based on duly justified grounds not linked to the communication or public disclosure.

In legal proceedings, including those relating to defamation, copyright infringement, breach of secrecy, infringement of data protection rules, disclosure of business secrets, or requests for compensation based on labor or statutory law, informants shall not incur liability of any kind as a result of communications or public disclosures protected by Law 2/2023. Said persons shall have the right to allege in their defense and in the framework of the aforementioned legal proceedings, having communicated or having made a public disclosure, provided they had reasonable grounds to believe that the communication or public disclosure was necessary to highlight an infringement under Law 2/2023.

The protection provided for in the law expressly excludes those persons who communicate or disclose:

  • Information contained in communications that have been rejected by an internal information channel or for any of the reasons provided for in the law.
  • Information linked to claims about interpersonal conflicts or that only affects the informant and the persons referred to in the communication or disclosure.
  • Information that is already fully available to the public or that constitutes mere rumors.
  • Information referring to actions or omissions not included in the scope of the law.

C) Measures for the protection of affected persons

During the processing of the file, the persons affected by the communication shall have the right to the presumption of innocence, the right of defense and the right of access to the file under the terms provided for in Law 2/2023, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure. The Independent Whistleblower Protection Authority, A.A.I., may, in the framework of the sanctioning procedures it instructs, adopt provisional measures under the terms established in Article 56 of Law 39/2015, of October 1, of the Common Administrative Procedure of Public Administrations.

D) Cases of exemption and mitigation of the sanction

When a person who has participated in the commission of the administrative offense subject to the information is the one who reports its existence through the presentation of the information and provided that it was presented prior to the notification of the initiation of the investigation or sanctioning procedure, the body competent to resolve the procedure, through a motivated resolution, may exempt them from compliance with the administrative sanction that corresponds to them provided that the following points are proven in the file:

  • Having ceased the commission of the infringement at the time of presentation of the communication or disclosure and having identified, where appropriate, the rest of the persons who have participated in or favored it.
  • Having cooperated fully, continuously and diligently throughout the entire investigation procedure.
  • Having provided truthful and relevant information, means of proof or significant data for the accreditation of the investigated facts, without having proceeded to their destruction or concealment, nor having disclosed their content to third parties, directly or indirectly.
  • Having proceeded to repair the damage caused that is attributable to them.

When these requirements are not fully met, including partial repair of the damage, it will be at the discretion of the competent authority, after assessing the degree of contribution to the resolution of the file, the possibility of mitigating the sanction that would have corresponded to the offense committed, provided that the informant or author of the disclosure has not been previously sanctioned for acts of the same nature that gave rise to the start of the procedure.

The mitigation of the sanction may be extended to the rest of the participants in the commission of the offense, based on the degree of active collaboration in clarifying the facts, identifying other participants and repairing or lessening the damage caused, as assessed by the body in charge of the resolution.

Law 2/2023 excludes from the provisions of this section the infractions established in Law 15/2007, of July 3, on the Defense of Competition.

CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data will be carried out ensuring compliance with Law 2/2023, of February 20, regulating the protection of persons who report on regulatory infringements and the fight against corruption, Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights and Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and execution of criminal sanctions.

The personal data subject to processing, the documents provided and any other information provided in the communication containing personal information, will be treated confidentially by the channel managers, as well as by the administrators and possible managers, for the purpose of complying with the obligation to investigate and manage the communication presented as well as to comply with the legal obligations established in Law 2/2023, of February 20, regulating the protection of persons who report on regulatory infringements and the fight against corruption.

The internal information system must prevent unauthorized access and preserve the identity and guarantee the confidentiality of data corresponding to the affected persons and any third party mentioned in the information provided, especially the identity of the informant if identified. The identity of the informant may only be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the framework of a criminal, disciplinary or sanctioning investigation, and these cases will be subject to safeguards established in applicable regulations.

If the information received contains special categories of personal data, subject to special protection, it will be immediately deleted, unless processing is necessary for reasons of essential public interest as provided for in Article 9.2.g) of the GDPR, according to Article 30.5 of Law 2/2023.

In any case, personal data whose relevance is not manifest to process specific information will not be collected or, if collected by accident, will be deleted without undue delay.

Communications that have not been acted upon may only exist in an anonymized form, without the blocking obligation provided for in Article 32 of the LOPDPGDD being applicable.

Access to personal data contained in the internal information system will be limited to:

  • The Person Responsible for the Internal System of the Channel.
  • The administrator(s) delegated by the person responsible for the system.
  • Managers designated for the processing of certain communications according to the scope to which they correspond.
  • Data may be brought to the attention of the Legal Department, Lawyers, Judicial Bodies and State Security Forces and Corps in the event that any of the information received were susceptible to being considered a crime or legal infraction of any kind.

Legal basis for processing: The processing of personal data, in cases of internal communication, shall be considered lawful under the provisions of Articles 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, 8 of Organic Law 3/2018, of December 5, and 11 of Organic Law 7/2021, of May 26, when, in accordance with the provisions of Articles 10 and 13 of the law, it is mandatory to have an internal information system. If it were not mandatory, the processing shall be presumed to be covered by Article 6.1.e) of the aforementioned regulation. The processing of personal data in cases of external communication channels shall be considered lawful under the provisions of Articles 6.1.c) of Regulation (EU) 2016/679, 8 of Organic Law 3/2018, of December 5, and 11 of Organic Law 7/2021, of May 26.

Rights of the data subject: access, rectification, deletion, limitation, portability and opposition, free of charge by email to: rosaduran@grupotomasgracia.com in legally provided cases.

Storage: Data will be kept for the legal term established for the processing of the file and for the time necessary for the exercise of legal actions or if it were necessary to leave evidence of the management of the channel. The data subject also has the right to file a claim with the AEPD at www.aepd.es to request the protection of their rights.

COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will carry out periodic training and awareness campaigns to promote a culture of integrity and transparency, and to inform employees and other stakeholders about the whistleblower channel. It will also provide information on the rights and protections offered to informants under Law 2/2023.

The company is committed to disseminating this policy to all employees and stakeholders, and will update, at least every three years and, where appropriate, modify this internal channel policy, taking into account the experience gained and the recommendations of the Competent Authority.

In Sitges on June 15, 2026