IMPORTANT INFORMATION ABOUT THE DOCUMENT

Name of the document:	Ethical Channel Operating Policy
Author:	System Manager
Responsible for compliance:	System Manager
Approval body:	Governing Body (Sole Administrator)
Date of approval of the current version:	October 2023

VERSION AND MODIFICATION HISTORY

Version:	Date:	Author:	Approval Body:	Summary of changes:
V.1	October 2023	System Manager	Administrative Body	New Policy

1.   PURPOSE AND OBJECT

The purpose of this Policy of Operation of the Ethical Channel (hereinafter, the « Policy« ), is to define and establish a suitable and effective model of operation of the Internal Information System (hereinafter, the « Ethical Channel« ) of COMERBAL, S.A. (hereinafter, « NOVAVENDA », or the « Company », indistinctly), adapted to the regulations in this area (DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons who report breaches of Union law (hereinafter, « Whistleblower Directive« ) and Law 2/2023, of 20 February, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, « Whistleblower Protection Act« ), as well as to the highest national and international standards in force (UNE-ISO 37002:2021 on Whistleblowing Management Systems. Guidelines), allowing to receive and process:

• On the one hand, communications related to non-compliance and/or practices contrary to the principles established in NOVAVENDA’s Policies and Protocols, as well as in the internal rules and procedures that develop them and in the other rules imposed by the regulatory framework of the organization and/or,

• On the other hand, actions or omissions that may constitute infringements of European Union law or serious or very serious criminal or administrative infringements of Spanish national law.

The present Policy establishes the procedure that regulates the operation of NOVAVENDA’s Ethical Channel, in such a way that it includes the issues related to the realization of communications by the informants, as well as the management and resolution of the same by the person in charge of the System.

The purpose of this Policy is to guarantee a professional, confidential, impartial and maximum protection of the rights of the interested parties (including the rights recognized in the personal data protection regulations) during the whole process of realization, management, processing, investigation and resolution of the communications made through NOVAVENDA’s Ethical Channel.

In this regard, this Policy establishes three basic guarantees:

1. guarantee of protection for informants;
2. guarantee of freedom from reprisals to the informants and
3. guarantee of the rights of the denounced party during the management and processing of communications.

2.   SCOPE

This Policy applies to all members of NOVAVENDA (including both workers and managers, as well as shareholders and members of the Administrative Body, regardless of the position or position they hold within the organization, the legal nature of their relationship and whatever their area of activity or hierarchical level), who have knowledge, in a work or professional context, of any infringement established in paragraph 1 of this Policy.

Likewise, what is established in this Policy will also be extensive to third parties such as: business partners, collaborating companies, subcontractors, suppliers and other persons or entities that have a professional relationship with NOVAVENDA.

3.   ETHICAL CHANNEL PRINCIPLES

3.1.       CONFIDENTIALITY

NOVAVENDA guarantees the maximum confidentiality of the communications received through its Ethical Channel and the data contained in them.

The identity of the person who reports an irregularity through the Ethics Channel will be considered confidential information and, therefore, will not be communicated to the reported person. In the same way, the identity of the reported person will be kept confidential.

Likewise, it is expressly forbidden for the personal data contained in the communication and resulting from the research carried out to be known by any person other than those expressly authorized. In this sense, specific confidentiality commitments will be signed with the persons in charge of the management of the same.

Without prejudice to the foregoing, the data of the person making the communication may be provided to the administrative or judicial authorities or to the Public Prosecutor’s Office, to the extent that they are required by such authorities as a result of any criminal, disciplinary or sanctioning proceedings arising from the subject matter of the communication.

Such transfer of data will always be made in full compliance with the legislation on protection of personal data, requiring that in any case prevent access by third parties to it.

When the communication is sent through reporting channels other than those established in this Policy or to members not responsible for their treatment or to non-competent personnel, there will be an obligation on the part of the recipient of the communication to immediately forward it to the System Manager, guaranteeing at all times the confidentiality of the same. Failure to comply with this obligation will be classified as a very serious breach, so NOVAVENDA may take disciplinary measures as appropriate.

3.2.       INDEPENDENCE

The procedures for processing, investigation and resolution and, in general, management of communications received through NOVAVENDA’s Ethical Channel will be governed by the maximum objectivity and independence, establishing in this Policy, the corresponding mechanisms in order to avoid the concurrence of possible conflicts of interest.

3.3.       GOOD FAITH

All communications submitted through the Ethics Channel must be made in good faith. This means that, at the time of submission of the communication, the reporting person must have reasonable and sufficient grounds to believe that the information provided is true, truthful and contains possible violations.

In this sense, false or malicious communications or complaints may result in the corresponding sanctions by NOVAVENDA, without prejudice to the civil and even criminal liabilities that may arise.

3.4.       PROHIBITION OF RETALIATION

NOVAVENDA undertakes not to adopt any form of retaliation, threats of retaliation or attempts of retaliation, direct or indirect, against persons who, in good faith, have communicated through the Ethical Channel any irregularity.

Retaliation should be understood as any act or omission that is prohibited by law, or that, directly or indirectly, entails unfavorable treatment that places the persons who suffer it at a particular disadvantage with respect to another in the labor or professional context, solely because of their status as whistleblowers.

Protection against retaliation also extends to persons who report possible violations through the external reporting channels mentioned in section 6 of this Policy.

In addition to whistleblowers, the prohibition against retaliation set forth in the Policy also extends to the following persons:

1. natural persons who, within the framework of the organization in which the reporting person provides services, assist the reporting person in the process;

• natural persons who are related to the reporting person and who may suffer retaliation, such as coworkers or relatives of the reporting person, and

• legal persons, for which the reporting person works or with which it maintains any other type of relationship in an employment context or in which it holds a significant shareholding. For these purposes, it is understood that the participation in the capital or in the voting rights corresponding to shares or participations is significant when, due to its proportion, it allows the person who holds it to have the capacity to influence the legal person in which he/she participates.

In the event that any member of NOVAVENDA, in contravention of the provisions of this Policy, take direct or indirect retaliation, it will be the organization itself who will take the necessary measures to cease retaliation as soon as possible and, where appropriate, take disciplinary action as appropriate against those responsible for them.

Likewise, through this Policy, the rights to privacy, to be heard, to be informed of the actions or omissions attributed to him/her, to defense, to honor and to the presumption of innocence of the persons under investigation, as well as the right to access the file will also be guaranteed.

4.   OPERATION OF THE ETHICAL CHANNEL

4.1.       SUBMISSION OF COMMUNICATIONS

4.1.1.    AVAILABLE CHANNELS

The reporting persons may make the communications through the channels provided for this purpose.

In this sense, NOVAVENDA makes available the following channels to carry out the communications included in this Policy:

• E-mail address: canaletic@comerbal.com
• By accessing the channel provided for this purpose on the corporate website (https://novavenda.com/). 
• By ordinary mail to the following address: Pla de la Seva 19-21, postal code 17458, Fornells de la Selva (Girona) (For the exclusive attention of the person in charge of the System).

At the request of the reporting person, the communication may also be submitted through a face-to-face meeting with the System Manager, which, if applicable, must be held within a maximum of seven (7) days from the request.

4.1.2.    COMMUNICATION INFORMATION

The communication shall contain the following information:

• Identity of the informant (names, surnames and ID number). Except in cases of anonymous communications. In this sense, NOVAVENDA’s Ethical channel allows communications to be carried out anonymously, without providing the identity of the informant.

• Relationship with NOVAVENDA (employee, supplier, shareholder, subcontractor, intern, etc.) and, if applicable, position in NOVAVENDA.

• A description as detailed and complete as possible of the conduct, event or alleged irregularity being reported.

• Identity of the person reported (name, surname and position), if known, the person responsible for the event and the area in which the reported event occurred.

• Indications, explanatory explanations or evidence on which the information is based. All available evidence should be provided or indicate where and how to obtain it (e.g. witnesses, documents, records, etc.).

• Approximate dates of occurrence of the events.

• If applicable, means of communication (address, e-mail, telephone or other) of the informant so that the person in charge of the System can send notifications or communications.  

If, after evaluating the content of the communication, it lacks the minimum requirements that are mandatory for its correct assessment, the System Manager will proceed to request the corresponding information and/or documentation from the informant through the means of communication indicated by the latter, proceeding to file the communication, if the necessary information is not available for the opening of the investigation phase.

4.2.       COMMUNICATIONS MANAGEMENT AND RESOLUTION

4.2.1.    RESPONSIBLE FOR THE SYSTEM

The Administrative Body of COMERBAL, S.A. is the competent body for the appointment, as well as removal or dismissal, of the System Manager, who, in turn, is responsible for the management and processing of communications entering through NOVAVENDA’s Ethical Channel.

The person in charge of the system may be a natural person or a collegiate body that must delegate to one of its members (natural person) the powers of management and processing of research files.

Both the appointment and the dismissal of the System Manager shall be notified to the Independent Authority for the Protection of the Informant (IAIP) or, as the case may be, to the competent authorities or bodies of the autonomous communities.

In this sense, the Administrative Body of COMERBAL, S.A. has designated a natural person as System Manager to carry out the powers of management and processing of communications of the Ethical Channel.

The System Manager shall act independently from the rest of the functions and hierarchical or functional subordination that, if any, may exist, performing the necessary tasks under the premises of confidentiality, respect, independence, neutrality, impartiality, honesty and objectivity towards the persons affected by the communication in question, also ensuring that the procedure is carried out in accordance with the procedures and principles set forth in this Policy.

In the event that the Person Responsible for the System has incompatibility or conflict of interest with the event or persons who are the object of the communication, he/she shall abstain from participating in the management and processing of the communication and shall not, therefore, have access to the information derived from the actions carried out in the management of the same. In this respect, the person in charge of the System shall be replaced by another person designated and appointed by the Director General or, as the case may be, the Administrative Body or other competent body.  

• Responsibilities of the System Manager

The main competences of the System Manager in the field of management of NOVAVENDA’s Ethical Channel are the following:

• Manage the Ethical Channel tool.
• Receive communications made through the Ethics Channel.
• Analyze the content of the communications received and decide on their admissibility.
• Determine the desirability or necessity of taking immediate action to prevent (stop or mitigate) further damage.
• In the case of nominative complaints (or, if initially anonymous, from the moment when, where appropriate, the reporting person communicates his/her identity), it shall notify the reporting person of the receipt of the complaint (sending of acknowledgement of receipt), unless this could jeopardize the confidentiality of the communication.
• Ensure that appropriate measures are taken to prevent and avoid possible retaliation against the complainant.
• Conduct the investigation/investigation of the facts internally in accordance with the rules and principles set forth in this Policy (or decide on the appropriateness of its investigation through an external expert manager).
• To make a report on the result of the investigation carried out, stating whether the facts reported are accredited and to propose the appropriate measures for the resolution of the event, as well as, if applicable, the disciplinary measures to be taken, always being able to delegate this power to another competent body.
• Communicate to the persons concerned (including the reporting person) the completion of the procedure.
• Extend the resolution period for reasons of complexity.
• To resolve any doubts and queries that may arise in connection with the Channel.
• Maintain the Complaints Book-Register up to date.
• Ensure that the necessary security is in place for the Communications Information Management System, including restricting access to it. 
• Manage the storage of communication information in the Communication Information Management System.

The System Manager shall perform these functions and competencies independently and autonomously from the rest of the organization’s bodies.

For the performance of the above functions and competences, and in those cases in which it is deemed necessary, the System Manager may be assisted by an external consultant or even delegate some of the above functions to the latter. In this regard, the System Manager shall obtain a confidentiality agreement from the external collaborators involved in the management and resolution of the communication. In the same way, he/she shall obtain it from the internal collaborators when deemed necessary.

4.2.2.    RECEPTION AND EVALUATION

Once a communication has been received through the Ethical Channel, the System Manager will proceed to register it in a Communications Book-Register, assigning an identification code to the communication.

The Book-Register of communications is contained in a secure database (Information Management System) with access restricted exclusively to authorized persons, and it will record all communications and information received through the Ethical Channel and during the processing of the same.

The following data shall be recorded in each of the records of the communications recorded in the Communications Book-Register:

• Date received.
• Identification code.
• Actions carried out.
• Actions taken.
• Closing date.

The Book-Register shall not be public and only at the reasoned request of the competent judicial authority, by means of an order, and within the framework of a judicial proceeding and under the guardianship of such authority, may its contents be totally or partially accessed.

Once the communication is received, within a maximum of seven (7) calendar days following its receipt, the System Manager shall send an acknowledgement of receipt of the communication to the reporting person, unless the communication is anonymous; the reporting person has waived the right to receive communications related to the investigation or; this could jeopardize the confidentiality of the communication.

If the reporting person accepts it, the possibility for the System Manager to maintain the communication is expressly provided for.

The System Manager will check the content of the communication. If documentation is missing or is defective in any way, he/she will request information from the informant. Likewise, the person in charge, if he/she deems it necessary, may request additional information from the informant regarding the communication made.

The System Administrator shall verify whether the communication sets forth facts or conduct that fall within the scope of this Policy and, therefore, whether the communication is admissible.

Once this preliminary analysis has been carried out, the System Manager, within a period that may not exceed ten (10) working days from the date of entry of the information of the communication in the Book-Register, shall:

1. Admit the communication for processing.

• Inadmit the communication, in any of the following cases:

1. When the facts reported lack any verisimilitude.

• When the facts reported do not constitute a violation of the provisions of this Policy.

• When the communication is manifestly unfounded or there are, in the opinion of the System Manager, reasonable indications that it was obtained through the commission of a crime.

In the latter case, in addition to the inadmissibility, a detailed account of the facts deemed to constitute a crime shall be sent to the Public Prosecutor’s Office.

• When the communication does not contain significant new information on infringements in comparison with a previous communication in respect of which the corresponding procedures have been concluded, unless there are new factual or legal circumstances that justify a different follow-up.

In these cases, the System Manager will notify the resolution to the informant in a reasoned manner.

Likewise, communications in which the facts described are misleading and/or there is corroboration that the communication was made in bad faith, i.e., with the intention of harming the organization or third parties related to it, will not be admitted.

• Immediately forward the information to the Public Prosecutor’s Office when the facts could be indicative of a crime or to the European Public Prosecutor’s Office in the event that the facts affect the financial interests of the European Union.

• Forward the communication to the authority, entity or organism considered competent for its processing.

The decision of admission, inadmissibility or remission of the communication shall be communicated by the System Manager to the reporting person within five (5) working days after the decision is made, unless the communication is anonymous or the reporting person has waived the right to receive communications.

The System Manager shall also assess the advisability or need to adopt immediate measures to avoid further damage and, if necessary, implement them.

4.2.3.    PROCESSING AND RESEARCH

Once the communication has been admitted for processing, the person in charge of the System, acting as an instructor, shall carry out all those actions, proceedings and investigations necessary and aimed at verifying the verisimilitude of the facts of the communication, and may entrust this task to an external expert, if the circumstances so require.

Thus, the truthfulness and accuracy of the information contained in the communication and, in particular, of the reported conduct will be checked, following at all times the principles set forth in this Policy and under a strict regime of confidentiality to respect the rights of the informant and of the person under investigation.

During the investigation, the person under investigation will be notified of the communication with a succinct account of the facts established therein. This information may be provided during the hearing of the person under investigation, if it is considered that its prior provision could facilitate the concealment, destruction or alteration of the evidence.

Without prejudice to the right to make allegations in writing, the investigation shall include, whenever possible, an interview with the accused person in which, always with absolute respect for the presumption of innocence, he/she shall be invited to explain his/her version of the facts and to provide such evidence as he/she may deem appropriate and pertinent.

In order to guarantee the right of defense of the accused person, he/she will have access to the file (without disclosing information that could identify the informant) and may be heard at any time. He/she will also be advised of the possibility of appearing with the assistance of a lawyer.

In addition, the instructor will give a hearing to all affected persons and possible witnesses and will carry out as many procedures as deemed necessary (review of documentation, obtaining information from external sources, etc.). In this regard, all members of the organization are obliged to cooperate loyally in the investigation carried out. The intervention of witnesses and affected persons shall be strictly confidential.

The investigator may gather all the information and documentation he/she deems appropriate from any area or department of the organization, in order to substantiate the investigation.

Of all the investigation actions and, in particular, of the explanations/statements given by the persons who have intervened in the procedure of investigation of the communication, written minutes shall be drawn up (provided that prior consent is obtained from them), which shall be duly signed by the persons involved in order to certify its content and that it conforms to their statement. The content of such minutes will be incorporated to NOVAVENDA’s Information Management System with the same guarantees of confidentiality as the rest of the file.

In the event that the presence of the person under investigation during the investigation period could jeopardize the development of the investigation or the strict observance of the guiding principles of the procedure established in this Policy, at the proposal of the investigator, the person under investigation may be granted paid leave of absence from his/her job, without loss of pay, in order to ensure the performance of the necessary investigative activities without interference that could be detrimental to him/her. The paid leave shall be granted for the time necessary to carry out the necessary research work, but in no case may it be extended beyond the duration of the research process.

The presence of external legal advisors shall be allowed in the hearings/declarations of the affected parties, interested parties, witnesses, etc., if the instructor deems it convenient.

In any investigation procedure, special care shall be taken to ensure compliance with the principles contained in this Policy and to guarantee confidentiality, impartiality, as well as the rights to privacy, defense, honor and the presumption of innocence of the persons under investigation. Likewise, the procedure shall be transparent and shall guarantee the right to information of the persons involved in it.

4.2.4.    RESOLUTION AND COMMUNICATION

Once all the investigation actions have been concluded, the System Manager shall prepare and issue a report containing at least the following contents:

• A statement of the facts reported (descriptive information of the communication) together with the identification code of the communication and the date of registration.
• Evaluation of the content of the communication.
• The actions carried out in order to verify the verisimilitude of the facts.
• The conclusions reached in the investigation and the assessment of the proceedings and the evidence supporting them.
• Actions taken (if any).

Once the Report has been issued, the System Manager shall adopt one of the following decisions:

1. File closure, which will be notified to the informant and, if applicable, to the person concerned.

• Proposal of resolution of the file and, where appropriate, the corresponding proposals for actions and/or proposal of disciplinary measures, being always able to delegate this last power to another competent body.

• Referral to the Public Prosecutor’s Office if, despite not initially appreciating indications that the facts may have the character of a crime, this should result from the course of the investigation. If the offence affects the financial interests of the European Union, it shall be referred to the European Public Prosecutor’s Office.

• Referral of the communication to the authority, entity or organism considered competent to process it.

The maximum term to respond to the investigation actions may not exceed three (3) months from the receipt of the communication, except in cases of special complexity that require an extension of the term, in which case, this may be extended, by decision of the System Manager, up to a maximum of three (3) additional months.

The proposed resolution shall be sent to the Director General or, as the case may be, to the Administrative Body or competent body, who shall adopt and execute the final resolution.

Whatever the decision, it shall be communicated to the reporting person within five (5) working days of the decision being made, unless he/she has waived this or the communication is anonymous, as well as to the other affected parties.

In the event that the resolution issued concludes that a member of NOVAVENDA has committed an irregularity, disciplinary, administrative or judicial proceedings will be initiated as legally appropriate.

Likewise, if as a consequence of the investigation proceedings, other facts are discovered that could constitute new irregularities allegedly committed by the same or different persons from those investigated, the investigator shall propose the opening of a new file, or if it is related to the investigation being carried out, the extension of the investigation file, if he/she considers it more appropriate.

4.2.5.    DISCIPLINARY MEASURES

When it is determined that the reported conduct constitutes an infringement in labor matters, NOVAVENDA may adopt the appropriate measures in accordance with the applicable disciplinary regime and, specifically, with the provisions of the Collective Agreement applicable in NOVAVENDA and the Spanish Workers’ Statute.

Without prejudice to the observance in all cases of the mandatory labor regulations in force at any given time, to the extent permitted by such regulations, the following criteria, among others, may be considered in assessing the seriousness of the conduct, for the purposes of grading the penalties to be imposed:

• Degree of intentionality;
• Failure to comply with prior warnings;
• Recidivism;
• Concurrence of several infractions in the same act or activity;
• Concurrence of concealment in the conduct carried out by the offender;
• Concurrence of continuity in the conducts carried out by the offender;
• The correction of the non-compliance that gave rise to the infringement on the offender’s own initiative;
• Reparation of the damages caused by the infringing person;
• Level of responsibility in the organization of the offender;
• Magnitude of the economic damage derived from the infringement;
• Magnitude of any other non-financially assessable damages resulting from the infringement;
• Affecting other employees or third parties;
• Collaboration with the organization.

Notwithstanding the adoption of disciplinary measures, when the facts may be indicative of a crime, the corresponding information shall be immediately forwarded to the Public Prosecutor’s Office. In the event that the facts affect the financial interests of the European Union, the matter shall be referred to the European Public Prosecutor’s Office.

5.   DATA PROTECTION AND CONSERVATION

• PERSON IN CHARGE OF THE TREATMENT

In compliance with the provisions of the General Data Protection Regulation and the Data Protection Act, it is reported that personal data, if any, may be included in the communication, will be integrated into a file owned by NOVAVENDA for processing. 

NOVAVENDA is committed to maintaining strict protection of privacy, security and data retention, as detailed in our policies and procedures and internal regulations on these matters. In this sense, these rules will also apply with respect to all personal data related to communications made in accordance with this Policy.

• DATA COLLECTION

In the processing of communications (realization and investigation of the same) made in accordance with this Policy, NOVAVENDA collects the following personal data:

• Name and contact details of the complainant (unless reporting anonymously) and his/her status as a NOVAVENDA employee;

• Name and other personal data of the persons mentioned in the complaint (witnesses, possible offender, etc.), if such information is provided (description of their functions, contact data and participation or role in the reported facts);

• PRESERVATION OF THE IDENTITY OF THE REPORTING PERSON AND OTHER AFFECTED PERSONS

NOVAVENDA will preserve the identity and guarantee the confidentiality of the data corresponding to the affected persons and any third party mentioned in the information provided, especially the identity of the informant in case he/she has been identified. In this sense, the person to whom the facts related in the communication refer, will in no case be informed of the identity of the informant.

In this regard, whoever submits a communication has the right not to have his or her identity disclosed to third parties. The identity of the informant may only be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation.

These disclosures will be subject to safeguards set forth in the applicable regulations. In particular, the informant shall be transferred before disclosing his or her identity, unless such information could compromise the investigation or judicial proceedings.

• PRESERVATION OF DATA

NOVAVENDA will keep a record of all communications received. These records and the personal data they contain will be kept confidential in the Information Management System. The records will not be kept longer than necessary and in any case for as long as necessary to comply with any legal requirement applicable at any time.

NOVAVENDA will keep the personal data of the complainant for the time necessary to decide on the appropriateness of initiating an investigation into the facts or conduct reported and, once decided, will be deleted from the Ethical Channel, being able to be treated outside the system to investigate the facts for the time necessary to make a decision. Once the investigation of the communication has been completed and the appropriate actions have been taken, as the case may be, the data of those reports that have been processed will be duly blocked in order to comply with the legal obligations that may apply in each case.

Personal data will be deleted from the Ethical Channel within a maximum period of three (3) months from receipt of the communication, unless the purpose of storage is to leave evidence of the operation of the system, and may continue to be processed outside the Ethical Channel in the event that the investigation of the complaint has not been completed, for as long as necessary. In no case may the data be retained for a period exceeding ten years.

In the event that it is decided not to follow up on the complaint filed, the information may be kept in an anonymized form.

• ACCESS TO DATA

Access to personal data contained in the Ethical Channel shall be limited, within the scope of its competencies and functions, exclusively to:

1. The person in charge of the system and whoever manages it directly.

• The external advisor involved in the investigation, with whom the corresponding confidentiality agreements shall be signed.

• The responsible of human resources of NOVAVENDA or the competent body duly designated, only when disciplinary measures could be taken against a worker.

• The person in charge of NOVAVENDA’s legal services, if the adoption of legal measures in relation to the facts related in the communication is necessary.

• The persons in charge of the treatment that eventually are designated.

• PURPOSE OF TREATMENT

Only personal data that is strictly necessary for the purposes of management, processing and investigation of communications relating to the commission of irregularities are processed, as well as to carry out the necessary actions for the investigation of the reported facts, including, where appropriate, the adoption of disciplinary or legal measures, as appropriate.

Personal data will not be used for any purpose other than the one indicated.

• RIGHTS OF INTERESTED PARTIES

The interested parties, at any time and under the terms provided by the applicable regulations, may exercise the following rights with respect to their personal data: access, rectification, deletion (right to be forgotten), limitation of processing, opposition, portability, decision on automated processing, information and complaint.

In the event that the person to whom the facts described in the communication refer exercises the right to object, it will be presumed that, unless proven otherwise, there are compelling legitimate reasons that legitimize the processing of his or her personal data.

If they deem it appropriate, the persons concerned may also lodge a complaint with the competent data protection authority.

• INFORMATION ON DATA PROTECTION AND EXERCISE OF RIGHTS

Those who wish to obtain more information about the treatment of their personal data can contact NOVAVENDA through the following e-mail rgpd@comerbal.com. 

6.   EXTERNAL INFORMATION CHANNELS

The informants may, alternatively, send their communication directly, or after sending the communication through NOVAVENDA’s Ethical Channel, to the public authorities through the external information systems enabled by the Independent Authority for the Protection of the Informant (A.A.I.) or the corresponding regional authorities or bodies (in the case of Catalonia, to the Anti-Fraud Office of Catalonia), in accordance with the terms established in Title III of the Law for the protection of informants.

7.   NON-COMPLIANCE

This Policy is a mandatory rule for all members of the organization. Its violation will be a breach of it and NOVAVENDA will adopt the appropriate disciplinary measures, in accordance with labor legislation and the Penalty Regime contained in the Collective Agreement of application, without prejudice to other responsibilities in which the non-compliant person may have incurred.

8.   APPLICABLE REGULATIONS

• DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons who report breaches of Union law (« Whistleblower Directive »).

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (« General Data Protection Regulation »- GDPR).

• Article 31 bis paragraph 5 of the Spanish Penal Code.

• Law 2/2023, of February 20, 23, regulating the protection of persons who report regulatory violations and the fight against corruption (« Law on the protection of reporting persons »).

• Organic Law 3/2018 of December 5, 2018, on the Protection of Personal Data and Guarantee of Digital Rights (« Data Protection Law » – LOPD-GDD).

• Circular 1/2016 of the State Attorney General’s Office, dated January 22, on the criminal liability of legal entities pursuant to the reform of the Criminal Code made by Organic Law 1/2015.

• UNE-ISO 37002:2021 on Whistleblowing Management Systems. Guidelines.

• UNE-ISO 37301:2021 Compliance management systems. Requirements with guidance for its use.

9.   ENTRY INTO FORCE, EFFECTIVENESS AND REVISION

The entry into force of this Policy shall take place at the same time as the date of approval, modification or update of this document and shall remain in force until it is repealed.

This Policy shall be reviewed periodically in order to detect possible weaknesses or points for improvement, and shall be updated and/or improved. This Policy shall be reviewed extraordinarily and, if necessary, modified when significant circumstances of a legal, organizational or any other nature arise that justify its immediate adaptation and/or updating