Whistleblower Channel

ATTITUDE & HIRING ETT, S.L.

Internal whistleblower channel policy

I. INTRODUCTION, PURPOSE AND APPLICATION

Law 2/2023 of 20 February on the protection of persons who report regulatory infringements and the fight against corruption (hereinafter Law 2/2023) transposes into Spanish law Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of EU law.

This policy applies to ATTITUDE & HIRING ETT, S.L. with CIF B44565935 and registered office at Av. Ronda de Mar 24, 08720 Vilafranca del Penedès, Barcelona; and aims to establish an internal channel for the reporting of possible breaches of regulations, breaches of internal and/or ethical policies and to establish a whistleblower protection regime, in compliance with Law 2/2023, of 20 February, regulating the protection of persons who report breaches of regulations and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible retaliation, persons who, in an employment or professional context, detect serious or very serious criminal or administrative offences and report them through the mechanisms regulated in this policy.

This Channel, therefore, is a mechanism that allows company employees, and other interested parties, to report any type of illegal conduct or conduct contrary to our values and ethical principles, without fear of reprisals, strengthening the culture of information, the integrity infrastructures of organisations and the promotion of the culture of information or communication as a mechanism to prevent and detect threats to the public interest. In this way, we seek to promote a culture of transparency, integrity and accountability in our organisation, while protecting those employees who choose to report in good faith.

II. WHISTLEBLOWER CHANNEL

A whistleblower channel (hereinafter, the CII) has been set up by the entity as the preferred channel for receiving information on actions or omissions that may constitute a serious or very serious criminal or administrative offence, and other actions provided for in article 2 of Law 2/2023.

The channel is under the administration of the Internal Channel System Manager (hereinafter referred to as the RSII). Access to this channel shall be limited, within the scope of its competences and functions, to:

  1. The Head of the Channel’s Internal System.
  1. To the administrator(s) delegated by the system administrator.
  1. To the managers designated for the processing of certain complaints according to the area to which they correspond.

The functions of these bodies, as appropriate, shall be:

  • Reception, registration and management of complaints received through the whistleblower channel.
  • Designation of the person or team in charge of investigating the complaints received.
  • Ensuring the protection of whistleblowers and the confidentiality of reports received.
  • Assessment of the veracity and credibility of the complaints received.
  • Decision-making on appropriate action based on the results of the investigation.
  • Regular monitoring and review of the whistleblowing process and the company’s internal policy.
  • Preparation of reports and recommendations to senior management on complaints received and actions taken.

The CII must technically guarantee the confidentiality or, possibly, the anonymity of the informant, in order to protect him/her against any leakage and subsequent retaliation to which he/she may be subjected.

  • Link to the whistleblower’s channel:

https://compliance.legalsending.com/canal/?C=48605239019047593

  • QR code:

  • Send an e-mail to the following address:

people@attitude.tech

  • Postal mail addressed to Av. Ronda de Mar 24, 08720 Vilafranca del Penedès, Barcelona, a/a RSII: El Responsable

III. SUBJECTIVE SCOPE – REPORTING SUBJECTS

Those persons who have an employment or professional relationship with the AEPD can make use of the internal information channel and benefit from the protection granted by Law 2/2023 as informants, in order to communicate information on the actions or omissions described in article 2 of Law 2/2023. This employment or professional relationship, which entails a dependence on the AEPD, is what makes special protection against possible reprisals necessary and appropriate.

In any case, they are considered informants, for this AEPD, for the purposes of Law 2/2023:

  • Persons who have the status of employees or workers.
  • Freelancers.
  • Shareholders, participants and persons belonging to the administrative, management or supervisory body of the company, including non-executive members.
  • Any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
  • Whistleblowers who communicate or publicly disclose information on breaches obtained in the framework of an employment or statutory relationship that has already ended, volunteers, trainees, trainees in training, whether or not they receive remuneration, as well as those whose employment relationship has not yet started, in cases where the information on breaches has been obtained during the recruitment process or pre-contractual negotiation.

It is important to note that allegations made through the whistleblower channel must be bona fide, i.e. they must be supported by concrete evidence and facts.

IV. OBJECTIVE SCOPE – REPORTABLE FACTS

As regards the purpose of the information, it follows from Law 2/2023 that the internal reporting channel may be used to report serious misconduct or suspected corruption, which may constitute serious or very serious criminal or administrative offences related to the activities of the entity, which the reporting person has observed or has received information about in the course of his work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such information that relates to:

  1. 1. Infringements falling within the scope of the acts of the European Union listed in the Annex to that Directive relating to the following areas
  1. public procurement,
  1. financial services, products and markets, and prevention of money laundering and the financing of terrorism,

  1. product safety and compliance,
  1. transportation security,
  1. environmental protection,
  1. radiation protection and nuclear safety,
  1. food and feed safety, animal health and animal welfare,
  1. public health,
  1. consumer protection,
  1. protection of privacy and personal data, and security of networks and information systems
  1. That affect the financial interests of the European Union as contemplated in article 325 of the Treaty on the Functioning of the European Union (TFEU).

  1. Affecting the internal market, as referred to in Article 26(2) TFEU, including infringements of European Union rules on competition and aid granted by States, as well as infringements relating to the market internal in relation to acts that violate corporate tax rules or practices whose purpose is to obtain a tax advantage that distorts the object or purpose of the legislation applicable to corporate tax.
  1. Actions or omissions that may constitute a serious or very serious criminal or administrative offense. In any case, all serious or very serious criminal or administrative infractions that imply economic loss for the Public Treasury and Social Security will be understood to be included.
  1. Violations of labor law in matters of safety and health at work that are reported by workers, without prejudice to the provisions of their specific regulations.

The reporting person must provide at least a reference to the subjective scope of the infraction (matter or regulation violated: European Union Law; criminal infraction; or administrative infraction); and a description of the facts being communicated (relevant information about what happened), as detailed as possible, attaching the documentation that may be available, if applicable.

Likewise, you can provide your name and surname, and a contact telephone number, if you do not choose to make this communication anonymously.

If you know the identity of the person responsible for the reported irregularity, or have made these facts known to another body or entity through some external channel, you may also provide this information.

V. COMPLAINT PROCEDURE

The information may be communicated to the entity anonymously. Otherwise, the identity of the informant will be kept confidential and will be limited to the knowledge of the RSII, managing directors or appointed managers. These members will carry out their functions independently and autonomously with respect to the rest of the bodies of the entity or organization and may not receive instructions of any kind in their exercise, having all the personal and material means necessary to carry them out.

The Company undertakes to investigate all reports of potential violations or non-compliance received through the reporting channel. All reports will be investigated impartially and confidentially and appropriate action will be taken based on the results of the investigation aimed at the protection of the whistleblower.

The information or complaint will be communicated through the internal information channel by means of the specific electronic application for this purpose, identified and accessible from the website: https://www.attitude.tech/

At the request of the informant, the complaint may also be submitted through a face-to-face meeting that will take place within a maximum period of seven days. Where appropriate, the informant will be warned that the communication will be recorded and will be informed of the processing of his/her data in accordance with the provisions of the RGPD and the LOPDPGDD. When submitting the information, the informant must indicate an address, email address, or safe place for the purposes of receiving notifications, unless he/she expressly waives the receipt of any communication of actions carried out by the RSII as a result of the information.

Once the information has been submitted, it will be registered in the information management system by assigning an identification code, which will be contained in a secure database with restricted access exclusively to RSII personnel, duly authorized, in which all communications received will be recorded with the following data:

  1. Date of receipt.
  1. Identification code.
  1. Actions carried out.
  1. Measures taken.
  1. Closing date.

Once the information has been received, within a period of no more than 7 calendar days from said receipt, the informant will be acknowledged, unless he or she has expressly renounced receiving communications related to the investigation. These complaints will be handled within a maximum period of 3 months, except in cases of special complexity that require an extension of the period, in which case, this may be extended up to a maximum of another 3 additional months.

Once the information has been recorded, the RSII and its team will proceed to analyze the admissibility in accordance with the material and personal scope provided for in articles 2 and 3 of Law 2/2023.

The company undertakes to inform the whistleblower of the status of the investigation and the measures taken, whenever possible and without compromising the confidentiality and protection of the whistleblower, and may request additional information on the facts reported through the channel.

Furthermore, the company undertakes to monitor all complaints received and the measures taken to ensure the effectiveness of this policy and to continuously improve the process.

Any information that could indicate a criminal offence shall be forwarded to the Public Prosecutor’s Office immediately. If the facts affect the financial interests of the European Union, it shall be forwarded to the European Public Prosecutor’s Office.

VI. PROTECTION OF INFORMANTS

The company is committed to protecting people who report violations or non-compliance, in accordance with Law 2/2023.

A. Acts constituting retaliation.

Acts of reprisal, including threats of reprisal or attempts at reprisal, against persons who submit a communication pursuant to the law are expressly prohibited.

Reprisal is understood to be any act or omission that is prohibited by law, or that, directly or indirectly, involves unfavorable treatment that places the persons who suffer it at a particular disadvantage compared to others in the work or professional context, solely because of their status as informants, or for having made a public revelation.

For the purposes of the provisions of Law 2/2023, and by way of example, reprisals are considered to be those taken in the form of:

  1. Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary employment contract after the trial period has passed, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, demotion or denial of promotions and any other substantial modification of working conditions and non-conversion of a temporary employment contract into an open-ended one, if the employee had legitimate expectations that he or she would be offered an open-ended job; unless these measures were carried out within the regular exercise of management power under the corresponding labour legislation or legislation regulating the public employee statute, due to proven circumstances, facts or infringements, and unrelated to the submission of the communication.
  1. Damage, including reputational damage or financial loss, coercion, intimidation, harassment or ostracism.
  1. Negative evaluation or references regarding work or professional performance.
  1. Inclusion on blacklists or dissemination of information in a particular sector, which hinders or prevents access to employment or the contracting of works or services.
  1. Denial or cancellation of a license or permit.
  1. Denial of training.
  1. Discrimination, or unfavorable or unfair treatment.

Any person whose rights have been violated as a result of the communication or disclosure of the data after the two-year period has elapsed may request protection from the competent authority, which may, exceptionally and in a justified manner, extend the period of protection, after hearing the persons or bodies that may be affected. Any refusal to extend the period of protection must be reasoned.

Administrative acts that aim to prevent or hinder the submission of communications and disclosures, as well as those that constitute retaliation or cause discrimination after the submission of those communications and disclosures under this law, shall be null and void and shall give rise, where appropriate, to disciplinary or liability corrective measures, which may include the corresponding compensation for damages to the injured party.

B. Measures to protect whistleblowers from retaliation

Persons who communicate information about the actions or omissions set out in Section FOUR, or who make a public disclosure in accordance with Law 2/2023, shall not be deemed to have infringed any restriction on disclosure of information and shall not incur any liability of any kind in relation to such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to reveal an action or omission under said law, all without prejudice to the provisions of the specific protection rules applicable in the workplace. This measure shall not affect criminal liabilities.

The provisions of the preceding paragraph extend to the communication of information made by workers’ representatives, even if they are subject to legal obligations of confidentiality or of not revealing confidential information. All of this without prejudice, equally, to the specific protection rules applicable in the workplace.

The whistleblower protection measures shall also apply, where appropriate, to:

  1. natural persons who assist the informant in the process;
  1. natural persons who are related to the informant and who may suffer retaliation, such as co-workers or family members of the informant;
  1. legal entities, for which you work or with which you maintain any other type of relationship in a work context or in which you hold a significant stake.

For these purposes, participation in the capital or in the voting rights corresponding to shares or interests is understood to be significant when, due to its proportion, it allows the person who owns it to have the capacity to influence the legal entity in which it is held.

Informants shall not incur liability for the acquisition of or access to information that is communicated or disclosed publicly, provided that such acquisition or access does not constitute a crime.

Any other potential liability of whistleblowers arising from acts or omissions that are not related to communication or public disclosure, or that are not necessary to disclose an infringement under Law 2/2023, will be enforceable in accordance with applicable regulations.

In proceedings before a court or other authority concerning harm suffered by whistleblowers, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure in accordance with Law 2/2023 and that he or she has suffered harm, it shall be presumed that the harm occurred in retaliation for reporting or making a public disclosure. In such cases, it shall be for the person who took the harmful measure to prove that that measure was based on duly justified reasons unrelated to the communication or public disclosure.

In legal proceedings, including those relating to defamation, infringement of copyright, breach of confidentiality, infringement of data protection rules, disclosure of trade secrets, or claims for compensation based on labour or statutory law, whistleblowers shall not incur any liability of any kind as a result of communications or public disclosures protected by Law 2/2023. Such persons shall have the right to claim in their defence and within the framework of the aforementioned legal proceedings, that they have communicated or made a public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure was necessary to reveal an infringement under Law 2/2023.

The following are expressly excluded are expressly excluded from the protection provided by law, those persons who communicate or disclose:

  1. Information contained in communications that has been rejected by any internal information channel or for any of the reasons provided for by law.
  1. Information relating to claims regarding interpersonal conflicts or which affects only the informant and the persons to whom the communication or disclosure refers.
  1. Information that is already fully available to the public or that constitutes mere rumours.
  1. Information relating to actions or omissions not covered by the law.

C. Measures for the protection of affected persons

During the processing of the file, the persons affected by the communication will have the right to the presumption of innocence, the right of defense and the right of access to the file under the terms provided for in Law 2/2023, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

The Independent Authority for the Protection of Informants, A.A.I., may, within the framework of the sanctioning procedures it conducts, adopt provisional measures in accordance with the terms established in article 56 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations.

D. Assumptions of exemption and mitigation of the sanction

When a person who participated in the commission of the administrative infringement that is the subject of the information is the one who reports its existence by submitting the information and provided that it was submitted before the initiation of the investigation or sanctioning procedure was notified, the body competent to resolve the procedure, by means of a reasoned resolution, may exempt him from compliance with the administrative sanction that corresponds to him provided that the following aspects are proven in the file:

  1. Having ceased to commit the infringement at the time of submission of the communication or disclosure and having identified, where applicable, the rest of the persons who participated in or favoured it.
  1. Having cooperated fully, continuously and diligently throughout the entire investigation process.
  1. Having provided truthful and relevant information, evidence or data significant to the accreditation of the facts investigated, without having proceeded to destroy them or conceal them, nor having revealed their content to third parties, directly or indirectly.
  1. Having proceeded to repair any damage caused that is attributable to him/her.

Where these requirements are not fully met, including partial reparation of the damage, it will be up to the competent authority, after assessing the degree of contribution to the resolution of the case, to mitigate the sanction that would have corresponded to the infringement committed, provided that the informant or author of the disclosure has not been previously sanctioned for acts of the same nature that gave rise to the initiation of the procedure.

The mitigation of the sanction may be extended to the rest of the participants in the commission of the infringement, depending on the degree of active collaboration in the clarification of the facts, identification of other participants and repair or reduction of the damage caused, as assessed by the body in charge of the resolution.

Law 2/2023 excludes from the provisions of this section the infringements established in Law 15/2007, of July 3, on Defense of Competition.

VII. CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data will be carried out in compliance with Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption, Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights and Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and the execution of criminal penalties.

The personal data being processed, the documents provided and any other information provided in the complaint containing personal information will be treated confidentially by those responsible for the channel, as well as by the administrators and possible managers, in order to comply with the obligation to investigate and manage the complaint filed as well as to comply with the legal obligations established in Law 2/2023, of February 20, regulating the protection of persons who report regulatory violations and the fight against corruption.

The internal information system must prevent unauthorized access and preserve the identity and guarantee the confidentiality of the data corresponding to the affected persons and any third party mentioned in the information provided, especially the identity of the informant if he or she has been identified. The identity of the informant may only be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation, and these cases will be subject to safeguards established in the applicable regulations.

If the information received contains special categories of personal data, subject to special protection, it will be immediately deleted, unless the processing is necessary for reasons of essential public interest as provided for in article 9.2.g) of the GDPR, as provided for in article 30.5 of Law 2/2023.

In any case, personal data whose relevance is not manifestly clear for the processing of specific information will not be collected or, if collected by accident, will be deleted without undue delay.

Communications that have not been processed may only be recorded in an anonymous form, without the blocking obligation provided for in article 32 of the LOPDPGDD being applicable.

Access to personal data contained in the internal information system will be limited to:

  1. The person responsible for the Canal’s Internal System.
  1. To the administrator(s) delegated by the system administrator.
  1. To the managers designated for the processing of certain complaints according to the area to which they correspond.
  1. The data may be disclosed to the Legal Department, Lawyers, Judicial Bodies and State Security Forces and Corps in the event that any of the information received could be considered a crime or legal infringement of any kind.

Legal basis for processing: The processing of personal data, in cases of internal communication, will be deemed lawful pursuant to the provisions of Articles 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Article 8 of Organic Law 3/2018 of 5 December and Article 11 of Organic Law 7/2021 of 26 May, when, in accordance with the provisions of Articles 10 and 13 of the Law, it is mandatory to have an internal information system. If it is not mandatory, the processing will be presumed to be covered by Article 6.1.e) of the aforementioned Regulation. The processing of personal data in the case of external communication channels shall be deemed lawful pursuant to the provisions of Articles 6.1.c) of Regulation (EU) 2016/679, 8 of Organic Law 3/2018, of December 5, and 11 of Organic Law 7/2021, of May 26.

Rights of the interested party: access, rectification, suppression, limitation, portability and opposition, free of charge by e-mail to: people@attitude.tech in the cases legally foreseen.

Conservation: The data will be kept for the legal period established for the processing of the file and for the time necessary for the exercise of legal actions or if it is necessary to leave evidence of the management of the channel. The interested party also has the right to file a claim with the AEPD at www.aepd.es to request the protection of their rights.

VIII. COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will conduct regular training and awareness-raising campaigns to foster a culture of integrity and transparency, and to inform employees and other stakeholders about the whistleblowing channel. It will also provide information on the rights and protections offered to whistleblowers under Law 2/2023.

The company undertakes to disseminate this policy to all employees and interested parties, and will update, at least every three years, and, where appropriate, modify this internal channel policy, taking into account the experience acquired and the recommendations of the Competent Authority.