1. PURPOSE

MANUBENS GROUP, with the aim of complying with its implemented Internal Information System – hereinafter “the System” or “SII” – as well as with Law 2/2023 of 20 February, regulating the protection of persons who report breaches of regulations and the fight against corruption – hereinafter Law 2/2023 – has proceeded to set up an Information Channel so that all individuals within the personal scope of the aforementioned SII can report the existence of breaches or conduct contrary to the rules contained within the material scope of the organisation’s SII.

Consequently, the purpose of this protocol is to regulate the functioning of the Information Channel, as well as the management and processing of the communications received and the investigation procedures to be initiated, where appropriate.

The scope of this protocol covers the following entities, which we refer to collectively as the MANUBENS GROUP:

• MANUBENS Y ASOCIADOS S.L.P.
• MANUBENS MADRID ABOGADOS S.L.P.
• MANUBENS MÁLAGA ABOGADOS S.L.P.

 

2. SCOPE OF APPLICATION

Material scope

The Information Channel enabled in MANUBENS GROUP allows communications in relation to the matters described below, in compliance with Law 2/2023, as well as Law 10/2010, of 28 April, on the Prevention of Money Laundering and the Financing of Terrorism, as it is considered an obliged subject to this Law.

 

a) Law 2/2023:

• Acts or omissions which may constitute breaches of European Union law, provided that:

1. 1. Enter within the scope of the European Union acts listed in the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of Union law, irrespective of their qualification under national law;
   2. Affect the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU);
   3. have an impact on the internal market, as referred to in Article 26(2) TFEU, including infringements of EU competition rules and aid granted by States, as well as infringements relating to the internal market in relation to acts in breach of corporate tax rules or practices aimed at obtaining a tax advantage that would defeat the object or purpose of the legislation applicable to corporate taxation.

• Actions or omissions that could constitute a serious or very serious criminal or administrative offence.
• Infringements of labour law in the field of health and safety at work.

b) Law 10/2010:

• Any infringement of the provisions contained in the current Law on the Prevention of Money Laundering and Terrorist Financing.

(c) Prevention of sexual and gender-based harassment:

• Any action contrary to current legislation on sexual harassment and harassment for reasons of sex (Organic Law 3/2007, for the effective equality of women and men, article 48), as well as to the provisions of the Protocol for the prevention of sexual harassment and harassment for reasons of sex. as well as the provisions of the MANUBENS GROUP’s Protocol for the prevention and tackling of sexual harassment and harassment for reasons of sex.

Personal sphere

The protection contained in Law 2/2023, as well as the regulation of this protocol, applies to the following whistleblowers:

1. Informants working in the private or public sector who have obtained information on offences in an employment or professional context, including in any case:
   1. persons having the status of public employees or employees;
   2. the self-employed;
   3. shareholders, unit holders and persons belonging to the administrative, management or supervisory body of a company, including non-executive members;
   4. any person working for or under the supervision and direction of contractors, subcontractors and suppliers.
2. Whistleblowers who communicate or publicly disclose information on breaches obtained in the framework of an employment or statutory relationship that has already ended, volunteers, trainees, trainees in training, whether or not they receive remuneration, as well as those whose employment relationship has not yet started, in cases where the information on breaches has been obtained during the recruitment process or pre-contractual negotiation.
3. The legal representatives of the employees in the exercise of their functions of advising and supporting the informant.
4. The measures for the protection of the informant shall apply, where appropriate, to:
   1. natural persons who, within the organisation in which the respondent works, assist the respondent in the process,
   2. natural persons who are related to the informant and who may suffer reprisals, such as co-workers or relatives of the informant, and
   3. legal persons, for whom he/she works or with whom he/she has any other relationship in an employment context or in which he/she has a significant shareholding. For these purposes, an interest in the capital or in the voting rights attaching to shares or participations is deemed to be significant when, by virtue of its proportion, it enables the person holding it to have the capacity to influence the legal person in which it is held.

 

3. PERMITTED FORMS OF REPORTING

MANUBENS GROUP has established, in accordance with Law 2/2023, the following forms of information:

• Internal channel (public): through the on-line computer tool called “Ovet-Auki”. Outsourced management.
• External channel: Independent Whistleblower Protection Authority.
• Public disclosure
• Postal mail. Internal management.
• Face-to-face interview. Internal management.
• Telephone. Internal management.

 

INTERNAL CHANNEL

MANUBENS GROUP has set up an on-line computer tool, called “OVET AUKI” through which anyone can access through the following link: https://www.ovetauki.com/index.php?route=login/complaint&c_key=zWvfmosFvqMNapLFrzVUsXABfozhDVPenCDj

This channel, whose management is outsourced to the experts at TARINAS VILADRICH ADVOCATS I PROCURADORS, SLP, allows both anonymous and confidential communications, at the choice of the informant.

Operation and characteristics

Access to the information channel is via the link https://www.ovetauki.com/index.php?route=login/complaint&c_key=zWvfmosFvqMNapLFrzVUsXABfozhDVPenCDj, from any device and at any time of the day, 365 days a year.

The informant must complete the different phases of the preparation of the report, following the instructions given by the platform itself, and must describe the facts in as much detail as possible, as well as attach all the evidence available, always with the aim of facilitating the subsequent investigation procedure, where appropriate.

Please consult the OVET AUKI information channel user manual, attached as Annex III to this Protocol.

In the last phase of the communication, the informant must expressly choose whether he/she wishes the communication to be confidential and, therefore, his/her identity to be known or, on the contrary, to be anonymous. If the anonymous option is chosen, the informant must keep the communication code generated in order to be able to access the OVET AUKI platform at a later date and thus be able to consult the status of the communication, contact the channel managers or the organisation, etc.

All of this is duly detailed in the OVET AUKI information channel user manual.

In case of doubts or incidents, you can contact the platform technicians by e-mail at soporte@ovetauki.com.

 

EXTERNALCHANNEL

Any natural person may report to the corresponding Independent Authority for the Protection of Whistleblowers, being the Anti-Fraud Office of Catalonia, through the following link: https://antifrau.cat/es/18-investigacio/1123-bustia-de-denuncies-anonimes-2.html

 

PUBLIC DISCLOSURE

Public disclosure shall mean the making available to the public of information on actions or omissions as provided for in Article 2 of Law 2/2023.

Persons shall be protected insofar as he or she fulfils one of the following conditions:

1. Prior to public disclosure, communication has been made through the above channels (internal, public and/or external), without appropriate measures within the maximum timeframe (3 months).
2. there are reasonable grounds to believe that either the breach may constitute an imminent or manifest danger to the public interest, in particular where there is an emergency situation, or there is a risk of irreversible damage, including a danger to the physical integrity of a person; or, in the case of communication through the external reporting channel, there is a risk of retaliation or there is a low likelihood of affective treatment of the information due to the particular circumstances of the case, such as concealment, destruction of evidence, collusion of an authority with the perpetrator of the offence, or involvement in the offence.

The conditions for the protection provided for in the previous paragraph do not apply when the person has disclosed information directly to the press in accordance with the exercise of the freedom of expression and truthful information provided for in the Constitution and in the implementing legislation.

 

Postal mail

Written communications may be sent by post to the following address:

MANUBENS GROUP

For the attention of SILVIA BOIX
(Head of the Internal Information System)
Avenida Diagonal 682, 3 – 08034 – Barcelona

 

All communications received by post will be handled in a way that guarantees the rights of the informant and confidentiality, in the case of providing a means of communication with the informant it will be used to notify the course of the communication or for any other necessary procedure or issue.

 

Face-to-face interview

The option of being able to communicate in person with the System Manager within a maximum period of 7 days is enabled.

Data protection in accordance with Regulation (EU) 2016/679 and Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights is guaranteed at the time of transcribing the communication.

 

4. TREATMENT OF COMMUNICATION

This section applies to communications received by the organisation.

The procedure for investigating communications received by the Independent Authority for the Protection of Whistleblowers is subject to the Statute of the Independent Authority for the Protection of Whistleblowers.

 

Minimum content of the communication

The reporter has the duty to provide as much detailed information as possible, as well as to provide all data and evidence at his disposal, in order to facilitate the possible subsequent investigation procedure. Furthermore, in order to be able to carry out such an investigation procedure, the following information as a minimum is required in the report:

• Description of the facts.
• The evidence on which the informant’s suspicion is based.
• If known, the identity of the person(s) who carried out the act(s), or of those who may have covered it up.
• If known, the place where the events occurred.
• Date of when the informant became aware of the facts, or since when the informant has been aware of them.
• How the informant came to know the facts (whether he/she witnessed it personally, through third parties, through documentary evidence, etc.).

Procedure for receiving, following up and investigating the communication.

Acknowledgement of receipt or proof of receipt

The informant must receive the acknowledgement of receipt or proof of receipt of the communication within a maximum of 7 calendar days of sending it.

The above applies in all cases of communications made through the OVET AUKI platform and, in all other cases, in those communications where the informant has provided a contact method.

Filtering of incoming communications

The external managers of the information channel shall be in charge of carrying out the first filtering of the communication received, in order to assess whether (i) the informant is within the personal scope of the MANUBENS GROUP Internal Information System and (ii) whether the communication is within the material scope of the aforementioned System. In the case of anonymous communications, only the material scope shall be filtered, as it is impossible to identify the informant.

Once the first filtering has been carried out, the following steps shall be taken:

1. In the event of NOT being within the personal and/or material scope of the SII, the communication received will be archived, a report will be generated justifying the reason for the archiving, and the informant will be notified and provided with a copy of the supporting report in question.
2. In the case of YES being within the personal and/or material scope of the SII, a check will be made to see if the communication has the minimum content mentioned above. In the event that information is missing to proceed, the informant will be contacted with the objective of providing the missing information within a maximum period of 15 days.
   1. In the event that the informant does not provide the missing information, the communication shall be archived and the corresponding notification and delivery of the report justifying the archiving shall be made, without prejudice to the informant being able to make a new communication on the same fact.
   2. In the event that the informant has used a method other than the OVET AUKI portal and has not provided a contact method, the investigation procedure will be initiated, recording what has happened and the possible archiving of the communication due to not having sufficient information to carry out an investigation process with all the guarantees.
3. In the case of YES being within the personal and/or material scope of the SII and that the communication has the minimum required content, it will have to be verified that the facts described in the content of the communication are not already under investigation or have already been investigated, and that the informant does not provide evidence or new information that motivates the initiation of a new investigation procedure:
   1. In the event that the facts have already been investigated or are already being investigated, and the informant does NOT provide evidence or new information, the communication shall be filed with a report justifying it.
   2. In the event that the facts have already been investigated or are being investigated, and the informant DOES provide evidence or new information, a new investigation procedure shall be initiated, which shall be carried out together with the information and/or investigation procedure that has been or is being carried out for the same facts described in the communication.
   3. If the facts have never been investigated, the investigation procedure shall be initiated.
4. In the event that the communication DOES fall within the personal and/or material scope of the SII and that the communication has the minimum required content, and does not deal with a case that has already been or is being investigated, the external managers of the channel, in the case of the OVET AUKI platform, will send the communication received to the Head of the SII so that the latter may proceed, as soon as possible, to initiate the corresponding investigation procedure. In the case of having received the notification by other means, the notification is received from the very first moment by the person in charge of the SII.

 

Investigation procedure

Opening of the file

The person who must initiate the investigation procedure is the person in charge of the SII, by means of an Act of initiation of the investigation procedure, in which the information contained in the communication received must be attached. The same Act must detail the reasons for which the communication is admitted for processing, and the level of plausibility that it implies, as well as whether or not it is considered to have been made in good faith.

Likewise, the IBS Officer’s own capacity to carry out the investigation procedure or, if necessary, the need to rely on other people from the organisation or external experts must be analysed, always following the procedure specified later in this protocol, and respecting all the guarantees and maximum confidentiality of the communication received and the informant. Likewise, if necessary, the IIS Manager may appoint an instructor for the investigation procedure other than him/her, either from the organisation itself or an external person, always respecting the guarantees and confidentiality.

On the other hand, investigative procedures should be established that allow for the preservation of evidence and respect for workers’ rights. These procedures may include personal interviews with specific departments of the organisation or persons involved in the reported events. A professional may also be called in to assess the damage and the offence, following the procedure for inviting external parties described below.

Similarly, it should be established which departments or areas should be informed of the present investigation and at what hierarchical level, depending on: (i) the hierarchical level and number of possible persons involved and (ii) the need to involve other departments.

Finally, the need to inform the organisation’s governing body about the investigation should be assessed, depending on whether the governing body could be involved in the process or could be subject to possible reprisals, which in any case should be avoided.

 

Maximum resolution period

The maximum time limit for the resolution of the investigation procedure, counted from the notification of receipt of the communication, is as follows:

• For communications received concerning the protection of European Union rights (Law 2/2023): 90 calendar days.
• For communications received regarding the Prevention of Money Laundering and the Financing of Terrorism (Law 10/2010): 90 calendar days.
• For communications received regarding sexual or gender-based harassment (Organic Law 3/2007, for the effective equality of women and men and, specifically, according to the protocol for the prevention of and action against sexual harassment and gender-based harassment in the workplace of the Spanish Ministry of Equality, drawn up by the Subdirectorate General for Entrepreneurship, Equality in the Company and Collective Bargaining, of October 2021): 10 working days.

Only in those cases where the complexity of the investigation can be justified, expressly, in writing and in a reasoned manner, may the time limit be extended for a further 90 calendar days.

 

Invitation of outsiders to the investigation procedure

As mentioned above, the IIS Officer should analyse the communication received and justify whether external persons should be invited to the investigation procedure to ensure its success. Some of the reasons why outsiders may be invited include:

• Lack of specific or technical knowledge of the reported facts.
• Potential conflict of interest on the part of the IBS Officer.
• Strategy when gathering evidence for the investigation, e.g. when interviewing staff, it is possible that an outsider may be able to obtain more information than an insider.

In order to invite external persons to participate in the research procedure, the IIS Officer shall draw up minutes justifying the reasons, and the external person(s) shall sign the declaration of absence of conflict of interest – attached to this protocol as Annex I – and the corresponding confidentiality agreement – attached to this protocol as Annex II -.

Resolution of the file and notification

At the end of the investigation procedure, the person in charge of the SII shall:

1. Report on the investigation procedure carried out, outlining all stages and evidence collected, as well as any incidents and their resolution.
2. Draw up the minutes of closure of the investigation procedure, specifying the decision taken.

The possible outcomes of the investigation procedure are as follows:

a) Archiving of the communication.

The communication may be archived, after the investigation procedure has been carried out, for a number of reasons, for example:

• • Not having enough information or evidence to investigate further.
  • Need the informant’s cooperation in order to carry out the investigation and the informant refuses to cooperate.
  • The outcome of the investigation is that the events described did not actually occur, or that the conduct is not contrary to the rules or legislation in force, or to the policies implemented in the organisation.

 

(b) forwarding the communication to the competent authority.

In those cases in which it has been ascertained that the facts are credible and could constitute any kind of offence under the Spanish Criminal Code in force, the report must be sent immediately to the Public Prosecutor’s Office.

Likewise, in those cases in which the person in charge of the SII considers it appropriate, he/she must forward the communication to the competent authority.

 

c) Internal resolution of the communication, with or without sanction.

In cases where the facts of the communication are proven to have occurred, remedies should be applied. It may be that they do not constitute unlawful acts or that they are minor conduct, and immediate resolution should be applied. In the event that immediate resolution is not possible, the resolution should be planned, determining a specific timeframe for resolution and developing the remedy to be applied. Likewise, the possible sanctioning of the person(s) who have carried out the acts that are the object of the sanction must be assessed, all of this in a reasoned and express manner.

 

5. RIGHTS AND OBLIGATIONS

Reporting must be made in good faith and it shall be ensured that the reporter is not subject to retaliation. Furthermore, in order to ensure that no person reporting an allegedly unlawful act in good faith is subject to retaliation, all communications shall always be addressed to the System Administrator. However, in the event that the person who is the subject of the report is the Head of the System, the report may be addressed to Carmen Torres, who will assume the role of Head of the SII only with regard to the investigation procedure of the report in question, and must respect all the provisions of this protocol.

The identity of the informant shall remain anonymous or confidential, at the choice of the informant, or unless the informant consents to the disclosure of his or her identity. Likewise, the identity of the informant shall, in any case, be treated confidentially. In this sense, the System Manager shall not provide the identity of the informant under any circumstances, except – if absolutely necessary – to external (or internal) persons who may form part of the research procedure, who must first sign the corresponding confidentiality agreement annexed to this protocol.

Likewise, the identity of the informant may be revealed by judicial request, providing the identity to the Judge, Public Prosecutor, Police or competent administrative authority so that the result of the investigation carried out may be passed on to the Judge, Public Prosecutor, Police or competent administrative authority.

The person(s) who are the subject of the communication received – i.e. the person(s) to whom the facts described in the communication are attributed – may exercise the right of access, this right does not include the disclosure of the informant’s identification data.

A person shall not be penalised or retaliated against for making a communication, provided it is made in good faith.

 

6. PROTECTION OF PERSONAL DATA

Law 2/2023, in its Title VI, establishes the guidelines for the processing of personal data arising from the application of Law 2/2023, being that such data processing shall be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, in Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, in Organic Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties. Furthermore, no data shall be obtained that allows the informant to be identified and the necessary technical and organisational measures must be in place to preserve the identity and guarantee the confidentiality and/or anonymity, where appropriate, of the data of the persons concerned.

On the other hand, Article 32 deals with the processing of personal data in the Internal Information System, specifically it should be noted that access to data in the Internal Information System is limited according to the responsibilities and competences to:

1. The System Manager and whoever manages it directly.
2. The human resources manager or the duly designated competent body, only where disciplinary measures may be taken against an employee. In the case of public employees, the body competent to deal with it.
3. The person in charge of the legal services of the entity or body, if legal action should be taken in relation to the facts described in the communication.
4. The persons in charge of processing that may be appointed.
5. The data protection officer.

Finally, it must be included in the Register of Processing Activity in accordance with the provisions of Article 30 of the GDPR.

Data Controller:

COMPANY NAME	MANUBENS Y ASOCIADOS S.L.P.
NIF	B62185632
LOCATION	Avenida Diagonal 682, 3 – 08034 – Barcelona

 

Purpose. To manage the data of the interested party in order to be able to process and manage the complaint filed through the channel provided,

Legitimation.

• The processing of personal data, when it is compulsory to have an Internal Information System and in cases of internal communication, the processing shall be considered lawful by virtue of the provisions of articles 6.1.c) of the RGPD, article 8 of the LOPDGDD, and 11 of Organic Law 7/2021, of 26 May.
• The processing of personal data in the case of external communication channels shall be considered lawful in accordance with the provisions of Article 6(1)(c) of the GDPR.
• The processing of personal data resulting from a public disclosure shall be presumed to be covered by the provisions of Articles 6(1)(e) of the GDPR.
• In the event that special categories of personal data are processed for reasons of essential public interest, the processing will be lawful in accordance with Article 9(2)(g) of the GDPR.

International Data Transfers. No International Data Transfers are made to third countries outside the European Union.

Communication of data: The processing of data by other persons, or even their communication to third parties, will be lawful when it is necessary for the adoption of corrective measures in the entity or the processing of the sanctioning or criminal proceedings that, as the case may be, may be appropriate.

Data Retention. The data processed may be kept in the information system only for the time necessary to decide whether to initiate an investigation into the facts reported. If it is accredited that the information provided or part of it is not truthful, it must be immediately deleted as soon as this circumstance comes to light, unless this lack of truthfulness may constitute a criminal offence, in which case the information shall be kept for the time necessary during the legal proceedings. In any case, if three months have elapsed since the receipt of the communication without any investigation having been initiated, it shall be deleted, unless the purpose of storage is to leave evidence of the operation of the system. Communications that have not been processed may only be recorded in anonymised form, without the obligation to block provided for in article 32 of Organic Law 3/2018, of 5 December, being applicable.

Rights of data subjects. The data subject may exercise the rights of access, rectification and deletion (right to be forgotten), limitation of data, data portability and opposition, by sending a letter to Carmen Torres, as well as file a complaint with the competent supervisory authority on data protection (currently the Spanish Data Protection Agency) in the event that you do not receive a satisfactory response and wish to make a claim or obtain more information regarding any of these rights.

 

COMMUNICATION AND TRAINING

In order to guarantee the rights of the addressees of this protocol, as well as to ensure that they are aware of their obligations, prior, precise and unequivocal information must be provided to the members of MANUBENS GROUP about the existence of this protocol.

It establishes the obligation to inform of the existence of and access to the information channel through, as a minimum, publication on the website.

The person in charge of the System shall coordinate and control the necessary communication and training actions to ensure that all the people who have a relationship with MANUBENS GROUP are aware of its existence and the way it operates.

 

7. APPROVAL, ENTRY INTO FORCE AND REVIEW

The MANUBENS GROUP Board of Partners approves the present protocol of the Information Channel, being Version V.2023.1 by Minutes dated 30 November 2023.