versión V.2023.1


In order to comply with the Internal Reporting System that has been implemented – hereinafter “the System” or “IRS” – as well as with Law 2/2023, of 20 February, on the protection of persons who report breaches of law and the fight against corruption – hereinafter “Law 2/2023” -, MANUBENS GROUP has created a Reporting Channel so that any person within the personal scope of the IRS can report the existence of breaches or conducts contrary to the rules contained within the material scope of the organisation’s IRS.

Therefore, the purpose of this Protocol is to govern the operation of the Reporting Channel and the management and processing of reports received and any investigations to be initiated.

The scope of this Protocol includes the following entities, all of which are referred to herein as “MANUBENS GROUP”:




Material scope

The Reporting Channel activated in MANUBENS GROUP allows for the reporting of the matters described below, in compliance with Law 2/2023, as well as Law 10/2010, of 28 April, on the Prevention of Money Laundering and the Financing of Terrorism, as MANUBENS GROUP is obliged to comply with this Law.


a) Law 2/2023:

  • Acts or omissions which may constitute breaches of European Union law, provided that:
    1. Such acts or omissions fall within the scope of the acts of the European Union listed in the Annex to Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, irrespective of their qualification under national law;
    2. They affect the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU);

    3. They affect the internal market as referred to in Article 26(2) TFEU, including infringements of European Union competition and State aid rules, as well as internal market infringements relating to acts in breach of corporate tax rules or practices aimed at obtaining a tax advantage that distorts the object or purpose of the legislation applicable to corporate taxation.

  • Acts or omissions that may constitute a serious or very serious criminal or administrative offence.

  • Infringements of labour law relating to health and safety at work.

b) Law 10/2010:

  • Any infringement of the provisions of the Law on the Prevention of Money Laundering and the Financing of Terrorism in force.

(c) Prevention of sexual and gender-based harassment:

  • Any act contrary to the current legislation on sexual and gender-based harassment (Organic Law 3/2007, for the Effective Equality of Women and Men, Article 48), as well as the provisions of MANUBENS GROUP Protocol for the Prevention and Combating of Sexual and Gender-Based Harassment.

Personal scope

The protection provided by Law 2/2023 and the provisions of this Protocol apply to the following whistleblowers:

  1. Whistleblowers working in the private or public sector who, in the course of their work or professional activities, have obtained information about infringements, including in any case:
    1. civil servants or employees;

    2. self-employed persons;

    3. shareholders, venturers, and members of the management, direction or supervisory bodies of a company, including non-executive members;

    4. anyone working for or under the supervision and direction of contractors, subcontractors and suppliers

  2. Whistleblowers who report or make public information about wrongdoing obtained in the context of an employment or legal relationship that has already ended, volunteers, interns, trainees, employees undergoing training, whether or not they are paid, as well as those whose employment relationship has not yet begun, if the information about wrongdoing was obtained during the recruitment process or pre-contractual negotiations.

  3. Employees’ legal representatives in the performance of their duties to advise and assist the whistleblower.

  4. The whistleblower protection measures shall also apply, where appropriate, to

    1. individuals who assist the whistleblower in the process within the organisation where the whistleblower provides services,

    2. individuals related to the whistleblower who may suffer retaliation, such as colleagues or family members of the whistleblower; and

    3. legal persons for whom the whistleblower works or with whom the whistleblower has another employment relationship or in which the Whistleblower has a significant interest. For these purposes, an interest in the capital or voting rights attached to shares shall be deemed to be significant if, by virtue of its proportion, it enables the person who holds it to influence the legal entity in which he/she holds an interest.



MANUBENS GROUP has established the following reporting methods in accordance with Law 2/2023:

  • Internal reporting channel (public): through the on-line computer tool called “Ovet-Auki”. Outsourced management.

  • External reporting channel: Independent Authority for the Protection of Whistleblowers.

  • Public disclosure.

  • Postal mail. Internal management.

  • Face-to-face interview. Internal management.

  • Telephone. Internal management.



MANUBENS GROUP has set up an on-line computer tool called “OVET AUKI”, which is accessible to everyone through the following link:

This channel, whose management is outsourced to the experts at TARINAS VILADRICH ADVOCATS I PROCURADORS, SLP, allows for both anonymous and confidential reports, according to the whistleblower’s choice.

Operation and features

The reporting channel can be accessed from any device, at any time of the day, 365 days a year, by clicking on

The whistleblower must complete the various sections of the report in accordance with the instructions provided on the platform. The whistleblower must describe the facts in as much detail as possible and attach any available evidence, always with the aim of facilitating any subsequent investigation, if applicable.

The OVET AUKI Reporting Channel User Guide, attached as Annex III to this Protocol, can be consulted.

In the last section of the report, the whistleblower must explicitly choose whether he/she wants the report to be confidential and therefore his/her identity to be known or, on the contrary, anonymous. If the anonymous option is chosen, the whistleblower must keep the report code generated in order to be able to access the OVET AUKI platform and check the status of the report, contact the channel managers or the organisation, etc.

All this is duly described in the OVET AUKI Reporting Channel User Guide.

In case of doubts or incidents, the platform technicians can be contacted by e-mail at


Any individual may report to the relevant Independent Authority for the Protection of Whistleblowers. In Catalonia, this authority is the Anti-Fraud Office of Catalonia, which can be accessed through the following link:



Public disclosure means the making available to the public of information about acts or omissions among those provided for in Article 2 of Law 2/2023.

Individuals will be protected if any of the following conditions are met:

  1. If the whistleblower has reported through the previous reporting channels (internal, public and/or external) prior to the public disclosure, without appropriate measures being taken within the established maximum period (3 months).
  2. If there are reasonable grounds to believe that either the breach may constitute an imminent or manifest danger to the public interest, in particular in an emergency situation, or if there is a risk of irreversible harm, including a risk to the physical integrity of an individual; or, in the case of a report made through the external reporting channel, where there is a risk of retaliation or where the specific circumstances of the case, such as the concealment or destruction of evidence, the collusion of a public authority with the perpetrator of the offence or the involvement of the public authority in the offence, make it unlikely that the information will be dealt with effectively.

The conditions for benefiting from the protection referred to in the previous paragraph shall not apply if the person concerned has disclosed information directly to the press in the exercise of the freedom of expression and truthful information provided for in the Spanish Constitution and the relevant implementing legislation.


Postal mail

Written communications may be sent by post to the following address:


For the attention of SILVIA BOIX
(Internal Reporting System Officer)
Avenida Diagonal 682, 3 – 08034 – Barcelona (Spain)


All communications received by mail will be handled in a manner that protects the rights and confidentiality of the whistleblower. If the whistleblower provides a means of communication, it will be used to communicate the progress of the report or any other necessary formalities or issues.


Face-to-face interview

MANUBENS GROUP offers the possibility of contacting the IRS Officer in person within a maximum period of 7 days.

MANUBENS GROUP guarantees the protection of data when transcribing communications, in accordance with Regulation (EU) 2016/679 and Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights.



This section refers to reports received by the organisation.

The procedure for investigating reports received by the Independent Authority for the Protection of Whistleblowers is governed by the Statute of the said Authority.


Minimum required content of the report

It is the responsibility of the whistleblower to provide all information in as much detail as possible, as well as all data and evidence available to him/her, in order to facilitate any subsequent investigation. Furthermore, for such an investigation to be carried out, the report must contain at least the following information:

  • Description of the facts.

  • Evidence on which the whistleblower’s suspicions are based.

  • If known, the identity of the person(s) who carried out the acts or who may have covered them up.

  • If known, the place where the events took place.

  • The date on which the whistleblower became aware of the facts or how long he/she has known about them.

  • How the whistleblower became aware of the facts (whether he/she witnessed it personally, through a third party, through documentary evidence, etc.).

Procedure for receiving, following up and investigating the communication.

Acknowledgement of receipt or proof of receipt

The informant must receive the acknowledgement of receipt or proof of receipt of the communication within a maximum of 7 calendar days of sending it.

The above applies in all cases of communications made through the OVET AUKI platform and, in all other cases, in those communications where the informant has provided a contact method.

Filtering of incoming communications

The external managers of the information channel shall be in charge of carrying out the first filtering of the communication received, in order to assess whether (i) the informant is within the personal scope of the MANUBENS GROUP Internal Information System and (ii) whether the communication is within the material scope of the aforementioned System. In the case of anonymous communications, only the material scope shall be filtered, as it is impossible to identify the informant.

Once the first filtering has been carried out, the following steps shall be taken:

  1. In the event of NOT being within the personal and/or material scope of the SII, the communication received will be archived, a report will be generated justifying the reason for the archiving, and the informant will be notified and provided with a copy of the supporting report in question.
  2. In the case of YES being within the personal and/or material scope of the SII, a check will be made to see if the communication has the minimum content mentioned above. In the event that information is missing to proceed, the informant will be contacted with the objective of providing the missing information within a maximum period of 15 days.
    1. In the event that the informant does not provide the missing information, the communication shall be archived and the corresponding notification and delivery of the report justifying the archiving shall be made, without prejudice to the informant being able to make a new communication on the same fact.
    2. In the event that the informant has used a method other than the OVET AUKI portal and has not provided a contact method, the investigation procedure will be initiated, recording what has happened and the possible archiving of the communication due to not having sufficient information to carry out an investigation process with all the guarantees.
  3. In the case of YES being within the personal and/or material scope of the SII and that the communication has the minimum required content, it will have to be verified that the facts described in the content of the communication are not already under investigation or have already been investigated, and that the informant does not provide evidence or new information that motivates the initiation of a new investigation procedure:
    1. In the event that the facts have already been investigated or are already being investigated, and the informant does NOT provide evidence or new information, the communication shall be filed with a report justifying it.
    2. In the event that the facts have already been investigated or are being investigated, and the informant DOES provide evidence or new information, a new investigation procedure shall be initiated, which shall be carried out together with the information and/or investigation procedure that has been or is being carried out for the same facts described in the communication.
    3. If the facts have never been investigated, the investigation procedure shall be initiated.
  4. In the event that the communication DOES fall within the personal and/or material scope of the SII and that the communication has the minimum required content, and does not deal with a case that has already been or is being investigated, the external managers of the channel, in the case of the OVET AUKI platform, will send the communication received to the Head of the SII so that the latter may proceed, as soon as possible, to initiate the corresponding investigation procedure. In the case of having received the notification by other means, the notification is received from the very first moment by the person in charge of the SII.


Investigation procedure

Opening of the file

The person who must initiate the investigation procedure is the person in charge of the SII, by means of an Act of initiation of the investigation procedure, in which the information contained in the communication received must be attached. The same Act must detail the reasons for which the communication is admitted for processing, and the level of plausibility that it implies, as well as whether or not it is considered to have been made in good faith.

Likewise, the IBS Officer’s own capacity to carry out the investigation procedure or, if necessary, the need to rely on other people from the organisation or external experts must be analysed, always following the procedure specified later in this protocol, and respecting all the guarantees and maximum confidentiality of the communication received and the informant. Likewise, if necessary, the IIS Manager may appoint an instructor for the investigation procedure other than him/her, either from the organisation itself or an external person, always respecting the guarantees and confidentiality.

On the other hand, investigative procedures should be established that allow for the preservation of evidence and respect for workers’ rights. These procedures may include personal interviews with specific departments of the organisation or persons involved in the reported events. A professional may also be called in to assess the damage and the offence, following the procedure for inviting external parties described below.

Similarly, it should be established which departments or areas should be informed of the present investigation and at what hierarchical level, depending on: (i) the hierarchical level and number of possible persons involved and (ii) the need to involve other departments.

Finally, the need to inform the organisation’s governing body about the investigation should be assessed, depending on whether the governing body could be involved in the process or could be subject to possible reprisals, which in any case should be avoided.


Maximum resolution period

The maximum time limit for the resolution of the investigation procedure, counted from the notification of receipt of the communication, is as follows:

  • For communications received concerning the protection of European Union rights (Law 2/2023): 90 calendar days.
  • For communications received regarding the Prevention of Money Laundering and the Financing of Terrorism (Law 10/2010): 90 calendar days.
  • For communications received regarding sexual or gender-based harassment (Organic Law 3/2007, for the effective equality of women and men and, specifically, according to the protocol for the prevention of and action against sexual harassment and gender-based harassment in the workplace of the Spanish Ministry of Equality, drawn up by the Subdirectorate General for Entrepreneurship, Equality in the Company and Collective Bargaining, of October 2021): 10 working days.

Only in those cases where the complexity of the investigation can be justified, expressly, in writing and in a reasoned manner, may the time limit be extended for a further 90 calendar days.


Invitation of outsiders to the investigation procedure

As mentioned above, the IIS Officer should analyse the communication received and justify whether external persons should be invited to the investigation procedure to ensure its success. Some of the reasons why outsiders may be invited include:

  • Lack of specific or technical knowledge of the reported facts.
  • Potential conflict of interest on the part of the IBS Officer.
  • Strategy when gathering evidence for the investigation, e.g. when interviewing staff, it is possible that an outsider may be able to obtain more information than an insider.

In order to invite external persons to participate in the research procedure, the IIS Officer shall draw up minutes justifying the reasons, and the external person(s) shall sign the declaration of absence of conflict of interest – attached to this protocol as Annex I – and the corresponding confidentiality agreement – attached to this protocol as Annex II -.

Resolution of the file and notification

At the end of the investigation procedure, the person in charge of the SII shall:

  1. Report on the investigation procedure carried out, outlining all stages and evidence collected, as well as any incidents and their resolution.
  2. Draw up the minutes of closure of the investigation procedure, specifying the decision taken.

The possible outcomes of the investigation procedure are as follows:

a) Archiving of the communication.

The communication may be archived, after the investigation procedure has been carried out, for a number of reasons, for example:

    • Not having enough information or evidence to investigate further.
    • Need the informant’s cooperation in order to carry out the investigation and the informant refuses to cooperate.
    • The outcome of the investigation is that the events described did not actually occur, or that the conduct is not contrary to the rules or legislation in force, or to the policies implemented in the organisation.


(b) forwarding the communication to the competent authority.

In those cases in which it has been ascertained that the facts are credible and could constitute any kind of offence under the Spanish Criminal Code in force, the report must be sent immediately to the Public Prosecutor’s Office.

Likewise, in those cases in which the person in charge of the SII considers it appropriate, he/she must forward the communication to the competent authority.


c) Internal resolution of the communication, with or without sanction.

In cases where the facts of the communication are proven to have occurred, remedies should be applied. It may be that they do not constitute unlawful acts or that they are minor conduct, and immediate resolution should be applied. In the event that immediate resolution is not possible, the resolution should be planned, determining a specific timeframe for resolution and developing the remedy to be applied. Likewise, the possible sanctioning of the person(s) who have carried out the acts that are the object of the sanction must be assessed, all of this in a reasoned and express manner.



Reporting must be made in good faith and it shall be ensured that the reporter is not subject to retaliation. Furthermore, in order to ensure that no person reporting an allegedly unlawful act in good faith is subject to retaliation, all communications shall always be addressed to the System Administrator. However, in the event that the person who is the subject of the report is the Head of the System, the report may be addressed to Carmen Torres, who will assume the role of Head of the SII only with regard to the investigation procedure of the report in question, and must respect all the provisions of this protocol.

The identity of the informant shall remain anonymous or confidential, at the choice of the informant, or unless the informant consents to the disclosure of his or her identity. Likewise, the identity of the informant shall, in any case, be treated confidentially. In this sense, the System Manager shall not provide the identity of the informant under any circumstances, except – if absolutely necessary – to external (or internal) persons who may form part of the research procedure, who must first sign the corresponding confidentiality agreement annexed to this protocol.

Likewise, the identity of the informant may be revealed by judicial request, providing the identity to the Judge, Public Prosecutor, Police or competent administrative authority so that the result of the investigation carried out may be passed on to the Judge, Public Prosecutor, Police or competent administrative authority.

The person(s) who are the subject of the communication received – i.e. the person(s) to whom the facts described in the communication are attributed – may exercise the right of access, this right does not include the disclosure of the informant’s identification data.

A person shall not be penalised or retaliated against for making a communication, provided it is made in good faith.



Law 2/2023, in its Title VI, establishes the guidelines for the processing of personal data arising from the application of Law 2/2023, being that such data processing shall be governed by the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, in Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights, in Organic Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties. Furthermore, no data shall be obtained that allows the informant to be identified and the necessary technical and organisational measures must be in place to preserve the identity and guarantee the confidentiality and/or anonymity, where appropriate, of the data of the persons concerned.

On the other hand, Article 32 deals with the processing of personal data in the Internal Information System, specifically it should be noted that access to data in the Internal Information System is limited according to the responsibilities and competences to:

  1. The System Manager and whoever manages it directly.
  2. The human resources manager or the duly designated competent body, only where disciplinary measures may be taken against an employee. In the case of public employees, the body competent to deal with it.
  3. The person in charge of the legal services of the entity or body, if legal action should be taken in relation to the facts described in the communication.
  4. The persons in charge of processing that may be appointed.
  5. The data protection officer.

Finally, it must be included in the Register of Processing Activity in accordance with the provisions of Article 30 of the GDPR.

Data Controller:






Avenida Diagonal 682, 3 – 08034 – Barcelona


Purpose. To manage the data of the interested party in order to be able to process and manage the complaint filed through the channel provided,


  • The processing of personal data, when it is compulsory to have an Internal Information System and in cases of internal communication, the processing shall be considered lawful by virtue of the provisions of articles 6.1.c) of the RGPD, article 8 of the LOPDGDD, and 11 of Organic Law 7/2021, of 26 May.
  • The processing of personal data in the case of external communication channels shall be considered lawful in accordance with the provisions of Article 6(1)(c) of the GDPR.
  • The processing of personal data resulting from a public disclosure shall be presumed to be covered by the provisions of Articles 6(1)(e) of the GDPR.
  • In the event that special categories of personal data are processed for reasons of essential public interest, the processing will be lawful in accordance with Article 9(2)(g) of the GDPR.

International Data Transfers. No International Data Transfers are made to third countries outside the European Union.

Communication of data: The processing of data by other persons, or even their communication to third parties, will be lawful when it is necessary for the adoption of corrective measures in the entity or the processing of the sanctioning or criminal proceedings that, as the case may be, may be appropriate.

Data Retention. The data processed may be kept in the information system only for the time necessary to decide whether to initiate an investigation into the facts reported. If it is accredited that the information provided or part of it is not truthful, it must be immediately deleted as soon as this circumstance comes to light, unless this lack of truthfulness may constitute a criminal offence, in which case the information shall be kept for the time necessary during the legal proceedings. In any case, if three months have elapsed since the receipt of the communication without any investigation having been initiated, it shall be deleted, unless the purpose of storage is to leave evidence of the operation of the system. Communications that have not been processed may only be recorded in anonymised form, without the obligation to block provided for in article 32 of Organic Law 3/2018, of 5 December, being applicable.

Rights of data subjects. The data subject may exercise the rights of access, rectification and deletion (right to be forgotten), limitation of data, data portability and opposition, by sending a letter to Carmen Torres, as well as file a complaint with the competent supervisory authority on data protection (currently the Spanish Data Protection Agency) in the event that you do not receive a satisfactory response and wish to make a claim or obtain more information regarding any of these rights.



In order to guarantee the rights of the addressees of this protocol, as well as to ensure that they are aware of their obligations, prior, precise and unequivocal information must be provided to the members of MANUBENS GROUP about the existence of this protocol.

It establishes the obligation to inform of the existence of and access to the information channel through, as a minimum, publication on the website.

The person in charge of the System shall coordinate and control the necessary communication and training actions to ensure that all the people who have a relationship with MANUBENS GROUP are aware of its existence and the way it operates.



The MANUBENS GROUP Board of Partners approves the present protocol of the Information Channel, being Version V.2023.1 by Minutes dated 30 November 2023.