ETHICAL BEHAVIOR CHANNEL

PROTOCOL FOR MANAGEMENT OF THE COMMUNICATION CHANNEL IN COMPLIANCE MATTERS

GENERAL CONSIDERATIONS

The management of the Communication Channel is the responsibility of the Compliance Committee of the Group (hereinafter referred to as "the Committee").

The Committee may outsource the management of the Communication Channel to an independent third party, which, under no circumstances, will assume any responsibility for deficiencies or negligence in its management.

In fulfilling this function, the Committee, and where applicable, the independent third party entrusted with its management, must adhere to the rules and guiding principles established for this purpose in both the Ethical Code and the Code of Conduct.

The principles, rules of conduct, and guarantees established in this title will apply to any file on infractions processed by the Committee, regardless of its initiation method.

ADMISSION OF COMMUNICATIONS AND/OR REPORTS

Upon receiving a communication submitted to the Channel, the Committee will determine whether or not to process it.

The Committee may process anonymous communications, provided they include sufficient elements to promptly initiate an investigation. In any case, the Committee will ensure compliance with the requirements regarding the protection of personal data of the whistleblower.

Without prejudice to forwarding the communication to the competent body, the Committee will not investigate those communications in which, notably, the actions subject to the complaint do not constitute a violation of the compliance program or conduct that may imply the commission of irregularities or acts contrary to legality or the rules of the Ethical Code or Code of Conduct with relevance to the professional functions of the author of the non-compliance within the Group, in the contractual relationship with suppliers, or in the interests and image of the Group.

For the purpose of determining the admission of the communication, if deemed necessary, the Committee may request clarification or additional information from the person who made the communication (if identified), providing the documentation and/or data necessary to substantiate the existence of irregular conduct.

PROCESSING OF THE FILE

Once a complaint is admitted, the Committee will appoint an instructor responsible for conducting the investigation and processing the file, and may also assign this task to an external investigator. In the event that the complaint is directed against a Committee member, they shall not participate in its processing.

If the complaint involves a member of the Board of Directors, the Committee will select an instructor who, as a guarantee of independence, will be an external person to the Company and the Group, as well as the person or persons who will assist the instructor in processing the file.

The instructor will verify the truth and accuracy of the information contained in the complaint and, in particular, of the reported conduct, respecting the rights of those affected. To this end, all affected parties and witnesses will be given an opportunity to be heard, and the instructor will carry out any necessary proceedings. All employees and professionals of the company are obliged to collaborate loyally in the investigation. The involvement of witnesses and affected parties will be strictly confidential.

he hearing process (which will take place within thirty calendar days following the receipt of the complaint) will include, at a minimum, whenever possible, a private interview with the person allegedly responsible for the reported conduct. Within the framework of respecting the presumption of innocence, they will be informed of the facts under investigation, invited to provide their complete version of the events, allowed to submit relevant evidence, and asked relevant questions depending on the circumstances of the case and the reported facts. Additionally, all affected parties will be informed about the processing of their personal data and will comply with any other obligations required by data protection legislation

In every investigation, the rights to privacy, defense, and presumption of innocence of the persons under investigation will be guaranteed.

The Committee and the instructors may seek advice and collaboration from the Finance and Legal Services at any time during the procedure to determine the consequences and actions to be taken regarding any complaint.

RESOLUTION OF THE FILE

Upon completion of the file's processing, the instructor will submit it, along with a resolution proposal, to the Committee for them to resolve as they see fit.

n the event that the issued resolution concludes that an employee or professional has committed any irregularity or any act contrary to legality or the rules of the Ethical Code or the Code of Conduct specifically directed at the company's employees or professionals, the Committee will forward it to the Human Resources Department or the relevant department for the application of appropriate disciplinary measures, of which the Committee will be informed.

If it is a violation of the rules of corporate governance affecting a member of the board of directors, the Committee will forward the issued resolution to the other members of the board or, failing that, to its President, if any, through the secretary of the board of directors, for the application of any measures provided for in the compliance program, of which the Committee will be informed.

In the event that the issued resolution concludes that a supplier has committed any irregularity or any act contrary to legality or the rules of the Ethical Code, the Committee will forward it to the Purchasing Department or to whoever, in each case, is the contact for purchases in the corresponding company, for the exercise of the appropriate contractual rights, of which the Committee will be informed

When, as a result of the file, the possible adoption of legal actions is revealed, the Committee will forward the proceedings to the Legal Services for the initiation of the relevant administrative or judicial proceedings in each case, on which they will inform the Committee

DATA PROTECTION

The submission of personal information through the Communication Channel may require, in certain cases, depending on the nature of the complaint, the need to obtain explicit and unequivocal consent for the processing of personal data from the person who made the communication, as well as from the reported party. To this end, the necessary mechanisms will be enabled to obtain the necessary consent prior to the start of proceedings, in accordance with the requirements of personal data protection legislation.

In general, the reported party will be informed of the existence of a complaint at the time when the procedure's instructor proceeds with the initiation of the investigation. However, in cases where there is a significant risk that such notification may jeopardize the ability to effectively investigate the allegation or collect the necessary evidence, the notification to the reported party may be delayed while such risk exists. In any case, this period will never exceed three months from the receipt of the complaint.

Individuals making any communication or complaint through the Communication Channel must ensure that the personal data provided are true, accurate, complete, and up-to-date.

The data processed in the context of investigations will be deleted as soon as they are completed, unless administrative or judicial proceedings may arise or result from the measures taken. Likewise, the affected Group Company will keep the mentioned data duly blocked during the periods in which responsibilities may arise from complaints by employees or professionals of the affected company, or from actions carried out by said Company.

Users of the Communication Channel may exercise, at any time, in accordance with applicable law in each case, their rights of access, rectification, cancellation, and opposition regarding their personal data by written communication addressed to the registered office of the Company in which they provide their services, attention to the Compliance Committee of the Group, complying with the requirements established by current legislation and indicating the specific right they wish to exercise.