Informant channel

Internal Whistleblower Channel Policy

I. INTRODUCTION, PURPOSE AND APPLICATION

Law 2/2023 of 20 February 2023 on the protection of persons who report breaches of regulations and the fight against corruption (hereinafter, Law 2/2023) transposes Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law into Spanish law.

This policy applies to Twin Pines, S.L. with CIF B85430627 and registered office at C/ Eraso, 36, 2º, 28028, Madrid, Madrid; and aims to establish an internal channel for the reporting of possible regulatory breaches, infringement of internal and/or ethical policies and to establish a whistleblower protection regime, in compliance with Law 2/2023, of 20 February, regulating the protection of people who report regulatory breaches and the fight against corruption.

Law 2/2023 explains and clarifies in its preamble, Part III, that its purpose is to protect, against possible retaliation, people who, in a work or professional context, detect serious or very serious criminal or administrative offences and report them through the mechanisms regulated in this policy.

This Channel, therefore, is a mechanism that allows the company's employees and other interested parties to report any type of illegal conduct or conduct contrary to our values and ethical principles, without fear of reprisals, strengthening the culture of information, the integrity infrastructures of the organizations and the promotion of the culture of information or communication as a mechanism to prevent and detect threats to the public interest. In this way, it seeks to promote a culture of transparency, integrity and responsibility in our organization, while protecting those employees who decide to make a complaint in good faith.

II. INFORMANT'S CHANNEL

A whistleblower channel (hereinafter, the CII) has been created by the entity as a preferential channel for receiving information on actions or omissions that may constitute a serious or very serious criminal or administrative offence, and other actions provided for in Article 2 of Law 2/2023.

The channel is under the administration of the Channel's Internal System Manager (hereinafter, the RSII). Access to this channel will be limited, within the scope of its powers and functions, to:

The Head of the Channel's Internal System.
To the administrator(s) delegated by the person in charge of the system.
To the managers appointed to process certain complaints according to the area to which they correspond.

The functions of these bodies, as appropriate, will be:

Reception, registration and management of complaints received through the whistleblower's channel.
Designation of the person or team in charge of the investigation of the complaints received.
Ensuring the protection of whistleblowers and the confidentiality of the complaints received.
Evaluation of the veracity and credibility of the complaints received.
Decision-making on appropriate measures based on research results.
Monitoring and periodic review of the whistleblowing management process and the company's internal policy.
Preparation of reports and recommendations for senior management on complaints received and actions taken.

The CII must technically guarantee the confidentiality or, eventually, the anonymity of the informant, to protect him against any leaks and subsequent retaliation to which he may be subjected.

· Link to the informant's channel:

· QR Code:

· Send an email to the following address:

info@twinpines.es

· Postal mail addressed to C/ Eraso, 36, 2º, 28028, Madrid, Madrid, to/a RSII: Juan Manuel Nogales Muriel

III. SUBJECTIVE SCOPE - REPORTING SUBJECTS

Those persons who have an employment or professional relationship with the AEPD can make use of the internal information channel and benefit from the protection granted by Law 2/2023 as whistleblowers, to report information on the actions or omissions described in Article 2 of Law 2/2023. This employment or professional relationship, which entails dependence on the AEPD, is what makes special protection against possible reprisals necessary and appropriate.

In any case, the following are considered informants, for the purposes of this AEPD, for the purposes of Law 2/2023:

People who have the status of employees or employees.
Freelance freelancers.
Shareholders, participants and persons belonging to the administration, management or supervisory body of the company, including non-executive members.
Any person working for or under the supervision and direction of contractors, subcontractors, and suppliers.
Whistleblowers who communicate or publicly disclose information on breaches obtained within the framework of an employment or statutory relationship that has already ended, volunteers, trainees, trainees regardless of whether they receive remuneration or not, as well as those whose employment relationship has not yet begun, in cases where the information on breaches has been obtained during the selection process or pre-contractual negotiation.

It is important to note that the complaints made through the whistleblower channel must be in good faith, that is, they must be supported by evidence and concrete facts.

IV. OBJECTIVE SCOPE - REPORTABLE FACTS

With regard to the purpose of the information, it follows from Law 2/2023 that the internal information channel may be used to report serious misconduct or alleged corruption, which may constitute serious or very serious criminal or administrative offences related to the activities of the entity, which the whistleblower has observed or about which he or she has received information in the course of his or her work or professional relationship.

Law 2/2023 itself and Directive (EU) 2019/1937 list as such, the information that refers to:

1. Infringements falling within the scope of the European Union acts listed in the Annex to that Directive relating to the following areas
1. public procurement,
2. financial services, products and markets, and prevention of money laundering and terrorist financing,
3. product safety and compliance,
4. transport security,
5. environmental protection,
6. radiation protection and nuclear safety,
7. food and feed safety, animal health and animal welfare,
8. public health
9. consumer protection,
10. protection of privacy and personal data, and security of networks and information systems
Affecting the financial interests of the European Union as referred to in Article 325 of the Treaty on the Functioning of the European Union (TFEU).
Affecting the internal market, as referred to in Article 26(2) TFEU, including infringements of the European Union's rules on competition and aid granted by States, as well as infringements relating to the internal market in relation to acts infringing the corporate tax rules or practices the purpose of which is to obtain a tax advantage that undermines the subject-matter, or The purpose of the legislation applicable to corporation tax.
Actions or omissions that may constitute a serious or very serious criminal or administrative offence. In any case, all serious or very serious criminal or administrative offences that involve economic damage to the Public Treasury and Social Security will be understood to be included.
Infringements of labour law in the field of occupational safety and health reported by workers, without prejudice to the provisions of their specific regulations.

The reporting person must provide, at least, a reference to the subjective scope of the infringement (subject matter or regulation infringed: European Union law; criminal offence; or administrative offence); and a description of the facts that are the subject of the report (relevant information on what happened), as detailed as possible, attaching any documentation that may be available, if applicable.

You can also provide your name and surname, and a contact telephone number, if you do not choose to make this communication anonymously.

If they know the identity of the person responsible for the irregularity reported, or have brought these facts to their attention to another body or entity through an external channel, they may also provide this information.

V. COMPLAINT PROCEDURE

The information may be communicated to the entity anonymously. Otherwise, the identity of the informant will be kept confidential and will be limited to the knowledge of the RSII, delegated administrators or appointed managers. These members will carry out their functions independently and autonomously with respect to the rest of the bodies of the entity or body and may not receive instructions of any kind in their exercise, having all the personal and material means necessary to carry them out.

The company undertakes to investigate all reports of possible violations or non-compliance that are received through the whistleblowing channel. All allegations will be investigated in an impartial and confidential manner and appropriate action will be taken on the basis of the results of the investigation aimed at the protection of the whistleblower.

The information or complaint will be communicated through the internal information channel through the specific electronic application for this purpose, identified and accessible from the website: https://www.twinpines.es/

At the request of the informant, the complaint may also be submitted through a face-to-face meeting that will take place within a maximum period of seven days. Where appropriate, the reporting party will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of the GDPR and the LOPDPGDD. When submitting the information, the informant must indicate an address, e-mail address, or safe place for the purpose of receiving notifications, unless he expressly waives the receipt of any communication of actions carried out by the IHR as a result of the information.

Once the information has been submitted, it will be registered in the information management system, by assigning an identification code, which will be contained in a secure database and with access restricted exclusively to the RSII staff, duly authorized, in which all communications received will be recorded with the following data:

Date of receipt.
Identification code.
Actions carried out.
Measures adopted.
Closing date.

Once the information has been received, within a period of no more than 7 calendar days from such receipt, the informant will be acknowledged, unless he or she has expressly waived receiving communications relating to the investigation. These complaints will be managed for a maximum period of 3 months except in cases of special complexity that require an extension of the period, in which case, it may be extended to a maximum of another 3 additional months.

Once the information has been registered, the RSII and its team will proceed to analyse the admissibility in accordance with the material and personal scope provided for in Articles 2 and 3 of Law 2/2023.

The company undertakes to inform the whistleblower about the status of the investigation and the measures adopted, whenever possible and without compromising the confidentiality and protection of the whistleblower, and may request additional information to the facts reported through the channel.

In addition, the company undertakes to follow up on all complaints received and the measures taken to ensure the effectiveness of this policy and to continuously improve the process.

Any information shall be sent to the Public Prosecutor's Office immediately when the facts could constitute an offence. In the event that the facts affect the financial interests of the European Union, it will be referred to the European Public Prosecutor's Office.

VI. PROTECTION OF WHISTLEBLOWERS

The company is committed to protecting people who report breaches or non-compliance, in accordance with Law 2/2023.

A. Acts constituting retaliation.

Acts constituting retaliation, including threats of retaliation and attempted retaliation against persons who submit a communication in accordance with the law, are expressly prohibited.

Retaliation is understood to be any act or omission that is prohibited by law, or that, directly or indirectly, involves unfavourable treatment that places the people who suffer it at a particular disadvantage with respect to others in the work or professional context, solely because of their status as informants, or because they have made a public disclosure.

For the purposes of the provisions of Law 2/2023, and by way of example, retaliation is considered to be that which is adopted in the form of:

Suspension of the employment contract, dismissal or termination of the employment or statutory relationship, including non-renewal or early termination of a temporary employment contract after the probationary period has passed, or early termination or cancellation of contracts for goods or services, imposition of any disciplinary measure, degradation or denial of promotions and any other substantial modification of working conditions and non-conversion of an employment contract temporary in an indefinite one, in case the worker had legitimate expectations that he would be offered an indefinite job; unless these measures were carried out within the regular exercise of the power of management under the corresponding labour legislation or regulatory legislation of the statute of the corresponding public employee, due to circumstances, facts or proven infractions, and unrelated to the presentation of the communication.
Damages, including reputational damages, or financial loss, coercion, intimidation, harassment or ostracism.
Negative evaluation or references regarding work or professional performance.
Blacklisting or dissemination of information in a certain sectoral area, which hinders or prevents access to employment or the contracting of works or services.
Denial or revocation of a license or permit.
Refusal of training.
Discrimination, or unfavorable or unfair treatment.

A person whose rights are infringed as a result of their communication or disclosure after the two-year period has elapsed may request the protection of the competent authority, which, exceptionally and justifiably, may extend the period of protection, after hearing the persons or bodies that may be affected. The refusal to extend the period of protection must be justified.

Administrative acts that are intended to prevent or hinder the submission of communications and disclosures, as well as those that constitute retaliation or cause discrimination after the submission of such communications under this law, shall be null and void and shall give rise, where appropriate, to disciplinary or liability corrective measures, which may include the corresponding compensation for damages to the injured party.

B. Whistleblower protection measures against retaliation

Persons who communicate information about the actions or omissions referred to in paragraph FOUR, or who make a public disclosure in accordance with Law 2/2023, shall not be deemed to have breached any disclosure restriction and shall not incur liability of any kind in relation to such communication or public disclosure, provided that they had reasonable grounds to believe that the communication or public disclosure of such information was necessary to disclose an act or omission under said law, all without prejudice to the provisions of the specific protection rules applicable in the labor field. This measure will not affect criminal liabilities.

The provisions of the previous paragraph extend to the communication of information made by the workers' representatives, even if they are subject to legal obligations of secrecy or not to reveal confidential information. All this is without prejudice, likewise, to the specific protection rules applicable in the workplace.

The whistleblower's protection measures shall also apply, where appropriate, to:

natural persons who assist the informant in the process;
natural persons who are related to the whistleblower and who may suffer retaliation, such as co-workers or family members of the whistleblower;
legal persons, for whom they work or with whom they have any other type of relationship in a work context or in which they hold a significant participation.

For these purposes, it is understood that the participation in the capital or in the voting rights corresponding to shares or participations is significant when, due to its proportion, it allows the person who holds it to have the capacity to influence the investee legal person.

Whistleblowers shall not incur liability with respect to the acquisition of or access to information that is publicly communicated or disclosed, provided that such acquisition or access does not constitute a criminal offence.

Any other potential liability of whistleblowers arising from acts or omissions that are not related to public disclosure or communication, or that are not necessary to disclose a breach under Law 2/2023 will be enforceable under applicable law.

In proceedings before a court or other authority, relating to harm suffered by whistleblowers, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure in accordance with Law 2/2023 and that he or she has suffered harm, it shall be presumed that the harm occurred in retaliation for reporting or making a public disclosure. In such cases, it is for the person who took the prejudicial measure to prove that the prejudicial measure was based on duly justified grounds unrelated to the public communication or disclosure.

In legal proceedings, including those relating to defamation, copyright infringement, breach of secrecy, infringement of data protection rules, disclosure of trade secrets, or claims for compensation based on labour or statutory law, whistleblowers shall not incur liability of any kind as a result of communications or public disclosures protected by Law 2/2023. Such persons shall have the right to allege in their defence and in the context of the aforementioned judicial proceedings, that they have communicated or made a public disclosure, provided that they have reasonable grounds to believe that the communication or public disclosure was necessary to reveal an infringement under Law 2/2023.

Persons who communicate or reveal:

Information contained in communications that has been inadmissible by any internal information channel or for any of the reasons provided for by law.
Information linked to complaints about interpersonal conflicts or that affects only the whistleblower and the persons to whom the communication or disclosure refers.
Information that is already fully available to the public or that constitutes mere rumors.
Information that refers to actions or omissions not included in the scope of the law.

C. Measures for the protection of affected persons

During the processing of the file, the persons affected by the communication will have the right to the presumption of innocence, the right of defence and the right of access to the file under the terms provided for in Law 2/2023, as well as the same protection established for informants, preserving their identity and guaranteeing the confidentiality of the facts and data of the procedure.

The Independent Authority for the Protection of Whistleblowers, A.A.I. may, within the framework of the sanctioning procedures it instructs, adopt provisional measures under the terms established in Article 56 of Law 39/2015, of 1 October, on the Common Administrative Procedure of Public Administrations.

D. Cases of exemption and mitigation of the penalty

When a person who has participated in the commission of the administrative offence that is the subject of the information is the one who informs of its existence by submitting the information and provided that it has been submitted before the initiation of the investigation or sanctioning procedure has been notified, the body competent to resolve the procedure, By means of a reasoned resolution, it may exempt you from compliance with the administrative sanction that corresponds to you, provided that the following points are accredited in the file:

To have ceased to commit the offence at the time of submission of the communication or disclosure and to have identified, where appropriate, the rest of the persons who have participated in or favoured it.
Have cooperated fully, continuously, and diligently throughout the investigation proceeding.
Having provided truthful and relevant information, means of proof or significant data for the accreditation of the facts investigated, without having proceeded to destroy or conceal them, or having disclosed their content to third parties, directly or indirectly.
To have proceeded to repair the damage caused that is attributable to him.

When these requirements are not met in their entirety, including partial reparation of the damage, it will be at the discretion of the competent authority, after assessing the degree of contribution to the resolution of the file, the possibility of mitigating the sanction that would have corresponded to the infringement committed, provided that the informant or author of the disclosure has not previously been sanctioned for acts of the same nature that gave rise to the initiation of the procedure.

The mitigation of the sanction may be extended to the rest of the participants in the commission of the infringement, depending on the degree of active collaboration in the clarification of the facts, identification of other participants and reparation or reduction of the damage caused, assessed by the body in charge of the resolution.

Law 2/2023 excludes from the provisions of this section the infringements established in Law 15/2007, of 3 July, on the Defence of Competition.

VII. CONFIDENTIALITY AND DATA PROTECTION

The processing of personal data will be carried out in compliance with Law 2/2023, of 20 February, regulating the protection of persons who report regulatory breaches and the fight against corruption, Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights and of Organic Law 7/2021, of 26 May, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offences and the execution of criminal sanctions.

The personal data subject to processing, the documents provided and any other information provided in the complaint that contains personal information, will be treated confidentially by those responsible for the channel, as well as by the administrators and potential managers, in order to comply with the obligation to investigate and manage the complaint filed as well as to comply with the legal obligations established in Law 2/2023. of 20 February, regulating the protection of persons who report on regulatory breaches and the fight against corruption.

The Internal Information System must prevent unauthorised access and preserve the identity and guarantee the confidentiality of the data relating to the persons concerned and to any third party mentioned in the information provided, in particular the identity of the informant, if identified. The identity of the informant may only be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or sanctioning investigation, and these cases shall be subject to safeguards established in the applicable regulations.

If the information received contains special categories of personal data, subject to special protection, it will be immediately deleted, unless the processing is necessary for reasons of an essential public interest in accordance with the provisions of Article 9.2.g) of the GDPR, as provided for in Article 30.5 of Law 2/2023.

In any case, personal data whose relevance is not manifest to the processing of specific information will not be collected or, if collected by accident, it will be deleted without undue delay.

Communications that have not been processed may only be recorded in an anonymised form, without the obligation to block provided for in article 32 of the LOPDPGDD being applicable.

Access to the personal data contained in the internal information system will be limited to:

The Head of the Channel's Internal System.
To the administrator(s) delegated by the person in charge of the system.
To the managers appointed to process certain complaints according to the area to which they correspond.
The data may be made known to the Legal Department, Lawyers, Judicial Bodies and State Security Forces and Corps in the event that any of the information received is likely to be considered a crime or legal infraction of any kind.

Legal basis for processing: The processing of personal data, in the event of internal communication, will be understood as lawful by virtue of the provisions of Article 6.1.c) of Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, 8 of Organic Law 3/2018, of 5 December, and 11 of Organic Law 7/2021, of 26 May, when, in accordance with the provisions of articles 10 and 13 of the Law, it is mandatory to have an internal information system. If it is not mandatory, the processing will be presumed to be covered by article 6.1.e) of the aforementioned regulation. The processing of personal data in the cases of external communication channels will be understood as lawful by virtue of the provisions of articles 6.1.c) of Regulation (EU) 2016/679, 8 of Organic Law 3/2018, of 5 December, and 11 of Organic Law 7/2021, of 26 May.

Rights of the interested party: access, rectification, deletion, limitation, portability and opposition, free of charge by email to: info@twinpines.es in the cases provided for by law.

Conservation: The data will be kept for the legal period established for the processing of the file and for the time necessary for the exercise of legal actions or, if necessary, to leave evidence of the management of the channel. The interested party has the right to file a complaint with the AEPD in www.aepd.es to request the protection of their rights.

VIII. COMMUNICATION AND REVIEW OF POLICIES AND PROCEDURES

The company will conduct regular trainings and awareness campaigns to foster a culture of integrity and transparency, and to inform employees and other stakeholders about the whistleblowing channel. It will also provide information on the rights and protections offered to whistleblowers under Law 2/2023.

The company undertakes to disseminate this policy to all employees and interested parties, and will update, at least every three years, and, where appropriate, modify this internal channel policy, taking into account the experience gained and the recommendations of the Competent Authorit