RIIS
I. INTERNAL INFORMATION SYSTEM
In compliance with Law 2/2023, of February 20, regulating the protection of individuals who report regulatory violations and combat corruption, hereinafter "Law 2/2023," FONT VERGÉS, S.L. declares that it has an Internal Information System. The company is responsible for processing personal data in accordance with the legislation in force in this area.
To strengthen the culture of information and the integrity infrastructures of the company and promote a culture of communication as a mechanism to prevent actions or omissions that may constitute serious or very serious labour, criminal, or administrative offenses, as well as violations of EU law, the company has appointed a Criminal Compliance Officer (CCO), who is currently the Finance Manager. This individual is also designated as the person Responsible for the Internal Information System (RIIS). Additionally, the company has an Alternate Responsible Person in case the reported information implicates the CCO and RIIS. This alternate person is currently the company’s CEO.
The reports can be submitted to the CCO/RIIS through any of the following means:
• Postal mail to the address: C/ dels Traginers 2, Pol. Ind. La Guàrdia, 08572 Sant Pere de Torelló (Barcelona), addressed to the attention of the CCO/RIIS or the Alternate RIIS, if applicable.
• Email to the address: compliance1@viefe.com for the CCO/RIIS and canaletic2@viefe.com for the Alternate RIIS.
• Written communication delivered directly to the CCO/RIIS or, if applicable, to the Alternate RIIS.
At the request of the reporting person, the communication may also be submitted through an in-person meeting with the CCO/RIIS (or, if applicable, the Alternate RIIS) within seven days.
Oral reports made during an in-person meeting with the CCO/RIIS (or Alternate RIIS) must be documented in one of the following ways, with prior consent from the reporting person:
a) Recording the conversation in a secure, durable, and accessible format.
or
(*) The reporting person will be informed that the communication will be recorded and will be advised about the processing of their data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 (GDPR).
b) Full transcription of the conversation by the responsible personnel.
(*) The reporting person will have the opportunity to review, correct, and sign the transcription.
The Internal Information System complies with the requirements of Article 5.2 of Law 2/2023:
a) It enables individuals covered by Law 2/2023 to report information through various channels regarding the infringements outlined in Article 2.
b) It ensures secure management, confidentiality of the identity of the reporting person and third parties mentioned, and protection of data, preventing unauthorized personnel access.
c) It includes a Protocol for the Internal Information System and the use of internal reporting channels, outlining guarantees for the protection of reporting individuals:
• Acknowledgment of receipt within seven calendar days.
• A maximum of three months to respond to the investigation, maintaining a diligent Record of Information.
• The ability to maintain communication with the reporting person.
• The right of affected persons to be informed and heard.
• Confidentiality guarantees when communications are submitted through unauthorized channels, with an obligation to forward them to the Responsible Person immediately.
• Respect for the presumption of innocence and the honour of affected persons.
• Compliance with Data Protection provisions (Title VI of Law 2/2023).
• Immediate referral to the Public Prosecutor when the facts may constitute a crime.
II. PROCESSING OF PERSONAL DATA
FONT VERGÉS, S.L., as the data controller, will process personal data included in communications covered by Law 2/2023 to manage them, initiate the corresponding investigation, and adopt corrective measures, if necessary.
The legal basis for the processing will be compliance with the obligations imposed by Law 2/2023. If the communication contains special category data, such data will only be processed when it is strictly necessary for the adoption of corrective measures and/or the initiation of the corresponding investigation procedure and/or the processing of applicable sanctioning or criminal procedures, in accordance with current legislation. In such cases, the legal basis will be essential public interest. The processing of personal data will be indispensable when the objectives and obligations stipulated by Law 2/2023 cannot be fulfilled without such data.
Personal data may be processed by authorized personnel only when necessary for the investigation of violations within the scope of European Union law, serious or very serious criminal or administrative offenses, or labour violations in the area of workplace health and safety, for the adoption of corrective measures, or for the processing of sanctioning or criminal procedures, as applicable. Additionally, personal data may be disclosed to third parties when there is a legal obligation to do so and may be communicated to the competent judicial authority, the Public Prosecutor's Office, or the relevant administrative authority within the framework of the aforementioned investigation.
If it is deemed appropriate to adopt corrective measures, the data will be retained for the duration of the implementation of these measures. On the other hand, if it is necessary to initiate sanctioning or criminal proceedings, the data will be retained for the duration of those proceedings.
In any case, if a decision to initiate an investigation into the reported facts is not made within three months, the personal data contained in the communication will be deleted, except for data that must be strictly retained in a blocked state to maintain evidence of the functioning of the SII in accordance with Law 2/2023.
Additionally, personal data that reveal behaviours outside the scope of application of Law 2/2023, as well as personal data deemed inaccurate, will also be deleted, unless such inaccuracy could constitute a criminal offense, in which case the information will be retained for as long as necessary for the judicial procedure.
Finally, it is noted that at any time, the reporting individual may request access to their personal data, its rectification or deletion, or the limitation of its processing, or may object to the processing, as well as exercise the right to data portability, by sending a written request to the postal address C/ dels Traginers 2, Pol. Ind. La Guàrdia, 08572 Sant Pere de Torelló (Barcelona) or the email address info@viefe.com. In case of disagreement with the processing of their data, they may file a complaint with the Spanish Data Protection Agency, the authority responsible for oversight in this matter, located at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es).
III. NON-RETALIATION
FONT VERGÉS, S.L. expressly commits not to engage in acts of retaliation, including threats or attempts of retaliation, against individuals who file a report in accordance with the provisions of Law 2/2023. The company also commits to applying protective measures during the processing of a case for individuals affected by a potential report.
IV. EXEMPTION AND MITIGATION OF PENALTIES
When a person who participated in the commission of the administrative infraction subject to the report is the one who discloses its existence by submitting the information, and provided that the information was submitted prior to the notification of the initiation of the investigation or sanctioning procedure, the competent body to resolve the procedure, through a reasoned resolution, may exempt them from the administrative sanction that would otherwise apply, provided that the requirements outlined in Article 40 of Law 2/2023 are met.
(*) The internal information channel allows the submission of anonymous communications.
(**) While the use of the internal channel is preferred whenever possible, communications may also be directed, as applicable, to the Independent Informant Protection Authority, the relevant regional authorities or bodies, the Public Prosecutor's Office, the European Public Prosecutor's Office, or the competent authority as appropriate.
