Management of the Internal Information Channel

INTRODUCTION

The collaboration of all organization members is indispensable for the effectiveness of standards and their compliance. This collaboration is manifested not only in the correct personal fulfillment of obligations incumbent upon each individual but also in the collective commitment to the proper functioning of internal processes.

For this reason, this procedure establishes the regulation of the operation of an internal information channel through which MARSET employees and collaborators can communicate any irregularity of varying severity, particularly when these irregularities involve a risk of committing criminal acts.

In the development of this procedure, the provisions of Law 2/2023 of February 20, governing the protection of individuals reporting breaches of regulations and the fight against corruption (hereinafter, Law 2/2023), which integrates national law and responds to the Spanish legislator’s obligation to transpose DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of October 23, 2019, concerning the protection of persons reporting breaches of Union law, have been taken into account.

1. MATERIAL SCOPE

This document aims to establish the internal information system for managing, investigating, and responding to any communication made by the informant regarding:
• Actions or omissions that may constitute a serious or very serious criminal or administrative offense. In all cases, all serious or very serious criminal or administrative offenses causing economic harm to public finances and social security will be considered included. • Actions or omissions contrary to MARSET’s internal procedures or regulations related to the ethical exercise of professional functions. • Actions or omissions that may constitute violations of European Union law, taking into account the specificities indicated in Article 2.1(a) of Law 2/2023.

This material scope may be referred to as the “normative framework.”

2. PERSONAL SCOPE

Entities included in this procedure:

• MARSET ILUMINACIÓN, S.A.
Hereinafter, it will be referred to as MARSET.

This procedure will apply to:
• Individuals with the status of employees. • Independent workers in relation to MARSET. • Shareholders, participants, and individuals belonging to the administrative, management, or supervisory body, including non-executive members. • Anyone working for or under the supervision and direction of contractors, subcontractors, and suppliers in relation to MARSET.

3. MEANS OF COMMUNICATING INFORMATION

The communication of any request or information must be processed if received through a physical reporting box.
In addition, an in-person meeting with personnel responsible for information processing may be requested through any of the enumerated channels.

Henceforth, these information reception channels will be jointly referred to as the Internal Information Channel.

Confidentiality must be ensured when the communication is sent through reporting channels other than those established or to personnel not responsible for their processing. The recipient will have the obligation to immediately forward it to the System Manager.

4. FIGURES OR ELEMENTS MANAGING THE INTERNAL INFORMATION CHANNEL

System Manager: Responsible for the management of the organization’s Internal Information Channel and the diligent processing of the provisions contained in this procedure.
If the option is chosen for the System Manager to be a collegial body, it must delegate to one of its members the powers to manage the internal information system and process investigation files.

Informant: Person reporting a risk or violation of MARSET’s normative framework and legal provisions.

Affected Person: Worker or collaborator to whom, according to this procedure, the commission of one or more violations of MARSET’s normative framework or legal provisions is attributed.

5. FUNCTIONS OF THE SYSTEM MANAGER

The person responsible for processing information requests is the Internal Information System Manager, and they have the following responsibilities.

1. Carry out their functions independently and autonomously from other bodies of MARSET, without receiving any instructions in their exercise.

2. Ensure, in collaboration with the Data Protection Officer (DPO) or an equivalent figure, compliance with national and European regulations on the protection of personal data of all individuals involved in the system.

3. Manage and ensure the proper functioning of the Internal Information Channel, in accordance with the provisions of this procedure or legal provisions.

4. Guarantee the confidentiality of all individuals involved in a communication and/or investigation.
5. Maintain direct contact with the informant (bidirectional).

6. Inform the informant of the status of their information and its resolution.

7. Present an activity report of the Internal Information Channel at least annually.

The System Manager will be aware that the failure to comply with their duties of confidentiality and preserving anonymity in the execution of tasks contained in this document may constitute a very serious offense under Law 2/2023 of February 20, governing the protection of individuals reporting breaches of regulations and the fight against corruption.

6. OBLIGATION TO INFORM
All individuals described in Section 3 of MARSET must ensure compliance with the provisions of the normative framework. Therefore, it is their duty to report any risk or non-compliance with the normative framework or any other internal MARSET standard aimed at ensuring the respect of fundamental rights.

This obligation to inform applies without prejudice to the informant’s ability to appeal directly to the organization’s bodies or competent authorities.

7. DOCUMENTATION RETENTION

The data of the person filing the communication and of the employees and third parties mentioned in it must be kept in the information reception system only for the time necessary to decide whether to initiate an investigation into the reported facts.

In any case, three months after entering the data, it must be deleted from the information system. Information that has not been processed can only be kept in anonymized form.

8. INFORMATION MANAGEMENT PROCEDURE

8.1 Preliminary analysis of received information

Upon receiving information through the Internal Information Channel, the Responsible Party of the Internal Information System will review if the information contains the following elements:

1. Identification of the informant and contact details (not applicable in the case of an anonymous report).
2. Clear and complete indication of the alleged facts, including:
• Possible individuals involved.
• Type of non-compliance.
• Detailed description of the facts or potentially irregular conduct.
• Approximate date of occurrence.
• Formulated in a respectful manner, non-insulting, and without obvious signs of bad faith.
3. If applicable, submission of evidence, documents, or witnesses regarding the reported facts.

8.2 Admission to processing

Upon receiving the information, the Responsible Party of the Internal Information System must decide whether to admit the information for processing or not.

Communications will be rejected if they:

1. Lack sufficient indications of credibility.
2. Address conduct that does not constitute a violation of the regulatory framework.
3. Clearly lack foundation or show rational indications of being obtained through the commission of a crime.
4. Do not contain new and significant information about violations compared to a previous communication for which the corresponding procedures have concluded, unless new facts or legal circumstances justify a different follow-up.
5. Is explicitly provided for in the organization’s internal regulations to be managed by another MARSET body or through another communication channel.

8.3 Information Record

8.3.1 General Criteria

Once admitted for processing, the Responsible Party of the Internal Information System will proceed to record the file.

This record must be retained only by the Responsible Party of the Internal Information System, whether in physical or digital format, applying the security measures corresponding to special categories of data (EU Regulation 679/2016). The record can only be accessed by the Responsible Party of the System and those managing it directly, the human resources manager, or the duly designated competent body, only when disciplinary measures against an employee could be taken, MARSET’s legal services manager or body, if legal measures are taken regarding the reported facts, the data processors that may be designated, and the Data Protection Officer (Article 32, Law 2/2023, of February 20, regulating the protection of persons reporting regulatory violations and corruption).

In addition, those making the report through the INTERNAL INFORMATION CHANNEL will be informed, clearly and accessibly, about external channels of information to competent authorities, and, if applicable, to institutions, bodies, or agencies of the European Union.

They will also be expressly informed that their identity will be kept confidential in any case and will not be disclosed to the persons referred to in the reported facts or to third parties.

8.3.2 In-person Meeting

When a person requests an in-person meeting and uses that method to report, subject to the informant’s consent and within a maximum period of seven days, complete and accurate records of the meeting may be retained in a durable and accessible format. The meeting can be documented in one of the following ways:

• By recording the conversation in a durable and accessible format,
• or through a detailed record of the meeting prepared by the personnel responsible for handling the information.

Without prejudice to the rights afforded by data protection regulations, the informant will be offered the opportunity to verify, rectify, and accept the transcription of the conversation by signing it.

8.4 Acknowledgment of Receipt and Request for Extension

Within seven days of receiving the information, the responsible party of the internal information system will communicate an acknowledgment of receipt to the informant, if possible, unless doing so could jeopardize the confidentiality of the communication or informant.

If the information lacks any of the elements provided in section 9.2, the Responsible Party of the Internal Information System may ask the informant to complete the necessary aspects or correct any formal defects.

In any case, the identification of the informant will not be required, and the processing of anonymous information will be accepted.

8.5 Accumulation of Information

If there are reports of information on the same facts, they will be accumulated into a single file. If there are reports of information about the same facts before different bodies within the administration, the body that has regulatory authority over the reported facts will be competent.

8.6 Investigation Phase

Throughout the investigation process, the right to the presumption of innocence and the honor of the individuals involved will be respected.

Admitting information for processing will lead to opening a file (with a unique identification code), initiating the investigation phase, which will be led by an Instructor.

During the investigation, the Responsible Party will have the powers of management and processing of the files and may carry out all the necessary diligences for the clarification of the reported facts, such as reviewing documents or records, analyzing processes and procedures, conducting interviews, etc., always an essential diligence being the examination of the evidence provided by the informant.

All MARSET personnel must cooperate with the Responsible Party in whatever is required of them.

The information will be sent to the Public Prosecutor’s Office immediately when the facts could be indicatively constitutive of a crime. In the case of facts affecting the financial interests of the European Union, it will be referred to the European Prosecutor’s Office.

Once all the information and evidence are gathered, the affected person will be given the opportunity to submit allegations within a specified period to exercise their right to defense at any time. This procedure, by completion or expiration of the period, will end the investigation phase.

8.7 Incompatibilities

If the information is directed against the Responsible Party of the System or, where applicable, against a member of the collegiate body, they will refrain from participating in the processing of that information, and another person within the body or expressly designated by the MARSET Administration will be responsible for conducting the procedure. Likewise, if the informant or affected person has a relationship of kinship (by affinity or consanguinity), a relationship of friendship or enmity, or belongs to the same Department or Secretariat as the Responsible Party, they will be automatically disqualified from participating in that specific procedure. In this case, the collegiate body or the MARSET Administration will appoint, on a provisional basis, a new Responsible Party for the processing and management of the file.

The incompatibility of the Responsible Party to participate in a procedure may be alleged by themselves or by any of the parties involved in the process.

8.8 Resolution and Application of Disciplinary Measures

The resolution can be of two types:

• Archive: if there is insufficient evidence or if, after conducting the investigation, no violation can be concluded.
• Proposal to adopt measures in case it is concluded that irregularity or non-compliance has occurred. This proposal for the adoption of disciplinary measures will be submitted to the corresponding body with disciplinary power and must contain:

 Identification of the involved parties;
 Nature of the irregularity or non-compliance;
 Relation of relevant facts or discoveries;
 Conclusions or evaluation of the facts;
 Proposal for disciplinary measures;

In these cases, the communication of the events to the competent authorities may also be considered, depending on their gravity or legal significance.

8.9 Prohibition of Retaliation

In accordance with current legislation, this procedure explicitly prohibits retaliation against informants for reporting, including threats of retaliation and attempts at retaliation, particularly in the form of:

• Suspension, dismissal, removal, or equivalent measures;
• Degradation or denial of promotions;
• Job reassignment, change of workplace location, salary reduction, or change of working hours;
• Denial of training;
• Negative evaluation or references regarding their work results;
• Imposition of any disciplinary measure, reprimand, or other sanction, including pecuniary penalties;
• Coercion, intimidation, harassment, or ostracism;
• Discrimination or unfair or unjust treatment;
• Non-conversion of a temporary employment contract into a permanent one, if the worker had legitimate expectations of being offered permanent employment;
• Non-renewal or early termination of a temporary employment contract;
• Damages, including to reputation, especially in social media, or economic losses, including loss of business and income;
• Inclusion in blacklists based on a sectoral, informal, or formal agreement, which may imply that the person will not find employment in that sector in the future;
• Early termination or cancellation of contracts for goods or services;
• Denial or cancellation of a license or permit; • Medical or psychiatric references.

8.10 Resolution Deadline

The maximum period for responding to investigation actions cannot exceed three months from the receipt of the communication or, if no acknowledgment of receipt was sent to the informant, three months from the expiration of the seven-day period after the communication was made, unless there are special circumstances that require an extension of the deadline, in which case, it may be extended for a maximum of an additional three months.

8.11 Communication of the Resolution

Once the investigation is concluded, both the informant and the affected person will receive a communication with the meaning of the resolution (unless the informant is anonymous and untraceable).

8.12 Protection of Personal Data

The data provided through the Internal Information Channel will be processed by MARSET for the management of the communication received through the Internal Information Channel, as well as for conducting any necessary investigations to determine the commission of the violation. Access to the information will comply with this procedure and current legislation on the protection of personal data.

MARSET undertakes to treat the personal data received through the Internal Information Channel at all times, absolutely confidentially, and in accordance with the purposes set out in this procedure, adopting the necessary technical and organizational measures to ensure the security of the data and prevent its alteration, loss, processing, or unauthorized access, taking into account the state of technology, the nature of the stored data, and the risks to which they are exposed, and complying with the provisions of the legislation on the protection of personal data.

Under no circumstances will personal data that is not necessary for the knowledge and investigation of actions or omissions be subject to processing, and they will be immediately deleted if applicable. Likewise, all personal data communicated that refer to behaviors not included in the scope of the law will be deleted.

If the information received contains personal data included in special categories of data, it will be immediately deleted without being recorded and processed. (Article 32 of Law 2/2023, of February 20).

Information that is not truthful will also be deleted, starting from the moment it is known, unless the lack of truthfulness constitutes a criminal offense. In that case, the information will be kept for the time necessary for the processing of the judicial procedure.

The identity of the informant will not be disclosed without their express consent to anyone other than an authorized member of the personnel competent to receive or follow up on information. This also applies to any other information from which the identity of the informant can be directly or indirectly inferred.

As an exception to the above, the identity of the informant may only be disclosed when it constitutes a necessary and proportionate obligation imposed by current laws, in the context of an investigation carried out by national authorities or within the framework of a judicial process, particularly to safeguard the defense rights of the affected person. The informant will be notified before disclosing their identity unless such disclosure could compromise the investigation or judicial procedure.

The processing of special categories of personal data for reasons of an essential public interest, which must be proportional to the objective pursued, essentially respect the right to data protection, and establish appropriate and specific measures to protect the interests and fundamental rights of the affected person, in accordance with Article 9.2 g) of Regulation (EU) 2016/679 on Data Protection.

In any case, the responsible party of the internal information system will use, in each data collection form, the legends required by the law to inform the interested parties clearly about the purposes, treatments, and other aspects related to their personal data required by current regulations.

Individuals making a report through the Internal Information Channel must ensure that the personal data provided are true, accurate, complete, and up-to-date.

9. COMMUNICATION AND DISSEMINATION OF THE PROCEDURE

MARSET will communicate this procedure to the profiles of the organization that may participate in its management.

10. EXTERNAL CHANNELS

Any natural person may report to the Independent Authority for the Protection of Informants, A.A.I., or to the corresponding regional authorities or bodies, the commission of any actions or omissions included in the scope of Law 2/2023, of February 20, regulating the protection of persons reporting regulatory violations and corruption, either directly or by prior communication through the internal channels described in this policy.

11. NON-COMPLIANCE

Failure to comply with any internal MARSET regulations may result in a punishable offense. Therefore, the breach of this procedure may be subject to disciplinary measures.

12. APPROVAL, UPDATING, AND EFFECTIVENESS

The Administration/Governing Body, on November 24, 2023, approved this procedure, which will enter into force on December 1. Its validity will be maintained until modified or repealed by a subsequent one.

The procedure will be subject to periodic review, and, if necessary, updating, as well as extraordinary reviews in the event of significant changes affecting MARSET (regulatory changes, changes in the organization’s structure or control structure, etc.).