Internal information system
I.- INTERNAL INFORMATION SYSTEM
In compliance with Spanish Law 2/2023, of 20 February, regulating the protection of people who report regulatory infringements and the fight against corruption, PROQUIMIA, S.A. (hereinafter "PROQUIMIA" or "the company") hereby states that it has an Internal Information System and that the company is responsible for the processing of personal data in accordance with the provisions of the corresponding legislation in force.
In order to strengthen PROQUIMIA's information culture and integrity infrastructures, and to promote the culture of communication as a mechanism for preventing activities or omissions that may constitute EU violations, criminal offences, or serious or very serious administrative or labour infringements in the field of health and safety, the company has set up a Criminal Compliance Committee (CCP), whose members are also Internal Information System Managers (RSII). This Committee is currently composed of the Director of Integrated Management and the Head of HR. For these purposes, the company’s Director of Integrated Management has been assigned the responsibility for managing this System and for processing the investigation files for the information received through the Ethical Channel (Internal Information Channel), covered by the aforementioned regulations.
This information may be sent by any of the following means:
-By e-mail to firstname.lastname@example.org
-By post to Carretera de Prats de Lluçanès, n.º 6, Vic (Barcelona), Spain, for the attention of the Criminal Compliance Committee and the RSIIs.
-In writing to any of the members of the Criminal Compliance Committee and the RSIIs.
At the request of the informant, the information may also be communicated in a a face-to-face meeting with the members of the Criminal Compliance Committee and appointed RSIIs, within a maximum period of seven days.
Verbal information provided in a face-to-face meeting must be documented in one of the following ways, subject to the consent of the informant:
(a) by a recording of the conversation in a secure, durable and accessible format; or
(*) The reporting person will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016.
- b) with a complete and accurate transcript of the conversation made by staff appointed this responsibility.
Without prejudice to their rights under data protection regulations, the informant shall be given the opportunity to verify, rectify and agree with the transcript of the conversation by signing it.
The Internal Information System complies with the requirements of Article 5.2 of the Law:
a). - It allows persons to whom the law applies to communicate information, by various means, regarding the offences outlined in Article 2 of the law.
b). - It is managed securely, ensuring that communications can be processed effectively within the companies, and also guaranteeing the confidentiality of the informant’s identity and that of any third party mentioned in the communication, and of the actions carried out in the management and processing of the communication, as well as data protection, preventing access by unauthorised personnel.
c). - It includes a Protocol that establishes guarantees for the protection of informants:
- Proof of receipt within seven calendar days of receipt of the information.
- A maximum period of three months to respond to the actions of the investigation, in accordance with the terms of article 9 of the Law, filling out and diligently keeping an Information Logbook.
- Possibility to maintain communication with the informant.
- The guaranteed right of the person concerned to be heard and to be informed of the actions or omissions attributed to them.
- Guarantee of confidentiality when the communication is sent through non-established complaint channels or to personnel who are not responsible for its processing, with the person who receives it being obligated to immediately forward it to the person Responsible for the System.
- Respect for the presumption of innocence and the honour of the persons concerned.
- Compliance with the provisions on Data Protection (Title VI of the aforementioned Law).
- Commitment to forward the information to the Public Prosecutor's Office immediately, when the facts could be indicative of a crime.
II.- PROCESSING OF PERSONAL DATA
As data controller, PROQUIMIA will process the personal data included in the communications received and covered by Spanish Law 2/2023, so that it can manage said data and, where appropriate, initiate the corresponding investigation procedure. The legal basis for the processing shall be the fulfilment of a legal obligation arising from the aforementioned Law. If the communication contains data of a special nature, the legal basis shall be public interest and other provisions established by Article 9(2)(2) of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data.
Likewise, this personal data may be processed and transferred by authorised personnel only when necessary for the adoption of corrective measures within the company or for the processing of any sanctioning or criminal proceedings that may be appropriate, as the case may be. Personal data shall be kept for as long as is necessary to decide whether an investigation into the reported facts should be initiated. In any case, if this decision is not taken within a period of three months, the personal data contained in the communication shall be deleted, except for the purpose of maintaining evidence of the functioning of the system.
Personal data which is not considered to be accurate shall also be deleted, except where such inaccuracy may constitute a criminal offence, in which case the information shall be held as long as necessary for the duration of the legal proceedings.
Finally, it is hereby stated that, at any time, the informant may ask the data controller to access their personal data, to correct or erase it, to limit or oppose its processing, or to assert their right to data portability, by sending an email accompanied by a copy of their identity document to email@example.com. Should you disagree with the processing of your data, you may lodge a complaint with the Spanish Data Protection Agency, which is the supervisory authority in this area, located at C/ Jorge Juan, 6 (28001) Madrid, Spain (www.aepd.es).
PROQUIMIA expressly undertakes not to carry out acts that constitute reprisals, including threats or attempts of reprisals against persons submitting a communication in accordance with the provisions of Spanish Law 2/2023, and to implement protective measures during the processing of a file, with regard to persons concerned by a possible communication.
IV.- EXEMPTION AND MITIGATION OF PENALTIES
When a person who reports information regarding an administrative offence also participated in said offence, (and provided that the information was submitted before notification of the opening of the investigation or sanctioning procedure), the body that is responsible for completing the procedure, by means of a reasoned resolution, may exempt them from the corresponding administrative sanction, provided that the points mentioned in Article 40 of the aforementioned Law are accredited.
(*) The Internal Channel allows the submission of anonymous communications.
(**) Although, whenever possible, preference shall be given to the internal channel, depending on the circumstances and seriousness of the information and if the whistleblower so decides, communications may be sent, where applicable, to the Independent Whistleblower Protection Authority (for these purposes, the Anti-Fraud Office of Catalonia), to the Public Prosecutor's Office or to the European Public Prosecutor's Office, as appropriate