Procedure for handling reports

1. Receipt

Each report received through the form is given a tracking code. The reporting person chooses a password and, with the code and the password, can check its status, read the replies and add information at any time, even if the report is anonymous.

Verbal reports, made at an in-person meeting, are documented in a written record that the reporting person can review, correct and accept using their code.

Reports are received by the System Manager (Responsable del Sistema). If a report concerns them, they abstain from taking part and the company entrusts its handling to an independent third party.

2. Acknowledgement of receipt

The channel confirms receipt immediately, on screen and, if the reporting person has left an email address, also by email (without the content). In any event, within seven calendar days of receipt.

The reporting person may also, at any time, go to the external channels: the Autoridad Independiente de Protección del Informante (Independent Authority for Whistleblower Protection), the Oficina Antifrau de Catalunya (Anti-Fraud Office of Catalonia) and, in matters of money laundering, Sepblac; and, where appropriate, the institutions, bodies or agencies of the European Union.

3. Admission

Whoever handles the report assesses whether it is admitted for processing. It may be rejected if the facts are not credible, if they are not one of the breaches covered by the channel, if it is manifestly unfounded or if it repeats an earlier report without new information. The reporting person is told the reason.

4. Investigation

Any necessary evidence is gathered, further information may be requested from the reporting person, and the person concerned is heard; they are informed of the facts attributed to them at the appropriate time so as not to frustrate the investigation.

If the facts may constitute a criminal offence, the information is immediately forwarded to the Ministerio Fiscal, the Spanish Public Prosecutor’s Office (or to the European Public Prosecutor’s Office, if they affect the financial interests of the European Union).

5. Time limit and response

A response is given within a maximum of three months from receipt. In particularly complex cases, the time limit may be extended once, by a further three months, with an explanation of why. When the report is closed, the reporting person is told the conclusion.

6. Register and retention

All reports and investigations are entered in a register, which is not public and can only be seen by whoever handles each report.

If, within three months of receipt, a report has not been admitted or investigated, its content is deleted and only a line without personal data remains in the register. In no case are the data kept for more than ten years.

7. Duty of secrecy

Whoever manages the channel keeps secret the identity of the reporting person and everything they learn through the channel, even after they stop managing it.