Whistleblower Channel

Object

The purpose of the Whistleblower Channel Policy is to regulate and facilitate the secure formulation of communications regarding (i) alleged irregularities or breaches committed by employees (including interns and trainees), commercial agents, managers or business partners, that may arise in the exercise of the business activity of all the entities that make up the Quintas group as well as (ii) suspicions of irregular conduct, bad business practices, and any violation of Compliance obligations, the Code of Ethics and the Code of Conduct for Business Partners, fostering a Compliance environment based on Quintas' principles and values.

It is the responsibility of the Board of Directors of Quintas to approve this Whistleblower Channel Policy by virtue of which the internal reporting system is implemented in accordance with the Act on the Protection of Persons Reporting Regulatory Offences and the Fight against Corruption transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of Union law (hereinafter "Whistleblower Act").

 

Principles

• To guarantee confidentiality* to all those who wish to make a report through the reporting tools set out in this policy, whether they have identified themselves when making the report or have reported anonymously, also guaranteeing anonymity.
• Ensure proper handling of complaints, which means that they will be treated confidentially and in accordance with this Policy and the Law.
• Ensure, for all complaints received, a timely, independent and confidential analysis within a reasonable period of time, which shall not exceed three months from the acknowledgement of receipt of the complaint.
• Protect the whistleblower against any direct or indirect form of retaliation.
• Conduct disciplinary, disciplinary and judicial proceedings, as appropriate, until they are resolved.

*In no case may confidentiality be understood as an impediment that conditions the possible reporting of the facts to the competent authorities.

 

Scope

Objective scope

It applies to all communications made through the whistleblowing channel regarding doubts, complaints, irregularities and breaches of the Code of Ethics, Code of Conduct for Business Partners and the Criminal Compliance Policy, as well as situations that could generate a criminal risk at Quintas.

Management of situations of mobbing, sexual harassment and harassment based on sex.

Quintas has a specific protocol for reporting and managing situations of moral, sexual and gender-based harassment which, a priori, should be incorporated into the Complaints Channel.

However, given its specificity as well as its transcendence in the area of labour and workers' rights, Quintas prefers to maintain the specific procedure set out in the Protocol for the prevention of moral harassment, sexual harassment and harassment on grounds of sex, independently of that regulated in this policy of the Whistleblowing Channel, and therefore, communications on this matter that are made through the Whistleblowing Channel will activate the Harassment Protocol and will be governed in accordance with its procedure.

Subjective scope

Employees, trainees/trainees, managers, directors, suppliers, business partners and customers of the Quintas group of companies, understood as a group of companies within the meaning of art. 42 of the Commercial Code.

 

Whistleblowing communication tools

Quintas has several ways of communicating a complaint that can be used interchangeably, although the Complaints Channel will be the preferred one:

1. By e-mail: compliance@quintasenergy.com

2. By post: Att. Compliance Area Avd. República Argentina, 25, 4ª planta 41011, Seville

3. Through the Complaints Channel which will be accessed via the Quintas website. https://www.quintasenergy.com

4. Verbally, by telephone via a voice messaging system or by means of a face-to-face meeting). In these cases, the communication shall be documented by means of a recording of the conversation (warning the complainant in advance of the processing of his/her data) or a transcript.

All complaints, regardless of the medium used, should include the following:

• Identification of the complainant and contact details (unless the complainant chooses to do so anonymously).
• Content of the complaint, in which the facts denounced must be described in a concrete and precise manner (the area affected and the date or period of commission and the possible parties responsible).
• The evidence at its disposal.

 

Responsible for the Whistleblowing Channel

The body responsible for managing the compliance channel is the Compliance area, led by the General Counsel, and decision-making and resolution is the responsibility of Quintas' management.

The Compliance area will be responsible for receiving, examining and investigating complaints. However, access to the personal data contained in the Whistleblowing Channel will be limited exclusively to (i) the person in charge of the Whistleblowing Channel and the person who manages it directly, (ii) the person in charge of human resources (when disciplinary measures should be taken against an employee), (iii) the person in charge of Quintas' legal services (if legal measures should be taken in relation to the facts reported), (iv) the persons in charge of data processing that may be appointed and, (v) the Data Protection Delegate.

The Head of the Whistleblowing Channel may delegate or include in the investigation team an external third party to advise him/her during the processing of the complaint. In this case, the external third party shall be subject to the provisions of this Policy, fundamentally in terms of protection of the complainant and the rights of those under investigation.

The Compliance Area (responsible for the Whistleblowing Channel) will draw up a report that will be forwarded to Quintas management with the result of the investigation and will issue a resolution proposal.

 

Procedure for using the complaints channel

Procedure: Phases

I. Start

A common link for the entire Quintas group will be set up on the website for the communication of the complaint, which will be managed by the person in charge of the Complaints Channel.

The Whistleblower Channel is hosted on a platform external to Quintas that guarantees compliance with all the requirements of the Whistleblower Act, especially confidentiality, anonymity and data protection (see Annex I).

The form must be filled in and the complaint must be sent. At this point, a complaint registration code will be generated, which the complainant can use to access the complaint.

 

II. Analysis of the complaint

Once the complaint has been received by the Compliance area, acknowledgement of receipt will be sent to the complainant through the Channel itself, within 7 calendar days of receipt.

In the event that the complaint deals with moral harassment, sexual harassment and/or harassment on grounds of sex, it shall be referred within 3 days to the investigating committee in accordance with the provisions of the Quintas Harassment Prevention Protocol and the complainant shall be informed that his or her complaint will be processed in accordance with the aforementioned Protocol.

The Compliance area will check that the complaint contains the necessary data and will preliminarily examine the facts reported in accordance with the provisions of this Policy, in accordance with the categories set out in Annex II.

If the Compliance area considers that additional information is needed, it may contact the complainant through the Channel.

If so, the content of the complaint:

• does not lead to non-compliance according to the categories in Annex II.
• the facts were manifestly unfounded and without any evidence whatsoever.
• there is no prima facie evidence to support it, or
• the facts were described in a generic, vague or unspecific manner

The complaint will be closed and the complainant will be informed. Otherwise, once the content of the complaint has been verified, the person complained of will be informed of the processing of the complaint, unless it is considered that such communication to the person complained of should be delayed due to the investigation and the investigation will be initiated.

Conflict of Interest

In the event that the complaint directly affects persons who may actively participate in the management and investigation of the complaint, i.e. the Compliance area, they will be automatically excluded during the entire investigation and analysis process until its resolution, in order to avoid any type of conflict of interest or incompatibility, and thus guarantee the objectivity and independence of the actions carried out by the Compliance area itself.

The excluded person shall be obliged to maintain the utmost confidentiality of the complaint, being forbidden to have direct or indirect access to any information about the identity of the complainant and the ongoing investigation process.

 

III. Research

Quintas Compliance will obtain from the complainant or from other sources and by its own means, all relevant information on the reported facts.

The activities undertaken should allow for both the preservation and safekeeping of evidence, as well as respect for the rights of the complainant and the reported person as set out in this Policy and may be:

• Personal interviews in person or by telematic means to obtain and confirm information, which may be recorded or documented by means of a complete and accurate transcript of the conversation, subject to the consent of the complainant.
• Data analysis.
• Obtaining information from accessible external public or private sources.
• Internal audit or independent external audit.

Once the necessary information and evidence has been obtained, the content of the complaint shall be transferred to the defendant, without the complainant's details, so that he/she may be heard and make the allegations that he/she deems appropriate in his/her defence.

Once the investigation has been completed, the Compliance area will issue a report, which will be submitted to Quintas management to establish the measures it deems appropriate.

 

IV. Report

The report drawn up by the Compliance area shall include, among other aspects, its conclusions on the possible infringements detected, possible perpetrators, evidence obtained, statements made by the complainant and the accused and any evidence provided. The report, with the proposed measures to be adopted, will be sent to Quintas management, which will be the body responsible for resolving the case and establishing the corresponding measures.

 

V. Resolution

In the light of the report, the management of Quintas may:

1. Request that the investigation be extended on an exceptional basis, in order to complete some aspect or to understand that it is insufficient.

2. The complaint will be closed and the investigation will be concluded on the grounds that the facts reported do not constitute non-compliance/offences. In the event that it is found that there has been bad faith or malice in the reported complaint, a disciplinary sanction will be imposed in accordance with the Quintas Disciplinary Policy contained in the Employee Handbook, the applicable Collective Bargaining Agreement and the legislation in this area.

3. In the event that the facts that are the subject of the complaint are verified, will proceed to impose disciplinary sanctions in accordance with the Quintas Disciplinary Policy contained in the Employee Handbook, the applicable Collective Bargaining Agreement and the legislation in this area.

If the complaint investigated refers to matters that have or may have a criminal impact, Quintas management will issue a resolution proposal, which must subsequently be confirmed by the Criminal Compliance Committee, which will evaluate possible failures in the control mechanisms, propose improvement actions and analyse, together with Quintas management, the possibility of taking legal or administrative action, including criminal or other actions, as appropriate.

The decision shall be communicated in writing to the complainant and the respondent and may not be delayed for more than 3 months from receipt of the complaint.

 

Whistleblower protection and rights of those under investigation

Whistleblower protection

Persons who report any facts within the scope of this policy shall be protected from retaliation and shall have the following rights and duties:

• Right to confidentiality. Quintas guarantees confidentiality to all those who file a complaint through the established reporting tools set out in this Policy.
• Right not to retaliate*
Quintas guarantees that no retaliatory, discriminatory or disciplinary/punitive action of any kind will be taken against complainants based on the filing of a complaint, unless the complaint is materially unfounded and it is reasonable to believe that the complainant has maliciously made a false statement. In this case, Quintas may take appropriate disciplinary action.
• The right to obtain an acknowledgement of receipt of the complaint within seven days of its receipt.
• The right to be informed of the decision and the closure of the complaint, if applicable within a reasonable period of time, which shall not exceed three months from the acknowledgement of receipt.
• Duty to act in good faith. Allegations made in bad faith, knowing them to be false, will be subject to disciplinary action in accordance with the provisions of the Quintas Disciplinary Policy. In such cases, therefore, the rights of confidentiality and non-disclosure of identity set out above shall not apply.
• Duty to provide data and documents related to the facts reported.
• Duty of confidentiality regarding the making of the complaint and the content of the complaint, during the period of investigation and resolution of the complaint.

*Annex III Definition and examples of reprisals

 

Rights of those under investigation

Reported persons also have a number of recognised rights:

• The right to know that he/she is the subject of an investigation process as a result of a complaint filed against him/her and the actions or omissions attributed to him/her.
• The right to be heard at any time, to present allegations and evidence in his or her defence.
• Right to the presumption of innocence.
• Right to honour.
• The right to be informed of the content of the decision.

 

Protection of personal data

In the management of the Whistleblowing Channel, the applicable legal regulations on personal data protection will be complied with. To this end, the Privacy Policy of the Whistleblowing Channel is attached as Annex I, which sets out all the information necessary for the processing of personal data submitted through the Whistleblowing Channel.

 

Publicity and entry into force

Without prejudice to the obligation of employees to know and act in accordance with the provisions of Quintas' internal policies in the performance of their duties, the proper dissemination of this Policy and the existence of the Whistleblowing Channel shall be promoted and ensured.

This Policy shall become effective upon approval by the Quintas Board of Directors.

 

Annex I Whistleblower Channel Privacy Policy

Quintas Energy, S.A. (hereinafter "Quintas") is committed to data security and the fair and transparent processing of personal data. Our Whistleblower Channel Privacy Policy is designed to comply with the requirements of the Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights, with the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, with Organic Law 7/2021 of 26 May on the protection of personal data processed for the purposes of the prevention, detection, investigation and prosecution of criminal offences and the execution of criminal penalties, and with the Law on the Protection of Informants when it enters into force.

The purpose of this privacy policy is to inform users of the Quintas Whistleblower Channel of our practices relating to the collection, protection and use of any personal data that you provide to us, or that we collect through the Whistleblower Channel. By "personal data" we mean any information about you that can be used to help us identify you. The term "personal data" is further defined in Article 4 of the General Data Protection Regulation (EU) 2016/679. Nothing in this Whistleblower Channel Privacy Policy limits your rights in relation to your personal data.

The Whistleblower Channel is accessed through the website www.quintasenergy.com and is a service provided by Factorial HR.

Please note that when you use the Whistleblower Channel, you are accepting and consenting to our handling of your personal information in accordance with this Whistleblower Channel Privacy Policy. If you do not agree to the terms set forth herein, please do not use the Whistleblower Channel.

 

1. Who is the controller of my personal data?

Quintas Energy, S.A., with registered office at Avenida República Argentina, 25, Planta 4, Modulo 2, 41011 Sevilla, Spain, is responsible for the processing of your personal data collected in the Quintas Complaints Channel located on the website http://www.quintasenergy.com. Contact details Data Protection: privacy@quintasenergy.com

 

2. What information do we collect and process?

The personal data that we process at Quintas by virtue of this Policy originate from the complaint submitted through the Whistleblower Channel by the interested parties who have an employment, commercial and/or service provision relationship with Quintas.

 

3. What are the purposes of collecting and processing your data and why do we have the right to do so?

At Quintas we process the information provided by users of the Complaints Channel for the purpose of processing complaints and, where appropriate, investigating the reality of the facts reported.

Quintas is entitled to collect and process the data because it is necessary for the fulfilment of a legal obligation applicable to the data controller; (6.1c) Regulation).

Likewise, the data subject's consent legitimises us for the storage and recording of complaints made through the Complaints Channel (those that are not anonymous) or complaints made through other channels, such as complaints made verbally or by telephone, with written ratification by the complainant and by voice messaging systems with recording. As well as for the recording of the personal meeting requested with Quintas for the purpose of reporting.

The data subject has the right to withdraw such consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

We do not take decisions that may affect you based solely on the automated processing of your data.

 

4. How we process and store your personal data?

The information we collect from you is stored on the servers of EVERYDAY SOFTWARE, S.L. ("Factorial HR") and the server on which your data is stored is located in the European Economic Area. You can find more information about their privacy policy here: https://factorialhr.es/privacidad.

We do not need to make international transfers of your personal data to countries that do not have an equivalent regulation to the European one.

 

5. Preservation of the Identity of the informant and of the persons investigated: Access and addressees

Anyone who submits a complaint to the Quintas Whistleblowing Channel has the right not to have their identity disclosed to third parties.

Therefore, access to the personal data contained in the Whistleblowing Channel shall be limited exclusively to (i) the person in charge of the Whistleblowing Channel and whoever manages it directly, (ii) the person in charge of human resources (when it is necessary to take disciplinary measures against an employee), (iii) the person in charge of Quintas' legal services (if it is necessary to take legal measures in relation to the facts reported), (iv) the persons in charge of processing that may be appointed, and (v) the data protection officer (if there is one).

The Quintas Whistleblowing Channel has appropriate technical and organisational measures in place to preserve the identity and guarantee the confidentiality of the data corresponding to the persons investigated by the information provided, especially the identity of the informant in the event that he/she has been identified.

Please note that the identity of the informant may only be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority in the context of a criminal, disciplinary or disciplinary investigation.

 

6. What rights can you exercise?

You may exercise your rights of access, rectification, deletion and portability, limitation and/or opposition to processing by sending the corresponding communication to the postal address indicated above in this Privacy Policy of the Whistleblowing Channel or to the e-mail address privacy@quintasenergy.com, indicating "Exercise of Rights" as the subject of the e-mail.

Any person has the right to obtain confirmation as to whether or not Quintas is processing personal data concerning them.

Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected. You also have the right to data portability.

In certain circumstances, data subjects may request that we limit the processing of their data, in which case we will only retain the data for the purpose of exercising or defending claims.

In certain circumstances and for reasons related to their particular situation, data subjects may object to the processing of their data. In this case, Quintas will stop processing the data, except for legitimate reasons, or the exercise or defence of possible claims.

If you consider that the processing of your personal data violates the regulations, you can file a complaint through the postal address indicated in this Privacy Policy of the Complaints Channel or to the e-mail address privacy@quintasenergy.com

If you are not satisfied with the exercise of your rights, you may lodge a complaint with the competent Data Protection Supervisory Authority via its website: https://www.aepd.es/es

 

7. How long do we keep the personal data obtained through the Whistleblowing Channel?

The data processed may be kept in the Whistle-blowing Channel only for the time necessary to decide whether to initiate an investigation into the facts reported.

In any case, they shall be deleted after three months have elapsed from the receipt of the complaint without any investigation having been initiated, unless the purpose of the storage is to leave evidence of the operation of the system.

Once this period has elapsed, the data may continue to be processed by the Compliance area, not being retained in the Complaints Channel itself.

Complaints that have not been followed up may only be recorded in anonymised form.

 

8. Policy update

Please note that this Whistleblower Channel privacy policy may need to be updated periodically to reflect changes in our practices and in the law. We recommend that you check this page regularly to ensure that you have read the most recent version of the document and that you are happy with any changes.

 

9. Security measures

We take all steps reasonably necessary to ensure that your data is treated securely. Unfortunately, sending information to us over the internet is not completely secure and sometimes such information can be intercepted. Therefore, we cannot guarantee the security of any information you choose to send us electronically and you do so at your own risk.

 

10. Contact us

If you have any comments or questions about this Whistleblower Channel privacy policy, please contact us by email at privacy@quintasenergy.com . You can also write to us at Quintas Energy, S.A. Avenida República Argentina, 25, Planta 4, Modulo 2, 41011 Sevilla, Spain.

 

Annex II Categories of communications to the whistleblowing channel

Reportable events must focus on conduct, breaches or irregularities that may go against the principles and values of the Code of Ethics and Conduct for Quintas Business Partners, or constitute an unlawful act or an act contrary to the applicable regulations.

The following is a non-exhaustive list of categories of possible reportable events:

 

Annex III Definition and examples of actions considered as retaliation

Definition of retaliation

The Whistlerblower Act includes a broad concept of retaliation:

"any acts or omissions which are prohibited by law, or which directly or indirectly result in unfavourable treatment placing the persons concerned at a particular disadvantage compared with another person in the employment or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure, and provided that such acts or omissions occur during the investigation procedure or within two years of the completion of the investigation procedure or of the date on which the public disclosure was made. An exception shall be made where such act or omission can be objectively justified by a legitimate aim and the means of achieving that aim are necessary and appropriate".

 

Examples of retaliation

• Suspension of the employment contract, dismissal, early termination of contracts for goods or services, imposition of disciplinary measures or modifications of working conditions (unless these measures were legally protected and imposed due to circumstances, facts or violations that were accredited and unrelated to the submission of the communication).
• Damage (including reputational damage), financial loss, coercion, intimidation, harassment or ostracism.
• Negative evaluation of professional performance.
• Blacklisting or dissemination of information in a particular sectoral area, which hinders or prevents access to employment or the contracting of works or services.
• Cancellation of a licence or permit.

 

Measures to protect against retaliation

The Whistleblower Protection Bill provides for the following protection measures:

• The reporter shall incur no liability of any kind for accessing or acquiring the information that is reported and for the disclosure of that information (unless such access or disclosure constitutes a criminal offence).
• In labour court proceedings concerning prejudice suffered by whistleblowers, it shall be presumed that the prejudice occurred in retaliation for reporting, and therefore the burden of proof shall be on the person who has taken the prejudicial action to prove that the action was based on justified grounds and not linked to that reporting (this is a reversal of the burden of proof).