CERBA GROUP WHISTLEBLOWER POLICY FOR SPAIN

Protection of whistleblowers anti-corruption and regulatory breaches

1. PURPOSE

Through the Communications Management Policy (hereinafter, the “Whistleblowing Policy”), Cerba International (or, indistinctly “Cerba Group”) aims to establish a clear and transparent framework for the communication of inappropriate, illegal conduct or conduct contrary to the ethical principles of our organisation. This is why the company recognises the importance of fostering a culture of integrity and responsibility, where all employees of our organisation feel safe and protected when reporting any irregularities they may witness or know about.

In this regard, this policy seeks to establish a confidential and secure channel for employees, suppliers, customers, and any other interested parties to anonymously report any concerns or violations of our internal policies or current legislation.

Our organisation is committed to impartially and diligently investigating all communications received and will take appropriate action to address any wrongdoing identified, while respecting the principle of proportionality. We also ensure that no retaliation will be taken against any bona fide whistleblower, thereby protecting their identity in accordance with applicable law and the procedures set out in this policy.

In summary, the primary objectives for which Cerba International adopts the Whistleblowing Policy are as follows:

  1. To provide a secure and confidential avenue for employees, suppliers, customers, and other stakeholders to report in an appropriate and timely manner any concerns or suspicions of wrongdoing.
  2. To foster a culture of integrity, ethics, and compliance within the organisation, promoting individual and collective responsibility in the detection and prevention of misconduct.
  3. To investigate reports received in an impartial and efficient manner, ensuring that appropriate action is taken to address identified irregularities and prevent their recurrence.
  4. Protect whistleblowers from any form of retaliation, discrimination, or negative consequences because of their good faith reporting.
  5. Provide clear and transparent communication about the procedures and resources available for making a report, as well as provide appropriate training and guidance to all members of the organisation.
  6. Regularly monitor and review the effectiveness of this policy, adjusting as necessary to ensure compliance and continuous improvement.

We therefore invite all employees of our organisation to familiarise themselves with the principles and procedures set out in this Whistleblowing Policy, and to use the communication channels integrated in the internal information system provided by Cerba International in a responsible and ethical manner, thus maintaining a safe, ethical and transparent working environment, where integrity is promoted and the interests of our organisation, as well as those of the other parties involved in the market, are protected.

2. DEFINITIONS

The following definitions will assist in understanding the application of terms used throughout this Whistleblowing Policy:

Misconduct, breach, wrongdoing, irregularity (without distinction) or offence

Any act or omission in breach of an Internal Policy and/or law within the scope of this Whistleblowing Policy (see section 2 – Scope and Scope of the Whistleblowing Policy).

Communication or information

Statement made by an informant (or whistleblower) through one of the communication channels and through which an irregularity or offence is noticed.

Whistleblower

A person who submits a report after having witnessed or learned by reference of the commission of an irregular act by a third party, who could potentially have breached the law or internal or external policies.

Channels of communication

Reporting channels through which whistleblowers may communicate or report any irregularities or wrongdoing in relation to positive laws or internal or external policies.

Any communication made through Cerba International’s communication channels will be confidential and protected from retaliation.

Positive law

It is any legal provision emanating from an authority, which is mandatory, and its effects are enforceable against any subject that the law itself indicates.

Employee

Employees, contractors, suppliers, and any other person who has an employment or business relationship with the company.

3. SCOPE AND SCOPE OF THE WHISTLEBLOWING POLICY

Cerba Internacional’s Whistleblowing Policy affects all employees of the organisation who have knowledge or suspicions of improper conduct, irregularities and/or violations of the policies, procedures, protocols, and laws applicable to the organisation.

In this sense, the non-observance of the dispositions contained in the present document could derive in the adoption of the corresponding disciplinary measures, as well as the provision of the facts object of persecution to the authorities, when these could have a criminal nature.

Likewise, Grupo Cerba reserves the right to take the corresponding legal and disciplinary actions if false or malicious allegations are made with the purpose of damaging the company or third parties.

Based on the content of this section, the organisation will understand that improper or irregular conduct is committed when the non-compliance contravenes any of the following areas:

  • Legal regulatory frameworks.
  • External policies owned by third parties to which Cerba International has agreed to abide.
  • Cerba International’s Protocol on Sexual, Gender and Moral Harassment.

4. RESPONSIBILITIES

Cerba International, in accordance with the organisational structure of the entity, has identified the following roles to fulfil the inherent responsibilities of the position, consisting of:

The Board of Directors

  • The Board of Directors shall be responsible for the implementation of the Internal Reporting System in consultation with the legal representatives of the employees.
  • The Board of Directors shall be responsible for the appointment, removal, or dismissal of the members of the body responsible for the internal information system, which is a collegiate body.
  • To make available to the Head of the Internal Information System the human, organisational and material resources necessary to ensure regulatory and legal compliance.
  • He/she shall be responsible for approving the information management procedure.
  • Regularly supervise the reports received, the investigations carried out and the actions taken in response to them.

Senior Management

  • Establish and promote a culture of transparency and ethics in the organisation.
  • Ensure that effective whistleblowing policies and procedures are implemented and maintained.

The head of the Internal Reporting System

  • Supervise the correct functioning of the communication channels set up by the entity.
  • Process all information received through the communication channels, initiating the relevant actions in accordance with the communications management procedure.
  • Maintain the confidentiality of the identity of the whistleblower, unless required by law or necessary to carry out a proper investigation.
  • Refer information received to the Anti-Harassment Committee when it could be inferred that a moral, sexual and/or gender-based harassment offence has been committed.
  • Carry out a preliminary analysis of the content of the information received through the communication channels provided.
  • Request additional information from the informant of a communication when there is a need to expand on the details of the report.
  • Admit or reject and file a communication when it does not fall within the scope of the internal information system.
  • Communicate to the reporter the admission or inadmissibility of the communication submitted. Likewise, it shall also notify the reported person of the opening of an investigation file, where appropriate, for the alleged irregular acts imputed to him/her.
  • Where appropriate, assign to the Investigating Body the investigations resulting from the communication received.
  • Informing the Board of Directors of the relevant company of the Cerba Group about the suspected criminal nature of certain specific acts.
  • Coordinate with other areas of the relevant company of Cerba International when necessary for the adoption of corrective measures of the entity, as well as for the processing of the sanctioning or criminal proceedings that, if applicable, may be appropriate.
  • Submit an annual report to the Board of Directors of the relevant company of Cerba Internacional, informing on the receipt, management and conclusions taken with respect to those communications submitted by the reporting persons, as well as the measures adopted.

In this regard, the responsibilities listed above shall be carried out by the following functions:

  • Chief Executive Officer (CEO)
  • Chief Financial Officer (CFO)
  • Chief Information Officer (CIO)
  • Commercial Director
  • Technical Director
  • People Director

The designated persons also form part of the Ethics Committee of Cerba España, although both corporate bodies are independent of each other, and the identities of the persons who form part of them may not coincide at any time.

Employees and other collaborators of Cerba International must

Comply with the whistleblowing policies and procedures established by the organisation.

Report any misconduct or suspicious behaviour in a timely and accurate manner, using established whistleblowing channels.

To the extent possible, cooperate to the extent possible in investigations conducted in connection with the reports submitted.

Whistleblowers

Submit reports in good faith, based on credible and verifiable information.

  • Not submit false reports. In such a case, the submission of a malicious report will be considered irregular conduct and, therefore, the competent Cerba Group company reserves the right to take appropriate disciplinary and/or legal action.
  • Cooperate fully in the investigations carried out in connection with the reports submitted.

Instructor body

The Head of the Internal Information System may designate one of the internal functions of the organization as the Investigating Body for investigations. Where this is the case, the member(s) of the Investigating Body (consisting of the System Manager and/or the internal functions) shall:Tener plena observancia de las políticas y procedimientos de whistleblowing establecidos por la organización

  • Have full observance of the whistleblowing policies and procedures established by the organization.
  • Conduct appropriate investigative steps commensurate with the merits of the case.
  • Preparation of meeting minutes when the members of the body meet with the parties involved, as well as with third parties relevant to the clarification of the reported facts.
  • Preparation of a report of conclusions after closing the investigation file, which will be sent to the Head of the Internal Information System.

The Anti-Harassment Committee (AC)

  • Comply with the whistleblowing policies and procedures established by the organization.
  • Handle all reports received regarding harassment in accordance with the company’s Harassment Protocol.
  • Provide guidance and support to persons reporting harassment and those involved in whistleblowing investigations.
  • Maintain the confidentiality of information related to reports and investigations.
  • Take appropriate measures to protect whistleblowers and witnesses from retaliation or discrimination.

The Human Resources department

  • Respond to requests for collaboration from the Head of the Internal Reporting System or the Anti-Harassment Commission, providing advice and support in the management of communications.
  • Provide guidance on legal actions that may be taken in response to reports received.
  • Maintain the confidentiality of information related to reports and investigations carried out.

The legal department

Respond to requests for collaboration from the Head of the Internal Reporting System, providing advice and support in the management of communications.

Adopting disciplinary measures against an employee when appropriate, always respecting the principle of proportionality.

Maintain the confidentiality of information related to the reports and investigations carried out.

The internal audit department

  • Conduct periodic reviews of the whistleblowing process, assessing the correct application of the Communication Management Procedure and evaluating its effectiveness and compliance.
  • Inform the Board of Directors of any findings or recommendations related to the whistleblowing process.
  • Attending to and collaborating with possible requirements of the Head of the Internal Information System or the Investigation Team in the investigation of the facts subject to prosecution.

The above responsibilities are critical to ensuring the effectiveness of and compliance with the Whistleblowing Policy.

Any breach of these responsibilities may result in disciplinary action, including termination of employment or contract termination. Likewise, when the breach is carried out by an external collaborator of the entity, Cerba International will take appropriate legal action.

5. WHISTLEBLOWING PROCESS

5.1 Communication

Any collaborating person (See section 2) who becomes aware of a fact or omission that could be an infringement or constitute a breach of the internal or external regulations of Cerba Internacional, must report it as soon as possible through the communication channels enabled by the entity, such as:

5.2 Classification

Upon submission of the communication by the informant, the Responsible for the Internal Information System shall acknowledge receipt of the communication, unless this could jeopardize the confidentiality of the information shared.

The System Manager, after notifying the informant of the acknowledgement of receipt, shall carry out a preliminary analysis of the information received and, depending on its content, shall:

  • Admit the communication for processing and proceed with the opening of the Instruction Phase, provided that an eventual action or omission could be inferred that has the nature of an infringement or violation of the internal or external regulations applicable to Cerba International.
  • To admit the communication and to rule on the file, arguing a justification.

To ensure that the choice of the System Manager is adjusted to the needs of the case that arises, this function may involve other positions, both for the preliminary analysis and for the investigation phase in case of admitting the communication.

Likewise, all those persons legally foreseen and competent for the knowledge of the facts and data reported in the communications shall be informed of their duty to respect the principle of confidentiality and, therefore, not to share any details contained in the information forming part of the investigation procedure.

The System Manager may seek the support of external consultants for the preliminary analysis and the investigation process.

5.3Notification

When the System Manager has made one of the above decisions, he/she shall communicate it to the informant, indicating briefly what the failure entails.

5.4Investigation

If the Head of the Internal Information System has admitted the communication in question for processing, the Investigation Phase shall be opened, thus initiating the corresponding Investigation File and appointing ad hoc the Investigating Body that will carry out the investigation of the reported facts.

For the preparation of such file, the Investigating Body shall:

  • Understand whether the facts reported by the reporting person have occurred and whether they may involve an infringement.
  • Have identified the regulations (internal or external applicable to the relevant company of Cerba Internacional) that have allegedly been violated.
  • To have identified the parties harmed by the alleged violation committed, without prejudice that, in the course of the investigation, new identities may be ascertained.
  • To have identified the alleged offenders, without prejudice that, during the investigation, new identities may be ascertained.
  • Identify the evidentiary material supporting the allegations presented by the informant(s);
  • Determine and, where appropriate, propose the adoption of precautionary measures aimed at preventing the achievement of the damage or violation reported.
  • Other information related to the subject or subjects reported and that could be related to the alleged contingency occurred.
  • Preparation of a script listing the various investigative steps that the instructor deems necessary, such as interviews or questionnaires addressed to the parties and eyewitnesses or by reference to the facts under investigation.

The investigation process may be outsourced to trusted third parties in whole or in part, depending on whether the circumstances and complexity of the case require the advice of an expert in a particular aspect, or an investigation completely developed from outside Cerba International. The choice of such a strategy will be especially advisable in cases where it is considered that the investigation may require a special standard of confidentiality or affect the Head of the Internal Information System.

The Head of the Internal Information System may also designate one of the internal functions of the organization as the instructor in charge of carrying out the investigation. In the same sense, the designated person/s will become part of the Instructing Body. The Head of the Internal Reporting System may be supported by such internal functions of the organization as he/she deems appropriate.

Before entrusting an external third party or an internal function with the process of investigation or preliminary analysis, the Head of the Internal Information System shall verify that such a party provides adequate guarantees of respect for independence, confidentiality, data protection and secrecy of communications.

5.5 Resolution

Finally, after the closure of the Investigation Phase and once the intervening parties have presented their corresponding allegations, the Investigating Body may adopt any of the following decisions:

  • To carry out the practice of additional investigation proceedings.
  • To archive the Investigation File due to the absence of sufficient evidence or due to the lack of relevance of the facts.
  • Declare the commission of an infringement within the Cerba Group company, which may entail the imposition of a sanction or the adoption of additional measures, as described in the following sections.

5.6 Disciplinary proceedings and applicable measures

If the investigation carried out shows that there has been a breach, the function in charge of the Group company shall draw up a Report and open the corresponding Disciplinary File.

This Disciplinary File may decree a series of measures, as detailed below:

Disciplinary measures

  • Infringements shall be graded in accordance with the provisions of the labour legislation applicable to the Group company.
  • The corresponding disciplinary measures shall be applied in accordance with the sectoral Collective Bargaining Agreement, if applicable.

Corrective and preventive measures

The Investigating Body of the investigation may recommend and propose in the Conclusions Report the adoption of certain corrective and preventive measures to reduce or mitigate any risk detected during the investigation process, as well as to improve said phase.
Such measures may consist of the following actions:

  • Adopting measures aimed at repairing any eventual damages caused with respect to any person or entity that may have been harmed by the facts.
  • Take decisions regarding communication, training, or internal dissemination of the facts, both to anybody or unit of the Cerba Group and in general to all employees when this is considered an effective tool to prevent similar breaches in the future (always with due precautions in terms of Personal Data Protection).
  • Adopt organizational or preventive measures of any kind.

6. STATISTICS AND PERIODIC REPORTING

On an annual basis, the Head of the Internal Information System of the Group company shall notify the Board of Directors of the relevant Cerba Group entity about the communications received through the Communication Channels enabled by the organization, as well as the management carried out in relation to them.

7. RIGHTS OF THE PARTIES INVOLVED

From the moment a communication is made by the reporting person to the closure of the process with the Investigation File, if applicable, or with the adoption of the corresponding measures in the event of non-compliance, the Cerba International Group companies guarantee the parties involved a series of rights for the purpose of providing a fair and transparent investigation.

7.1 Rights recognized to informants

  • The right to confidentiality and confidentiality of identity.
  • Right to anonymity.
  • Right not to suffer reprisals.

7.2 Rights granted to the persons involved

  • The right to confidentiality and the right to confidentiality of identity.
  • Right to defence and access to the Investigation File.
  • The right to the presumption of innocence and the right to honour.
  • Right to a fair procedure and the adoption of proportional measures against him/her.
  • Right not to suffer reprisals.

8. GUARANTEE IN THE ABSENCE OF CONFLICT-OF-INTEREST SITUATIONS

The Cerba International Group guarantees the absence of Conflict-of-Interest situations by the persons in charge of managing the information received by the organization through the communication channels enabled by the same.

9. ANNEXES

In order to know the treatment of personal data carried out by Cerba International as a result of the information submitted through the communication channels of the organization, the interested persons should consider the provisions of the Privacy Policy, visiting the following link: https://cerba.com/en/privacy-policy/

10. EFFECTIVENESS

The Whistleblowing Policy of Cerba International Group will come into force in 2024.