Ethical Channel Operating Protocol

1. Introduction

Openers & Closers S.L., as part of the proper implementation of the Criminal Risk Prevention Program (hereinafter, the PRP Program or the Program), must establish and communicate the general principles of conduct, ethical standards of behaviour, and policies and procedures, all of which are mandatory, to all members of the organisation without exception, as well as to third parties with whom it interacts in the course of its professional activities.

In addition, Openers & Closers S.L. shall provide the organisation with the corresponding criminal compliance structures for the effective implementation of the PRP Program and to fulfil the various functions and responsibilities arising from it.

Within the framework described above, and taking into account that Criminal Risk Prevention Programs must enable the detection of conduct contrary to the general principles of conduct and ethical values established in the Program itself, Openers & Closers S.L. must implement appropriate procedures for the establishment, operation and management of an Ethics Channel.

The Openers & Closers S.L. Ethics Channel shall be an effective and trustworthy mechanism for the internal reporting of circumstances that may constitute breaches of the PRP Program itself, the policies and procedures that form part of it, the principles and values arising from it, as well as the regulations it is intended to cover.

Accordingly, the content of the Openers & Closers S.L. Ethics Channel is set out in detail below, establishing the procedure for submitting and managing reports, as well as ensuring and protecting the rights and safeguards of all parties involved in the process.

2. Purpose of reports

The main purpose of establishing an Ethics Channel at Openers & Closers S.L. is to receive reports made in good faith and based on reasonable grounds concerning circumstances, facts or conduct that may constitute infringements, irregularities, breaches or weaknesses in the PRP Program, any of its policies and procedures and/or the regulations it is intended to cover, as well as any circumstances that may constitute regulatory non-compliance relating to criminal risk prevention within the organisation.

A report is considered to have been made in good faith when the person submitting it has reasonable grounds to believe, based on the information available to them at the time of reporting, that the facts reported are true.

An infringement, irregularity or breach shall be understood to include:

• Actual or potential acts or omissions that have already occurred or are very likely to occur.
• Acts or omissions that the reporting person has grounds or evidence to consider infringements.
• Any attempt to conceal infringements, irregularities or breaches shall be considered an infringement in itself.

The above conduct shall be considered an infringement, irregularity or breach regardless of whether it causes harm to the organisation, its members, third parties or public authorities.

3. Reports not subject to the Ethics Channel

Information that is fully available to the public, as well as unconfirmed rumours and hearsay, shall not be considered infringements or irregularities that may be reported through the Ethics Channel.

Nor shall interpersonal complaints affecting only the reporting person be considered eligible for reporting through the Ethics Channel, such as interpersonal conflicts between the reporting person and other members of the organisation, or any other doubts, complaints or queries regarding their employment situation, which must be handled through the appropriate procedures other than the Ethics Channel.

Reports made in bad faith, or reports that are false or malicious, may result in the corresponding sanctions, without prejudice to any civil or even criminal liability that may arise under the applicable legislation in force.

4. Reporting mechanisms

Openers & Closers S.L. may provide the following means for submitting the reports referred to above:

• Dedicated email address: info@openers-closers.com
• Specific forms depending on the type of report, which the organisation shall make available to interested parties and which, once completed, must be submitted to the Compliance Officer (see Template for reporting indications or suspicions of non-compliance).
• Web form available through the organisation's electronic office.

The Ethics Channel web form must be available in a visible and easily accessible section of the website. It must include an introduction explaining the purpose of the report and the procedure that will be followed, as well as the corresponding data protection clause in case the reporting person identifies themselves.

It must also allow the reporting person to provide their personal data if they wish to identify themselves, indicate their relationship with the organisation and describe the facts they wish to report, including, among other information, details of the persons involved, dates and an account of the events, etc. (see the example in the document Web Form – Ethics Channel).

Openers & Closers S.L. allows reports concerning possible regulatory infringements and breaches of the PRP Program and its measures, policies and procedures to be submitted either anonymously or confidentially. For this reason, the following measures are established to enable anonymous reporting:

• Providing an ethics or whistleblowing mailbox within the organisation in which reports may be deposited.
• Sending the report by post for the attention of the Compliance Officer to the organisation's address (Calle Agricultura 17, (Nave 12) 08980 Sant Feliu de Llobregat, Barcelona, Spain).

If the Template for reporting indications or suspicions of non-compliance is not used, the minimum information that must be provided is as follows:

• Date on which the report is submitted.
• Facts being reported:
  • Details of the person or persons involved in the events.
  • Date of the reported events.
  • Description of the events being reported.

In all cases, whether the report is submitted anonymously or confidentially, any available evidence supporting the reported facts must be provided at the time the report is submitted.

Lastly, reports made through means other than those listed above shall be deemed not to have been submitted.

5. Intended users of the Ethics Channel

The Ethics Channel is intended for members of the organisation, namely employees, members of the governing body, owners of the organisation, as well as volunteers and interns, where applicable, regardless of their contractual arrangement, the position they hold or the geographical area in which they perform their work.

The Ethics Channel is also available to third parties, whether natural or legal persons, with whom the organisation interacts in the course of its professional activity, including clients, service providers, suppliers, contractors, advisers, subcontractors, and staff, members or officials of public authorities, as well as any person working under the supervision and direction of the foregoing.

Finally, the Ethics Channel is also intended for persons whose employment or professional relationship with the organisation has not yet begun but who have had dealings with it through recruitment processes or pre-contractual negotiations.

6. Management

Management of the Ethics Channel is the responsibility of the Compliance Officer of Openers & Closers S.L.

6.1. Receipt

Reports shall be received through any of the channels established by the organisation.

Regardless of the channel used, the Compliance Officer shall carry out a preliminary review of the report so that it can be handled appropriately:

1. If the report reveals an infringement or irregularity related to the Program or to regulatory compliance concerning criminal risk prevention within the organisation, it shall be managed in accordance with this Protocol.
2. If the report reveals an irregularity unrelated to the PRP Program or relates to regulatory compliance matters other than criminal risk prevention within the organisation (for example, a request to exercise data protection rights or a notification of a personal data security breach), it shall be forwarded to the appropriate body, department or person within Openers & Closers S.L. for proper handling.
3. If the report does not reveal any infringement or irregularity in any area, or is completely unfounded, it shall be archived and dismissed, thereby bringing its processing to an end.

In all cases, any report received through the Ethics Channel, regardless of the means used, shall be registered in accordance with the Resolution Template for Reports of Indications or Suspicions of Infringement, together with its reference number, so that it can be identified throughout the management process and the steps detailed below can be initiated.

Within no more than seven calendar days from receipt of the report, an acknowledgement of receipt shall be sent to the reporting person confirming its receipt; informing them of their data protection rights, where this has not already been done; and indicating, always with due justification, whether processing will continue under the Ethics Channel Operating Protocol, whether the report will be referred to another body, department or person within Openers & Closers S.L. because it is unrelated to the Program, or whether, on the contrary, the report is dismissed because it is not considered an infringement.

If the Compliance Officer considers that they may be subject to a conflict of interest, they shall inform the governing body and refrain from participating in the management of the report.

Depending on the seriousness of the reported facts and the persons within the organisation involved, the Compliance Officer shall assess whether it is appropriate to inform the governing body of Openers & Closers S.L.

6.2. Processing

If it has been determined that the report must follow the procedure established in this Protocol, an investigation into the facts reported shall begin in order to verify their truthfulness and accuracy.

During the investigation phase, where deemed appropriate, the necessary precautionary measures shall be adopted to prevent the reported conduct from recurring while the investigation is underway, as well as to preserve evidence.

For this purpose, during the investigation phase, additional information may be requested from the person who submitted the report where considered necessary and, if deemed appropriate, they may be interviewed.

With regard to the person or persons reported, they shall be informed of the existence of the report at the beginning of the investigation phase. In exceptional cases, where there is a risk that such notification could jeopardise the investigation itself, notification of the reported person may be delayed for as long as that risk persists.

The reported person shall also be informed of the facts under investigation and invited to provide their full account of them, with the opportunity to submit any relevant evidence, without prejudice to their right to submit written representations. Lastly, they shall be informed about the processing of their personal data in connection with the report.

Likewise, witnesses and/or persons affected by the content of the report may be interviewed. In this regard, all members of Openers & Closers S.L. must cooperate loyally with investigations while maintaining due discretion, confidentiality and reserve regarding the information provided. They shall likewise be informed of their data protection rights.

Except in exceptional cases due to the complexity of the investigation or the number of persons involved, the investigation phase may not exceed three months. Likewise, where the reported facts are particularly serious, the report shall be handled with the appropriate urgency.

A written record shall be drawn up of all actions forming part of the investigation.

A reporting person acting in good faith shall have the right, at any time, to be informed of the status of the processing of their report.

Likewise, throughout the entire management and processing of the report, and particularly during the investigation phase, the rights to privacy, defence and the presumption of innocence of the persons under investigation shall be guaranteed at all times.

7. Procedural safeguards

Openers & Closers S.L. guarantees the confidentiality or anonymity, as applicable, of persons using the Ethics Channel, as well as the management of all personal data relating to parties involved in the procedure in accordance with the applicable data protection legislation in force.

Likewise, the organisation prohibits any form of retaliation against persons who submit reports in good faith and on the basis of reasonable grounds through the Ethics Channel.

7.1. Confidentiality

The identity of persons submitting a report shall not be disclosed, nor, where applicable, shall the identity of persons whose conduct or actions may be mentioned in such reports. In addition, unauthorised persons shall not be permitted access to information contained in the reports. However, persons other than those responsible for receiving and following up on reports may lawfully access such information where necessary for the adoption of disciplinary measures or for the conduct of any judicial proceedings that may be appropriate.

To ensure compliance with the above, persons managing the Ethics Channel or who may otherwise become aware of the content of reports shall be subject to a duty of confidentiality.

The confidentiality of the report and the related procedure may only cease in cases where disclosure is required by the competent authority and/or where there is a necessary and proportionate legal obligation to do so.

The organisation shall ensure that access to the content of reports and investigations, as well as the storage of information, is carried out securely and diligently.

7.2. Data protection

The personal data of the person submitting the report and of the persons involved in the reported events shall be processed in accordance with the applicable data protection legislation in force.

Access to data contained in the Ethics Channel management system shall be restricted exclusively to those performing internal control and compliance functions, or to data processors who may be appointed for this purpose. However, access by other persons, or even disclosure to third parties, shall be lawful where necessary for the adoption of disciplinary measures or for the conduct of any judicial proceedings that may be appropriate.

Personal data shall be retained in the system only for the time strictly necessary to decide whether an investigation into the reported facts should be initiated.

In all cases, once three months have elapsed since the data were entered, the organisation shall delete them from the system, unless retention is required to provide evidence of the effective operation of the Ethics Channel and the organisation's Criminal Risk Prevention Program. Data relating to reports that have been archived may only be retained in anonymised form.

Likewise, Openers & Closers S.L. shall not collect personal data whose relevance is not clearly evident for handling a specific report; if such data are collected accidentally, they shall be deleted without undue delay.

7.3. Non-retaliation

Openers & Closers S.L. guarantees that there shall be no retaliation against reporting persons who, acting in good faith, have reported an infringement or irregularity through the Ethics Channel.

Accordingly, any unfavourable treatment caused by an action or omission occurring in an employment or contractual context and causing unjustified harm to a person who has reported an infringement is prohibited.

Therefore, any disciplinary action or dismissal of members of the organisation's professional staff for submitting a report through the Ethics Channel is prohibited.

Likewise, situations involving discrimination, harassment or threats as a result of having submitted a report shall be duly sanctioned by the organisation.

8. Conclusion and outcome of the procedure

Once the investigation phase has been completed, the conclusion and response phase shall begin.

If the investigation phase establishes that an infringement has been committed, the Compliance Officer shall prepare a report, which shall be submitted to the governing body, containing:

• The facts under investigation.
• Possible breaches of the Criminal Risk Prevention Program and/or its policies and procedures.
• A detailed explanation of the investigative actions carried out.
• A proposed resolution.
• Measures to be adopted in the event of breaches and irregularities, which shall vary according to the seriousness of the case and may include disciplinary measures established in the Disciplinary System, ranging from a warning to disciplinary dismissal; measures to prevent the events from recurring; and, where appropriate, reporting the facts to the relevant administrative and/or judicial authorities.

If the report received involves a third party with whom the organisation maintains professional or commercial relations, the measures contractually provided for within that relationship shall be considered.

If the investigation phase establishes that the facts do not constitute an infringement, a report shall nevertheless be prepared containing the information detailed above together with a proposal to archive the report.

In all cases, whether it is considered that an infringement has occurred or that the reported facts are unfounded, the report shall be duly reasoned and justified.

The report may be prepared using the Resolution Template for Reports of Indications or Suspicions. This template is amendable and non-binding and may be modified or expanded according to the needs of the case.

Once the report has been submitted to the governing body, it shall ratify it, making any modifications it deems appropriate. The outcome shall be communicated to the reported person and, where applicable, the relevant disciplinary measures shall be adopted and the appropriate authorities shall be notified.

Finally, depending on the circumstances of each case and provided that the rights of the affected parties are safeguarded, the outcome of the investigation shall be communicated to the reporting person.

9. Advice

The organisation shall provide advice to any intended user of the Ethics Channel who raises doubts or concerns relating to it. Such doubts or concerns shall be submitted to the organisation through the Ethics Channel itself.

10. Awareness

The existence of the Ethics Channel, the obligation to use it where there are reasonable indications of irregularities, and its operation shall be communicated and publicised to all employees of Openers & Closers S.L. without exception through the Code of Conduct and by making this Protocol available to them.

The same communication shall be provided to persons joining the organisation by attaching the Code of Conduct to their contract, thereby assuming the commitment to inform the organisation of any irregularities of which they may become aware.

Likewise, the existence of the Ethics Channel and the obligation to use it when becoming aware of infringements related to the organisation and/or its members shall be communicated to the organisation's various stakeholders, namely suppliers, service providers, clients, contractors, subcontractors, advisers and any other third party that has any form of relationship with OPENERS & CLOSERS SL.