1. Change control:

1.1. Identification and description:

1.2. Classification

1.3. Version log

2. Purpose and objective.

The CLIKALIA Management Body, as a demonstration of its commitment to making the decisions necessary for the effective implementation of a Compliance Management System, has established the implementation of a Clikalia Ethics Channel (hereinafter “the Channel”) as one of its main pillars.

The purpose of this Channel is to receive and effectively process communications related to behaviors that, in essence, may constitute a violation of the general legal system, as well as the principles set forth in its Code of Ethics and other essential documents that make up its Compliance System.

To this end, this Policy covers issues relating to the management and processing of communications received, with the aim of incorporating a flexible and agile model in accordance with current legal regulations, national and international standards and best practices, distinguishing between ordinary channels and other so-called alternative channels in which potential whistleblowers can, without fear of reprisals or harmful conduct, report facts that constitute violations of the Compliance System.

The purpose of this Policy, together with the Internal Communications and Information Management Channel Procedure that regulates its operation, is to ensure professional, confidential, impartial, and maximum protection throughout the process, thereby creating a climate of trust among its stakeholders.

3. Scope.

This Policy applies to all activities carried out by the organization and is mandatory for all its members, regardless of their position or role within the organization, the legal nature of their relationship, and their geographical location.

It may be extended to third parties, business partners, foreign subsidiaries, non-controlled investee companies and, in general, to any person who wishes to inform the organization of the existence of possible breaches and/or infringements.

The provisions of this Policy shall apply to any communication, query, or notification related to its purpose that is received through means other than the formally established Ethics Channel, provided that such communications comply with the principles and requirements set forth in this Policy.

4. Principles governing the Channel. 

The general principles governing the Channel must be respected and guaranteed by all members of the organization, in order to provide whistleblowers with adequate protection against possible reprisals they may suffer for the mere fact of bringing to the organization's attention facts that may constitute a violation of the legal system or internal rules.

The Channel is governed by the following principles:
 

4.1 Accessibility. The Channel must be clear, public, and easily accessible to employees and third parties who wish to make a report, serving as the ideal means for the organization to listen to and communicate with all members of the organization or other interested third parties.

4.2    Good faith.
The whistleblower must act in good faith and must base the communication on facts or evidence from which it can reasonably be inferred that irregular, illegal, criminal, or contrary to the principles and values of the organization behavior has taken place. Deliberately passing on information that is known to be false, thereby causing harm, may result in disciplinary action.

4.3    Confidentiality.
Confidentiality in general will be guaranteed at all times. The identity of the person reporting will be considered confidential information and may not be communicated or disclosed without their consent.

4.4 Objectivity and impartiality. Once a report has been received, impartiality will be guaranteed, as will the right to privacy, defense, and presumption of innocence of all persons involved.

4.5    Transparency.
The Channel is a transparency tool that promotes trust among the organization's members.

4.6    Authority, independence, and conflict of interest.
At all times, the Channel manager and the Compliance Committee will act with complete autonomy and independence. If any of the persons involved in the investigation is implicated in the events reported or considers that they may be involved in any kind of conflict of interest, they must refrain from participating in the management and subsequent investigation.

4.7    Prohibition of retaliation. 
It is guaranteed that the use of this Channel will not be subject to any direct or indirect retaliation against those who, in good faith, have reported an alleged irregularity.

4.8    Exemption from contractual obligations.
The possibility of using this Channel will not be restricted on the basis of contractual obligations, such as non-disclosure agreements or clauses relating to commercial or employment confidentiality, when the whistleblower makes the report on reasonable grounds for believing that it is necessary to bring an action or omission in relation to the regulations to the attention of the organization.  

5. Conduct that can be reported.

Information about violations or breaches is interpreted broadly, i.e., reports may be made about events that give rise to reasonable suspicion, are actual or potential violations, have occurred, or are likely to occur. 

By way of illustration and without limitation, some of the possible topics that may be reported are outlined below:

• Bribery and corruption;
• Conduct that jeopardizes health and safety at work;
• Conflicts of interest;
• Discrimination, equality, as well as sexual harassment, gender-based harassment, moral harassment, and/or harassment based on sexual orientation, gender identity, and/or gender expression;
• Internal fraud; • Allegations of unfair competition;

• Breaches of competition law;

• Irregularities in tax or accounting matters or that undermine the integrity of the business and financial records.

• Disclosure of information that could affect the interests of Clikalia.

•    Acts that threaten the environment.

•    Breaches of Clikalia's internal regulations.

5.1    Guarantees for the whistleblower.

The Channel has the necessary guarantees in place to maintain the security of communications and confidentiality between the whistleblower and the Compliance Committee.

Those responsible for managing the Channel will take note of the content of each communication and treat it with due diligence, maintaining the utmost confidentiality regarding the identity of the whistleblower when the communication is not anonymous.

Any type of retaliation against those who use this Channel in good faith is strictly prohibited. If it is confirmed that such persons have been subjected to any type of retaliation, stigmatization, or harassment, the perpetrators will be investigated and, where appropriate, punished.

5.2    Guarantees for the person allegedly involved.
Persons allegedly involved in the events reported through the Channel may never be sanctioned for a simple communication or notification. In all cases, the veracity of the communication must be verified and the persons involved must be given the opportunity to offer an explanation of the situation reported.

The persons potentially involved will be informed by the Person Responsible for the Ethics Channel as soon as possible and, at the latest, within one (1) month of receipt of the communication, of the facts reported, the person responsible for processing the communication, the next steps in the investigation, and their data protection rights.

Exceptionally, if there is a significant risk that notifying the alleged person involved could jeopardize the effectiveness of the investigation or the collection of evidence, notification will not be made until such risk ceases to exist.

The reasons for determining the existence of such a risk shall be documented and sufficiently justified, and the maximum period of one month may be extended for a period not exceeding three months.

Information relating to the possible person involved shall be treated with strict confidentiality.

6. Essential principles of the communication management procedure.

6.1 Guiding principles of the procedure. Given the possible criminal consequences of the facts that may be reported through the Channel, its management will be aligned with the guiding principles of judicial proceedings:

• Documentation: regardless of the means of entry, the investigation procedure must be duly documented in writing.

•    Promotion of the investigation: once a report of possible non-compliance or infringement has been received, the investigation will depend on the will of the organization, thus preventing the person reporting from misusing the Channel.

•    Contradiction: during the investigation, the alleged perpetrator must be allowed to exercise their right of defense at all times.

6.2    Sending acknowledgment of receipt of the report to the whistleblower.
Within seven calendar days of receiving the report, unless this could jeopardize the confidentiality of the report or it was made anonymously, an acknowledgment of receipt shall be sent to the reporting person.

6.3    Communication with the reporting person. If necessary, communication may be maintained with the reporting person (if they have identified themselves) and additional information may be requested.

6.4    Determination of the maximum period for responding to the investigation. 
The deadline for responding to the reporting person may not exceed three months from the date of receipt of the communication or, if no acknowledgment of receipt was sent, three months from the expiration of the seven-day period after the communication was made, except in cases of special complexity that require an extension of the deadline, in which case it may be extended for a maximum of three additional months.

6.5    Admission, non-admission, and referral to other channels. 

A communication may be rejected if it is considered irrelevant, inadmissible, or unrelated to the matters to be communicated through the Channel. Grounds for rejection include:

a) When the facts reported are not credible. b) When they do not constitute a violation of the legal system. c) When the report is unfounded. d) When the information does not contain new and significant information from another previous report that has already been concluded.

In this case, the reporting person will be notified of the reasons for the decision and the report will be filed. Additionally, if appropriate, the report may be redirected to the appropriate channel if the information it contains is relevant to other areas of action.

If deemed relevant, a communication will be sent to the informant confirming the opening of the file.

6.6    Referral to the Public Prosecutor's Office. 
The information received will be immediately referred to the Public Prosecutor's Office when the facts could constitute a crime.

6.7    Opening of an internal investigation. 
When it is determined that the facts provide sufficient evidence of a possible breach, an internal investigation will be opened.

The Compliance Body, specifically the person appointed to manage the Ethics Channel, will in principle be responsible for the investigation, unless a conflict of interest is detected, in which case the Management Body will be informed and will decide to appoint an alternative person to be responsible for the investigation, who may be internal or external.

The person in charge of the investigation will open a file, which will record all incidents that occur in the course of their work. This file will be confidential and governed by the regulations on the protection of personal data, and the corresponding report will be issued.

If urgent response or containment measures are deemed necessary, the report will be forwarded to senior management so that they are aware of this information and, if appropriate, can make a decision regarding the proposed measures.

Similarly, a summary of the facts and a preliminary analysis of the evidence provided will be made available to the person allegedly involved so that they can make any representations they deem appropriate in their defense, unless it is determined at this early stage that disclosure is not appropriate in order not to hinder the investigation or prevent the destruction of evidence.

6.8 Internal investigation.

The Compliance Committee will ensure that the investigation has all the necessary resources, whether internal or external, and that it has access to all information and documentation, as well as to any persons who may be related to the case, depending on the specific circumstances.

6.9    Conclusions and proposed actions.
Once the investigation has been completed within the established time frame, a report will be drawn up with conclusions and proposed actions.

6.10     Follow-up on decisions made. 
After the investigation has been completed and decisions have been made, the Compliance Body will follow up to ensure that the decisions made are properly implemented.

The purpose of this monitoring is to verify that the measures adopted are being implemented, thereby contributing to the continuous improvement of the organization's Compliance Management System and reinforcing the culture of compliance.

7.    Resolution of queries. 

The Channel may also be used as an internal source for receiving queries and questions about the process of reporting irregularities itself, or about the application of internal policies or compliance with legal obligations affecting the organization.

8.    Retention of communications. 

All information generated by communications will be stored in the systems and with the security measures established within the framework of its data protection management system, for the storage periods that may be determined internally in application of the applicable principles on personal data protection or for the periods during which, in accordance with the law, liabilities may arise as a result of the actions investigated.

Personal data will be stored in the Channel environment for a maximum period of three months from the date of communication. After this time, if the data is necessary to continue the investigation of the facts, it may continue to be processed for the purposes of the investigation or, where appropriate, from the end of the disciplinary, administrative, or judicial proceedings that may have been initiated.

Communications that have not been acted upon may only be recorded in anonymized form. Once the investigation has been completed, the person designated for this purpose may retain the information necessary to ensure the traceability, compliance, and effectiveness of the Compliance Management System.

9. External channels. 

The existence of external channels for reporting information to the competent authorities is hereby announced. Currently, the following external channels are announced, which may be of interest depending on the organization's sector of activity and its territorial scope of action:

•    Channel for reporting fraud or irregularities affecting European funds of the National Anti-Fraud Coordination Service (SNCA). Ministry of Finance and Public Service of the Government of Spain.
•    European Anti-Fraud Office (OLAF)
•    Andalusian Office for the Fight against Fraud and Corruption
•    Anti-Fraud Office of Catalonia (OAC)
•    Ethics and Good Governance Mailbox of Barcelona City Council;
•    Municipal Office Against Fraud and Corruption of Madrid City Council. 
•    Independent Whistleblower Protection Authority (AIPI).

10.    Ethics channel. 

Any knowledge of actual or suspected non-compliance with this Policy must be reported to the Compliance Committee. Likewise, it is encouraged that situations that may represent a weakness in the system be brought to the attention of the Organization so that they can be corrected or improved.

Please note that the Organization has established a formal channel so that all interested parties can, in good faith and without fear of reprisals, make inquiries or report breaches of this Policy.

If you are aware of any conduct (active or passive) that contravenes the content of this Policy or any other internal regulations, we remind you that you can file a complaint through the Ethics Channel, which can be accessed via the link available on the website https://clikalia.es/legal/aviso-legal

The report can be submitted anonymously or with identification. The Organization guarantees the confidentiality of all information communicated.

All persons who submit their reports in good faith will be protected against any type of discrimination or penalty.

False or defamatory reports may be subject to sanctions or give rise to legal action.

This same channel may be used by interested parties to report other issues of interest or questions about the application of this Policy.

11.    Publicity of the policy. 

This policy will be made available to all Clikalia employees and will be available to third parties upon request. The policy will be subject to appropriate communication, training, and awareness-raising actions to ensure its proper understanding and implementation within the Organization. 

12.    Entry into force and review. 

This policy is approved by the Administrative Body, as the Governing Body, and comes into force on the day of its approval and will remain in force until its repeal is approved.