Procedure of the internal information system or whistleblowing channel

1.- THE INTERNAL INFORMATION SYSTEM OR WHISTLEBLOWING CHANNEL.

1.1.- Concept and nature.

The penal code warns in its art. 31 bis, of the obligation of legal persons to establish within their organisation systems or means for communicating possible risks or legal breaches.

Likewise, Law 2/2023, of 20 February, regulating the protection of persons who report regulatory breaches and corruption, has also introduced a series of requirements that legal persons must comply with to establish and manage these “internal information systems” or “whistleblowing channels.”

Accordingly, Abac Capital, as part of its culture of ethics and compliance, has implemented this INTERNAL INFORMATION SYSTEM OR WHISTLEBLOWING CHANNEL, through which reports may be filed about events relating to materialized risks, suspicious facts that may constitute a crime, and any other conduct that may constitutes a breach of the law or the company’s Internal Policies.

This whistleblowing channel may be used by employees, directors, executives, members of the board, or any other interested third party included in art. 3 of the aforementioned Law 2/2023 of 20 February, on a confidential basis or anonymously without fear of reprisal, in accordance with the provisions of the aforementioned law. By submitting their report and expressing their concern, the whistleblower is contributing to our organisation being a responsible organisation in all aspects of its business.

1.2.- Basic guiding principles of the System 

Accessibility: there are different options for submitting whistleblower reports:

• · Through the form available on this channel.
• · By postal mail to the address Att. Compliance Officer, Abac Capital Manager SGEIC, S.A.U., C/ Lleó XIII, 24, 08022 Barcelona.

Confidentiality: the identity and contact details of the whistleblower, as well as the facts and documents included in the report on the eventual irregular fact, shall always be treated as confidential information and, therefore, shall not be disclosed without their consent to the accused and/or third parties, except by request of an administrative or judicial authority, all in accordance with the provisions of art. 31.1 of Law 2/2023. 

Anonymity: anonymous reports are accepted, for which the only available options for submitting reports are through this channel or by postal mail or hand delivery, in a sealed envelope addressed for the attention of the RESPONSIBLE FOR THE INFORMATION SYSTEM and without indicating any personal details of the whistleblower, both on the envelope and in the complaint itself. 

System manager: the Company has delegated the management of complaints to a system manager, duly identified and in accordance with Law 2/2023. 

Objectivity and impartiality: all whistleblower reports shall be managed objectively and impartially, guaranteeing the rights to privacy, defence, and the presumption of innocence of the persons involved. 

Data protection: In accordance with article 24 of LO 3/2018 of 5 December on the protection of personal data and guarantee of digital rights (modified by the Seventh Additional Provision of the aforementioned Law 2/2023), “The processing of personal data necessary to guarantee the protection of persons who report regulatory violations will be lawful. Such processing will be governed by the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of April 27, 2016, in Organic Law 3/2018 of December 5 on Data Protection and Guarantee of Digital Rights and in the Law regulating the protection of persons who report regulatory violations and fight against corruption.” The legal basis for data processing is found in art. 30.3 of the LOPDGDD. 

Data must be kept in the whistleblowing system only for the time necessary to decide whether to initiate an investigation into the reported facts. In any case, three months after the data is entered (or six if the period is extended due to the complexity of the report), it must be deleted from the system, unless the purpose of retention is to provide evidence of the functioning of the crime prevention model by the Company. Under no circumstances shall personal data that is not necessary for these purposes or that refers to conducts not included in the scope of the law, be processed, and if applicable, they shall be immediately deleted. If the information received contains special category of personal data, it shall be immediately deleted, without being registered and processed. 

If the facts are proven or with sufficient indicia, the data shall be retained as long as necessary for the Company to exercise its rights before the courts of justice. 

Those complaints made anonymously will be identified by an internal reference to be incorporated into the whistleblowing system. Only the following individuals will have access to the complaints:

• · The system manager.
• · The competent internal body duly designated in the Company, when disciplinary measures against an employee may be necessary.
• · The head of the Company’s legal department, if legal measures are to be taken in relation to the reported facts.
• · External advisors or third parties necessary due to the nature of the case, who will be considered data processors or sub-processors.
• · The Data Protection Officer and the Compliance Officer.

1.3.- Rights and Obligations

Rights and Guarantees for Whistleblowers 

Whistleblowers shall be guaranteed the effective exercise of the following rights, without prejudice to any other rights recognized by the Constitution and the laws:

• · To provide information anonymously and to maintain anonymity during the procedure, as long as they follow the established procedure indicated above.
• · To make communications verbally or in writing. For verbal complaints, a system will be made available to allow this mode of communication.
• · To indicate an address, email, or safe place to receive communications from the System Manager, except for anonymous complaints.
• · To appear before the System Manager or the delegated manager on their own initiative.
• · To waive communication with the System Manager or the delegated manager instructing the procedure and, if applicable, to revoke such waiver at any time.
• · To preserve their identity. The identity of the whistleblower cannot be revealed without their express consent to any person who is not competent to receive and manage whistleblower reports, with the exceptions established by European Union law or Spanish laws in the context of investigations carried out by authorities or during judicial proceedings.
• · To protect their personal data.
• · To know the identity of the manager instructing the procedure.
• · To maintain the confidentiality of communications.
• · To receive protection and support measures as provided in Law 2/2023.
• · To file a whistleblower report with the Independent Authority for the Protection of Whistleblowers.
• · Not to be subject to reprisals, even when the results of the investigations verify that there has been no breach of applicable regulations or the Company’s internal regulations, as long as they have not acted in bad faith.

1.4.- Whistleblower Obligations

Whistleblower, regarding the submission of their reports through the channel, shall be subject to the following obligations:

• · To have reasonable or sufficient indications about the certainty of the whistleblower reports that they communicate, not being able to make generic reports, in bad faith, or with abuse of rights, in which case they could incur civil, criminal, or administrative liability.
• · To describe the facts or behaviours that they communicate as detailed as possible, providing all available documentation about the described situation or objective indications to obtain evidence.
• · To refrain from making whistleblower reports with a purpose different from that provided by the System or that violate the fundamental rights to honour, image, and personal and family privacy of third parties or that are contrary to the dignity of the person.

1.5.- Third Party Rights 

Persons considered as third parties in the procedure shall be recognized the rights recognized by the Constitution and the laws, without prejudice to the possibility of extending to them, as far as possible, the support and protection measures for the whistleblower provided in Law 2/2023; specifically, the following:

• · To be informed, as soon as possible, of the information that affects them.
• · To access the actions taken against them, without prejudice to the temporary limitations that may be adopted to ensure the outcome of the actions.
• · To know the identity of the manager instructing the procedure.
• · To preserve their honour and privacy, as well as to the preservation of their identity. The identity of the third party cannot be revealed without their express consent to any person who is not competent to receive and manage whistleblower reports, with the exceptions established by European Union law or Spanish laws in the context of investigations carried out by authorities or during judicial proceedings.
• · To the presumption of innocence and to use all valid means in law for their defence.
• · To indicate an address, email, or safe place to receive communications from the System Manager.
• · To appear before the System Manager or the delegated manager on their own initiative.
• · To protect their personal data.
• · To maintain the confidentiality of communications.
• · Not to be subject to reprisals.

2.- INCIDENT REPORTING PROCEDURE

2.1.- Reportable Incidents or Breaches

The following cases are considered reportable incidents or breaches:

• · Any violation of current legislation.
• · Any breach of the INTERNAL POLICIES of our Company or the values, general principles of action, or codes of conduct of employees, as set out in them.
• · Any contingency that may pose a risk to the reputation of our Company.

2.2.- Minimum Content of Complaints

For their admission and proper processing, communications or whistleblower reports must necessarily contain the following data:

• · Whistleblower identified by name and surname (except for anonymous whistleblower reports), a succinct statement of the facts or arguments supporting the communication/report.
• · The person or department against whom the communication/report is directed.

The burden of proof shall always lie with the whistleblower, who must provide the documents on which the whistleblower report is based, and the accused party may provide the documents they deem appropriate to counter those of the whistleblower.

If any of the persons affected by the communication/report are part of the investigation, they shall be replaced by another person who is not directly related to the communication/report in question.

3.- INSTRUCTION PHASE OF THE PROCEDURE

3.1.- Receipt and Acknowledgment

Upon receiving the communication/report, the system manager shall acknowledge receipt to the whistleblower within a maximum period of 3 days, unless the whistleblower is anonymous, and shall initiate the necessary verifications and checks; generating a file that shall be registered and identified by a reference.

If necessary and if the whistleblower is not anonymous, the system manager may request clarifications or additional information.

3.2.- Preliminary Analysis of the Information Received

With this initial information, the system manager shall conduct a preliminary analysis to verify the entity, sufficiency, and plausibility of the report, the credibility of the whistleblower, and the relevance of the reported facts; determining whether they may constitute a legal violation or an infringement of the Company’s internal policies.

Based on the result of this preliminary analysis, the system manager may adopt, in writing and motivated, one of the following decisions:

• · Inadmissibility of the notification or report and immediate filing of the case when the reported facts do not constitute any of the cases provided for this channel.
• · Admission of the notification or report and immediate filing of the case when the content is manifestly irrelevant, when the information is insufficient to proceed with any additional action, when the reported facts are implausible, or the informant lacks credibility.
• · Admission of the notification or report and initiation of the corresponding investigation file in relation to the reported facts.

3.3.- Procedure after the Analysis

If the whistleblower report is considered inadmissible, the system manager will inform the whistleblower (except for anonymous complaints) of the inadmissibility of the report or the filing of the case, as appropriate, as well as any additional measures that may have been adopted.

If the whistleblower report is admitted, the instruction body will be constituted, whose functions are the processing of the whistleblower report and the drafting of a decision for its resolution.

However, urgent measures may be adopted, always motivated, with the following purposes:

• · Mitigate the effects of the materialized or potential risk.
• · Implement urgent measures to preserve evidence.
• · Urgently communicate the information to the Company’s governing bodies, if applicable.

If admitted, the procedure will follow these steps:

• · Identify the affected legislation, policies, procedures, or internal regulations, as well as the reputational, economic, financial, or legal risks that may arise from the incident.
• · Identify all relevant information and documents whose review is considered useful (emails, websites, audiovisual surveillance and security supports of the company, attendance lists, passwords or electronic security devices, accounting supports, etc.).
• · Determine, with the collaboration of the Human Resources Department, the need and urgency, if any, to adopt precautionary measures regarding the investigated subjects.
• · Depending on the severity, immediately suspend the investigated subjects.

The investigation will include all investigative actions deemed appropriate to clarify the facts, identify responsible persons, and determine corrective measures to be adopted if necessary.

The following are some of the main investigative actions that may be part of the investigation:

• · In the case of a non-anonymous complaint, conduct an interview with the complainant to obtain more information about the filed complaint.
• · Statement of the investigated subjects.
• · Conduct confidential questionnaires and interviews with witnesses.
• · Arrange hearings with the investigated subjects, their superiors, and colleagues, as well as any other persons deemed necessary.
• · Gather as much information as possible through company documentation.
• · If necessary to clarify the facts, adopt surveillance measures through detectives or computer, telematic, or audiovisual means, as long as they meet criteria of reasonableness, suitability, and proportionality, ensuring the worker’s right to privacy and the right to secrecy of communications.
• · Request external assistance from other professionals.
• · Any other investigative actions deemed necessary by the Instruction Body to clarify the facts.

3.4.- Communication to the Investigated Subjects

Except for anonymous whistleblower reports, the system manager shall contact the parties, identifying themselves as the person in charge of investigating the whistleblower report and briefly informing them about the facts attributed to them and the main milestones that may occur during the investigation.

In the case of inadmissibility of the whistleblower report, considered not admissible, the whistleblower shall be informed of this within a maximum period of 3 days from its submission (except for anonymous reports).

3.5.- Documentation of the Investigation Procedure

It shall be essential to include in the file the detailed documentation of the entire investigation procedure developed, such as the documents collected, and the minutes of the interviews conducted.

In all interviews conducted by the Instruction body, it will take written notes of the relevant facts, incorporating them into a record, which must be signed by the interviewees and the members of the instructing body.

Likewise, they will be informed of the requirements of the current data protection legislation.

3.6.- Final Report of the Instruction Body

Once all investigative actions have been completed, the Instruction Body will prepare a conclusions report within 15 days, containing a brief description of the following elements:

• · Identity of the members of the instructing body.
• · Nature of the contingency. The intervening subjects, the nature of the facts, the date, place, and circumstances in which they supposedly occurred, the legal provisions, or the internal regulations infringed or endangered will be identified as far as possible.
• · Relationship of the relevant facts and discoveries. The most relevant facts collected throughout the investigation procedure will be reported, differentiating between those obtained from company documentation, the information provided by the complainant, or the interviews conducted with the investigated subjects and witnesses.
• · Conclusions and assessment of the facts. The conclusions drawn by the instructing commission will be specified, as well as their assessment of the reported facts, proposing two possible actions:
  • · Proposal to continue the procedure, if it is considered that the investigated subject has committed a sanctionable offense based on the conducted investigations, including a final section identifying the sanctions that may be adopted by the company against the responsible subjects, as well as any other additional measures, including possible compensatory actions that may be taken regarding any person harmed by the facts.
  • · Filing of the procedure, if it is considered that the fact does not constitute an offense, is not sufficiently justified, or no known author has been identified.

Once prepared, the final investigation report will be immediately forwarded to the Decision Body and must be filed along with the rest of the investigation file.

4.- DECISION PHASE 

In view of the report prepared by the Instruction Body, if the complaint is deemed appropriate, the Decision Body will be constituted, whose function is to form the Company’s decision, in response to the complaint raised.

To form its decision, the Decision Body may seek advice from as many external services as necessary, as well as any clarifications required from the Instruction Body itself.

Its composition shall be collegiate, consisting of the members of the Instruction Body, and a representative of the Company’s Board of Directors.

In case of incompatibility of any of the members of the Decision Body for the processing of a specific matter, that member shall be removed from all procedures related to it.

The Decision Body will forward the file to the investigated subjects, who shall be granted a period of 5 days to submit in writing whatever they deem appropriate for their defence and to provide the documents they consider relevant. After this period, the Decision Body may adopt one of the following decisions:

• · Request additional investigative actions.
• · Request the Company’s Board of Directors to impose sanctions and/or additional measures.
• · In the case of eventual criminal offences, it shall be obliged to inform the competent authority, whether administrative or judicial.
• · Adopt compensatory actions regarding any person or entity that may have been harmed by the facts.
• · Make decisions on communication, training, or internal disclosure of the facts, both to any body or unit of the Company and to the entire workforce, when this is considered an effective tool to prevent similar incidents in the future (always with due caution in terms of Personal Data Protection).

5.- RECORDS

For the purpose of documenting actions taken, the System Manager must maintain an updated and confidential Chronological Register of the investigation (both ongoing and closed), reports, and disciplinary measures applied in relation to breaches.

This record shall contain at least:

• · Date of the incident
• · Type of incident
• · Date of whistleblower report
• · Type of whitleblower
• · Persons involved in the facts
• · Description of the incident
• · Actions taken
• · Consequences derived

Such register shall always be updated and available for review by those responsible for this procedure (the system manager and the Company’s Compliance Officer), always maintaining the strictest confidentiality.

However, it shall be determined what publicity or disclosure may be made to the rest of the employees and managers about the facts once they have been resolved, either as a deterrent measure or as an improvement of procedures and future actions to avoid bad practices.

Furthermore, the resolution of the procedure shall become part of the file (labour, if applicable) of the reported person.