1.  DATA CONTROLLER

This Whistleblower Channel is the responsibility of GRUPO EMPRESARIAL INMARK, S.A. with TAX number A83411215, company domiciled in Avda. Llano Castellano, 13 – 2º. 28034. Madrid , entity registered in the Commercial Registry of Madrid at Volume A-4526, Folio I, Section 8, Page number M-74554 (hereinafter, GRUPO INMARK) .

We inform you that GRUPO INMARK has designated a Data Protection Delegate who can be contacted at the following e-mail address [email protected]

2.   MOTIVATION

GRUPO INMARK makes this Whistleblower Channel available to its stakeholders in compliance with the recent Law 2/2023 regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter, " Whistleblower Protection Law ").

In addition, GRUPO INMARK fully complies with the current regulations on the protection of personal data; specifically, with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, " GDPR ") and Organic Law 3/2018 of 5 December on data protection and guarantee of digital rights (hereinafter, " LOPD ").

3. PERSONAL DATA PROCESSED

As indicated in the previous section, GRUPO INMARK's Whistleblower Channel allows the submission of anonymous complaints.

However, if the informant wishes to submit the complaint in a nominative way, GRUPO INMARK may collect, within the framework of a communication, the following types of data from the informant and, where appropriate, from the persons involved in the communication:

• Identifying data: Name and surname(s).
• Contact data: Telephone and e-mail.
• Professional data: Professional position.

Additionally, GRUPO INMARK may process other types of data by virtue of the allegedly criminal or irregular facts reported and the supporting documentation that may be appropriate to investigate the reported conduct.

No personal data shall be collected if it is not clearly relevant to the processing of specific information. In the event that irrelevant data is accidentally collected, such data shall be deleted from the Whistleblower Channel without undue delay.

If it is proven that the information provided or part of it is not truthful, it will be deleted immediately as soon as this circumstance becomes known. In the event that this lack of truthfulness may constitute a criminal offense, the information will be kept for the necessary time during the legal proceedings.

4. PURPOSES OF DATA PROCESSING

GRUPO INMARK shall process the data to which it may have access as a result of the communications received for the following purposes:

• Receiving and deciding on the admission for processing of communications received through the Complaints Channel.
• Once the communications have been admitted for processing, to carry out the investigation of the reported facts and to adopt, if appropriate, the pertinent corrective measures.
• Keeping the complainant informed about the admission, or not, of his communication as well as the progress and results of the investigation process in the event that there are sufficient grounds to admit his communication for processing.

5. LEGITIMACY FOR DATA PROCESSING

GRUPO INMARK has the following legitimate bases for the processing of the data, taking into account the conduct reported through this Whistleblower Channel:

• Compliance with legal obligations applicable to GRUPO INMARK if the communication refers to breaches provided for in the Whistleblower Protection Act:

             o   Non-compliance with European Union law,

             o    Commission of crimes or serious or very serious administrative offenses or any violations of the regulations for the prevention of money laundering;

•  Legitimate interest of GRUPO INMARK in ensuring that corporate behaviors are respected, without the processing of data in this framework entailing an imbalance to the rights of the data subjects and without the processing being likely to cause them prejudice, if the communication concerns conduct contrary to GRUPO INMARK's Code of Ethics or Code of Conduct.
• Public interest of GRUPO INMARK when the Whistleblower Channel is not mandatory or the processing is carried out in the scope of public disclosure.
• If the processing of special categories of data that are necessary for the management of the communications received and the processing of the corresponding procedures should occur, it will be considered to be enabled by the provisions of letter g of article 9.2 of GDPR for reasons of essential public interest, on one of the legal bases mentioned above.

 6. RECIPIENTS OF THE INFORMATION

The data to which GRUPO INMARK may have access due to the communications received through the Whistleblower Channel, may be communicated to:

• Public bodies or institutions, judges and courts when necessary for the adoption of disciplinary measures, for the processing of legal proceedings that, where appropriate, or in those cases in which it was legally required.
• To the Public Prosecutor's Office, when the procedure is within its competence.
• When necessary for the investigation or the adoption of disciplinary or corrective measures to the GRUPO INMARK Group entity where the reported facts have occurred.

Regarding the communication of the informant's personal data, GRUPO INMARK will guarantee that his identity, and all those personal data that GRUPO INMARK may have about his person, will be in any case reserved and that they will not be communicated to the persons to whom the reported facts refer nor to third parties, respecting in any case the fundamental rights of the person, without prejudice to the actions that, if necessary, may be taken by the competent judicial authorities .

7. TIME LIMITS FOR THE STORAGE OF DATA

The personal data to which GRUPO INMARK may have had access as a result of the communications received through the Complaints Channel, will be processed for the time necessary to decide on the appropriateness of initiating an investigation into the facts reported and for the management of the communication provided that it is admitted for processing.

Specifically, GRUPO INMARK will process the personal data within a maximum period of three months from receipt of the communication, except in cases of particular complexity, in which case it could be extended for an additional three months.

Once the aforementioned period has elapsed without any investigation actions having been initiated, the data will be deleted from the communication system, except for the purpose of maintaining evidence of the operation of the system and in an anonymized form.

In the case of communications that have not been sent, they will be kept in an anonymized form, completely eliminating the personal data.

8. USER RIGHTS

The regulations for the protection of the informant guarantee Users the following rights recognized in the data protection regulations, which may be exercised whenever applicable:

• Access : Allows interested parties to know what information is held, where it has been obtained, to whom it has been provided and for what purposes it has been processed.
• Rectification : Allows interested parties to rectify any erroneous or outdated data.
• Deletion : Allows interested parties to stop the processing of their data.
• Opposition : Allows interested parties to stop the use of their data for a specific purpose. In the case of the person to whom the facts related in the communication refer, it will be presumed that, unless proven otherwise, there are compelling legitimate reasons that legitimize the processing of their personal data.
• Limitation : Allows data subjects to restrict the processing of their data, but in such a way that they are retained for some subsequent purpose.
• Portability : Allows data subjects to obtain a copy of their data in electronic format and, under certain circumstances, to request that it be communicated to another service provider. It is only applicable for computerized processing carried out with the User's consent or for the fulfillment of a contract.
• Revocation of consent : Allows interested parties to withdraw the consent, if any, given for the processing of their data.

However, the exercise of these rights is limited to those whistleblowers who have identified themselves at the time of submitting the communication. If GRUPO INMARK has reasonable doubts about the identity of the informant requesting the right, he/she may request information that allows him/her to prove his/her identity.

Whenever applicable, they may exercise the aforementioned rights before GRUPO INMARK by mail to the above address or by e-mail to [email protected] .

If the informants wish further information in this regard or consider that their right to data protection has been violated, they may contact the Spanish Data Protection Agency (www.aepd.es) or the Data Protection Delegate of GRUPO INMARK ( [email protected] ).

9. SECURITY MEASURES

In compliance with the aforementioned current regulations, GRUPO INMARK has incorporated the appropriate technical and organizational measures to guarantee the protection of the rights and freedoms of those affected by the processing of their personal data, including the corresponding data security measures, reinforced, among other aspects, with respect to the necessary confidentiality and, singularly, the disclosure of the identity of the informant, data protection and secrecy of communications, in order to prevent the loss, misuse, alteration, unauthorized access and theft of the data provided by the informant.

10. ACCURATE AND TRUTHFUL INFORMATION

GRUPO INMARK informs the complainant that the communication transferred through the Whistleblower Channel may lead to the initiation of internal or external investigations and may have negative consequences for those affected.

For this reason, you should only provide us with information that is believed to be correct, to the best of your knowledge and belief, and that is relevant to detect a breach of GRUPO INMARK's regulatory compliance and/or Code of Ethics or Code of Conduct.

GRUPO INMARK may initiate any disciplinary and/or legal action it deems appropriate whenever the communication is manifestly unfounded or there are, in the opinion of GRUPO INMARK reasonable indications that the information has been obtained through the commission of a crime.