Internal Information System

I.- INTERNAL INFORMATION SYSTEM

In compliance with Law 2/2023, dated 20 February, regulating the protection of people who report regulatory infractions and the fight against corruption (“Law 2/2023”), the companies MASIAS INVEST, S.L., MASIAS MAQUINARIA, S.L. and FLUVITEX, S.L. hereinafter, jointly, “MASIAS” or the “companies”) state that they have an Internal Information System, where the company MASIAS INVEST, S.L. Is the data controller of personal data in accordance with the provisions of current legislation in this area.

In order to strengthen MASIAS’s information culture and integrity infrastructures, and to promote the culture of communication as a mechanism to prevent actions or omissions that may constitute violations of EU regulations, criminal or serious or very serious administrative violations, as well as labour infractions regarding occupational safety and health, MASIAS has a Criminal Compliance administrator (RCP in Spanish) who is also the Internal Information System administrator (RSII in Spanish) (hereinafter , the “RCP/RSII” person). For these purposes, MASIAS has appointed the person holding the position of Head of Quality, Safety and Environment for this role.

Information related to the areas indicated in the previous paragraph can be sent to the RCP/RSII by any of the following means:

To the following email address: compliance@nullmasias.com
To the following postal address: C. Major de Santa Magdalena, 1, Sant Joan les Fonts (17857) (for the attention of the RCP/RSII person).
By telephone: calling 972293150 and asking for the RCP/RSII person.
Requesting an in-person meeting with the RCP/RSII person through the aforementioned email, which must take place within seven days.

The information communicated verbally must be documented in one of the following manners, with the prior consent of the reporting party:

a) By recording the conversation in a secure, durable and accessible format.

(*) The reporting party will be warned that the communication will be recorded and will be informed of the processing of their data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, dated 27 April 2016. (GDPR or General Data Protection Regulation).

b) Through a complete and accurate transcription of the conversation made by the RCP/RSII person.

(*) Notwithstanding the rights that correspond to them in accordance with data protection regulations, the reporting party will be offered the opportunity to check, rectify and accept the transcription of the conversation through their signature.

The MASIAS Internal Information System complies with the requirements of Article 5.2 of Law 2/2023, namely:

a).- Allows people to whom Law 2/2023 applies to communicate information, through a variety of means, about the infractions provided for in its Article 2.

b).- It is managed securely, guaranteeing that communications can be treated effectively within companies, as well as the confidentiality of the identity of the reporting party and any third party mentioned in the communication and the actions performed, develop in its management and processing, as well as data protection, preventing access by unauthorised personnel.

c).- It has a Protocol for the use of the Ethical Channel and the actions of the person responsible for Criminal Compliance and the Internal Information System that establishes guarantees for the protection of informants, essentially:

Proof of receipt within seven calendar days following receipt of the information.
An ordinary maximum period of three months to respond to the investigation proceedings, within the terms of Article 9 of Law 2/2023, properly completing and safeguarding an Information Record Book.
Option of maintaining communication with the reporting party.
Establishment of the right of the affected party to be informed of the actions or omissions attributed to him or her and to be heard.
Guarantee of confidentiality when the communication is sent through reporting channels other than those established or to personnel not responsible for its processing, as well as the obligation for the party who receives it to immediately send it to the RCP/RSII person.
Respect for the presumption of innocence and the honour of the affected parties.
Respect for the provisions on Data Protection (Title VI Law 2/2023).
Compromise to forward the information to the Public Prosecutor’s Office immediately whenever the facts could indirectly constitute a crime.

II.- PROCESSING OF PERSONAL DATA

MASIAS INVEST, S.L. will process, as data controller, the personal data included in any communications that are received and are covered by Law 2/2023, in order to be able to manage them and initiate any corresponding investigation procedure when applicable and adopt corrective measures that may apply.

The legal grounds for the processing will be compliance with the obligations imposed by Law 2/2023. Any communication that contains data of a special nature will only be processed whenever strictly necessary for the adoption of corrective measures and/or the initiation of the corresponding investigation procedure and/or the processing of sanctioning or criminal procedures that may proceed, in accordance with current legislation, where the legal grounds in these cases will be the essential public interest. The processing of personal data will be essential, whenever the objectives and obligations stipulated by Law 2/2023 cannot be met if this does not take place.

Personal data may be processed by MASIAS INVEST, S.L., MASIAS MAQUINARIA, S.L. and FLUVITEX, S.L. personnel authorised to do so only whenever necessary for the investigation of non-compliance with the internal regulations of the aforementioned companies, infractions in the field of European Union Law, serious or very serious criminal or administrative infractions, as well as labour infractions in the field of occupational safety and health for the adoption of corrective measures or for the processing of sanctioning or criminal procedures that may apply. Personal data may also be communicated to third parties in the event of legal obligation, and may be communicated to the judicial authority, the Public Prosecutor’s Office or the competent administrative authority within the framework of the aforementioned investigation.

Personal data will be retained for the time necessary to decide whether to initiate an investigation into the reported events. If it is recommended to adopt corrective measures, the data will be retained for the entire duration of the application of these measures. On the other hand, in the event that it is necessary to initiate the processing of sanctioning or criminal procedures, the data will be retained for the entire duration of the sanctioning or criminal procedure.

In any case, if the decision on whether to initiate an investigation into the reported facts is not adopted within a period of three months, the personal data contained in the communication will be deleted, except for any data that are strictly necessary to be retained blocked to maintain evidence of the operation of the companies’ Internal Information System in accordance with Law 2/2023.

Any personal data that reveal behaviours that are not included in the scope of application of Law 2/2023 will also be deleted, as well as any personal data not considered truthful, except that this lack of truthfulness may constitute a criminal offence, in which case the information shall be retained for the necessary time during which the judicial procedure is processed.

Finally, please be informed that the communicating party may request the data controller to access their personal data, its rectification or deletion, or the limitation of its processing, or to object, as well as the right to data portability at any time by sending a letter by post to Major Santa Magdalena 1, 17857, Sant Joan Les Fonts, or by email to conformity@nullmasias.com. In the event of any disagreement with the processing of your data, you may file a claim with the Spanish Data Protection Agency, the organisation with power for the same, located at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es).

III.- NON-RETALIATION

The companies comprising MASIAS expressly undertake not to perform any acts constituting retaliation, including threats or attempts at retaliation, against anyone who submits a communication in accordance with the provisions of Law 2/2023, and to apply protection measures during the processing of a file, regarding the people affected by a possible communication.

IV.- EXEMPTION AND REDUCTION OF THE SANCTION

In accordance with the provisions of Law 2/2023, whenever someone who has participated in the commission of the administrative offence that is the subject of the information is the party who reports its existence by presenting the information, and provided that it has been presented prior to having been notified of the initiation of the investigation or sanctioning procedure, the administrative body competent to resolve the procedure, by means of a reasoned resolution, may exempt this party from compliance with the administrative sanction applying to them, provided that the points mentioned in Article 40 of Law 2/2023 are proven.

(*) The Ethical Channel allows the presentation of anonymous communications.

(**) Although the use of the internal channel will be preferential whenever possible, depending on the circumstances and severity of the information, communications may also be sent to the Independent Authority for the Protection of Informants (in the Autonomous Community of Catalonia, before the Anti-Fraud Office of Catalonia), or to the corresponding authorities or autonomous bodies, to the Public Prosecutor’s Office, to the European Public Prosecutor’s Office, or to the competent authority as appropriate.