WHISTLEBLOWER PROTECTION

1. Objective scope of application

1. The objective scope of application refers to the matters and behaviors that must be reported through the Internal Reporting System. The Company’s Internal Reporting System allows the following behaviors to be reported:

• Infringements referring to: (i) public procurement; (ii) financial services, products and markets, and prevention of money laundering and terrorist financing; (iii) product safety and compliance; (iv) transport security; (v) environmental protection; (vi) radiation protection and nuclear safety; (vii) food and feed safety, animal health and animal welfare; (viii) public health; (ix) consumer protection; (x) protection of privacy and personal data, and the security of networks and network and information systems.
• Infringements affecting the financial interests of the European Union.
• Infringements affecting the internal market, including infringements of European Union competition rules and aid granted by States, as well as infringements relating to the internal market in relation to acts infringing corporation tax rules or practices aimed at obtaining a tax advantage that undermines the object or purpose of the law applicable to corporation tax.
• Actions or omissions that may constitute a serious or very serious criminal or administrative offence, including, among them, all serious or very serious criminal or administrative offences that involve economic damage to the Public Treasury and Social Security.

1. Likewise, the Internal Reporting System allows:

• To report any acts that are allegedly unlawful or constitute breaches of the Code of Conduct, the Regulatory Compliance Program or any of the procedures or policies that make up the Company’s internal regulations, as well as any irregular or inappropriate conduct in the opinion of the whistleblower.
• To formulate consultations on the interpretation and application of the manuals or internal regulations of mandatory compliance or in case of doubt or concern about whether a certain situation could be considered an act of those set forth in the previous points.

These latter communications and consultations are expressly excluded from the scope of regulation and protection provided for in Law 2/2023, of 23 February. The foregoing will be communicated to anyone who submits information through the Internal Reporting System that is outside the walls of said regulation.

1. Personal scope

The subjective scope of application includes the delimitation of those persons who can communicate, through the Internal Information System, their knowledge or suspicion of the conduct detailed in the material scope.

1. The obligation to report through the channels integrated into the Company’s Internal Reporting System extends to all employees, senior managers and persons belonging to the Company’s administrative, management or supervisory body, including non-executive members, as well as to volunteers, trainees and trainees, regardless of whether or not they receive remuneration («Employees«), without fear of dismissal or any other form of retaliation.

1. The possibility of informing through any of the channels provided for in the Internal Information System also extends to: (i) shareholders and participants; (ii) any person working for or under the supervision and direction of contractors, subcontractors, and suppliers; (iii) those persons who communicate information on the infringements included in the material scope of application obtained within the framework of an employment relationship that has already ended with the Company; and (iv) those whose employment relationship has not yet begun in cases where the information on violations has been obtained during the selection process or pre-contractual negotiation («Third Parties«).

For the purposes of the Internal Information System, the aforementioned Employees and Third Parties have the status of whistleblower.

1. Responsible for the Internal Reporting System

The Company’s administrative body, in its capacity as the person most responsible for the implementation of the Internal Reporting System, is competent to appoint, dismiss or dismiss the natural person or collegiate body responsible for the management of the Internal Reporting System.

In accordance with Article 8 of Law 2/2023, the person in charge of managing the Internal Reporting System is the System Manager. This person coincides with the Company’s Compliance Officer, and this is without prejudice to the supervision and control functions attributed to the Company’s Supervisory and Control Body to which the latter belongs.

The System Manager carries out his/her functions independently and autonomously with respect to the rest of the Company’s bodies, without receiving instructions of any kind in their exercise, and has all the personal and material means to carry them out.

In the event of a vacancy, absence or illness of the System Manager, he or she will be replaced in his or her function in relation to the Internal Reporting System and internal investigations by another member of the Supervisory and Control Body designated for this purpose by this body («Substitute for the System Manager«), who will be notified of this circumstance by the Supervisory and Control Body itself.

Notwithstanding the foregoing, both the System Manager and the Substitute of the System Manager, if they consider it necessary for the adoption of corrective measures in the Company, such as the proper conduct of an internal investigation from its inception, and always guaranteeing the confidentiality of the information, may request support from the corresponding internal department in those cases in which their participation is required due to the specific matter to support in the processing of the regulated process in the Internal Reporting System, and this without these collaborators necessarily having to access specific personal data. The foregoing is without prejudice to the supervision and control tasks attributed to the Supervisory and Control Body in accordance with the Company’s internal regulations.

1. Principles and guarantees

1. The confidentiality of the reports received is guaranteed, preserving the identity and confidentiality of the data corresponding to the persons affected by the information provided (reported), as well as of the person who reported the facts through the Internal Information System (informant), if identified. Likewise, anonymous reports may be made, guaranteeing the anonymity of the informant. The confidentiality of the documentation generated during any internal investigation that is processed following the formulation of a complaint is also guaranteed.

It is expressly prohibited to disclose information about reports or possible subsequent internal investigations. Failure to comply with this duty will be subject to the  appropriate disciplinary sanctions in accordance with the applicable regulations in each case.

1. The duty to make inquiries and communicate the acts included in the material scope of application of the Internal Information System with absolute freedom and without fear of reprisals is guaranteed. Consequently, it is strictly forbidden to adopt any measure against any of the subjects included in the subjective scope of application that constitutes a retaliation, threat or attempt of retaliation, or any type of negative consequence for having made a complaint. Such measures shall be null and void.

The prohibition of retaliation provided for in the preceding subparagraph shall also apply, where appropriate, to:

• Natural persons who, within the framework of the organisation in which the whistleblower provides services, assist the whistleblower in the process, as well as, if any, the legal representatives of the workers in the exercise of their functions of advising and supporting the whistleblower.
• Natural persons who are related to the whistleblower and who may suffer retaliation, such as co-workers or family members of the whistleblower.
• Legal entities for which the respondent works or with whom he or she has any other type of relationship in a work context or in which he or she has a significant stake.

Without prejudice to the provisions of the preceding paragraphs, the appropriate disciplinary measures shall be adopted when the complaint is false or has been made in bad faith or when the information sent has been obtained illegally. Good faith is presumed unless there is evidence to the contrary.

Likewise, any conduct aimed at preventing or hindering the filing of a complaint will also be subject to investigation and, where appropriate, subject to disciplinary sanctions by the Company.

The System Manager will assess from an ex ante perspective  the probability that the whistleblower may suffer some type of retaliation or damage for the facts reported and, in the event that it is concluded that there is a real risk of retaliation, will adopt the appropriate measures in order to minimise this risk in view of the concurrent circumstances.

1. Information that may have been obtained illegally will not be accepted through the channels provided for in the Internal Information System, because it is not reasonable for the person who provides it to have had access to it lawfully or because it is not publicly accessible. Such information will be rejected and communicated to the whistleblower. Notwithstanding the foregoing, the Head of the Internal Reporting System may decide to continue with the processing of the complaint considering the lawful information if possible.

1. It is guaranteed that the complaint will be received directly by the System Manager, except in those cases in which the complaint is directed against him or her or when he has to be replaced by justified absence regulated in the Internal Reporting System, without the whistleblower having to previously communicate his complaint to a hierarchical superior or any other intermediate bodies.

1. Strict respect for the rights of the whistleblower is guaranteed from the filing of the complaint until the end of the internal investigation and adoption, where appropriate, of the measures that may arise from it, with the only limitations provided for by law.

1. Strict respect for the rights of the person(s) reported is guaranteed, from the filing of the complaint by the whistleblower to the completion of the internal investigation and adoption, where appropriate, of measures that may arise from it, with the only limitations provided for by law.

1. The System Manager will ensure that neither the right to the presumption of innocence nor the prestige and reputation of the accused or of the Company are unnecessarily jeopardized.

1. Compliance with applicable data protection legislation is ensured in the complaint procedure and in any subsequent internal investigation procedure.

1. The dissemination, in a clear and easily accessible manner, of the existence, use, usefulness and principles and guarantees of the Internal Reporting System and internal investigations, for all persons included in the subjective scope of application, through the website (on the home page, in a separate and easily identifiable section) of AZ Capital and, in addition, through communication and training aimed at all employees of the Company on the obligation to make communications through the Internal Reporting System as a preferential channel.

1. Rights and obligations of the whistleblower

Employees and Third Parties who, using the established channels, report or disclose violations provided for in section 1.A., and who have reasonable grounds to believe that the information referred to is true at the time of communication or disclosure, even if they do not provide conclusive evidence, are considered to be whistleblowers.

The rights and obligations of the whistleblower provided for in this section are applicable from the filing of the complaint, and extend to internal investigations and subsequent measures that may arise from them, except for legal limitations.

The following rights and obligations of the whistleblower are guaranteed:

1. Obligation to inform: Employees who become aware of the commission, by the Company, its employees and managers, or by a third party in their relations with the aforementioned parties, of an act within the material scope of application of the Internal Information System, must report it through the Internal Information System as a preferential channel.

Failure to comply with this obligation will constitute an infraction and subject to disciplinary sanction in the terms provided for in the Company’s disciplinary system.

2. The reporting person shall have the right to decide whether to make the communication anonymously or non-anonymously; verbally or in writing; In the latter case, the confidentiality of the identity of the whistleblower is guaranteed, so that it is not revealed to the persons involved in the facts denounced or to third parties.

3. The report will not have to go through the reporting person’s hierarchical superiors or any other intermediate bodies, but will be received directly by the System Manager through the tools included in the Company’s Internal Reporting System, in order to guarantee the good faith whistleblower that he or she will not suffer any retaliation or sanction for making a complaint and the confidentiality of his or her identity (in the event that the report is not anonymous) and the information and documentation communicated.

4. The data of the whistleblower will not be disclosed and will be confidential even in the event that the respondent exercises his right of access to his personal data. In this case, the accused will be denied access to specific information on the identity of the whistleblower.

5. The identity of the whistleblower will only be accessible and will not be protected by the obligation of confidentiality when a rule provides for its disclosure or is requested by the judicial authority, the Public Prosecutor’s Office or the competent administrative authority in the framework of a criminal, disciplinary or sanctioning investigation. However, the whistleblower shall be informed of this before revealing his or her identity, unless such information would jeopardize the investigation or judicial proceedings.

6. As the only exception to the above rule, the identity of the whistleblower will only be provided, if necessary, to the Company’s internal professionals who are directly involved in the possible internal investigation, who are subject to a strict duty of confidentiality and in accordance with the applicable data protection regulations. Likewise, the identity of the whistleblower may be communicated to the external professionals involved in the possible internal investigation (lawyers, forensic team, etc.), who are subject to the same duty of confidentiality. Likewise, the identity of the whistleblower may be communicated to the authority to which, where appropriate, the result of the possible internal investigation is transferred (Examining Magistrate, Public Prosecutor’s Office or relevant administrative authority) in the cases provided for in the applicable regulations.

7. Failure to comply with the aforementioned confidentiality obligations, as well as failure to comply with the prohibition of retaliation, will constitute a very serious infraction in the Company’s disciplinary system, unless the complaint has been made in bad faith.

8. Bad faith shall be considered to exist when the complaint is made with knowledge of its falsity or with reckless disregard for the truth. In these cases, the appropriate disciplinary sanctions will be imposed.

9. The whistleblower has the obligation to collaborate with the System Manager when required to do so, except in cases of anonymous reporting.

10. The whistleblower shall be informed in a clear and accessible manner about the external reporting procedures to the competent authorities and, where appropriate, to the institutions, bodies, offices or agencies of the European Union.

11. The whistleblower may request the assistance of a lawyer during the processing of the internal investigation, which will be submitted to the consideration of the System Manager. If admitted, the cost will be borne by the whistleblower.

1. Rights and obligations of the accused

The rights and obligations of the accused or investigated party provided for in this section are applicable from the filing of the complaint, and extend to internal investigations and subsequent measures that may arise from them, except for legal limitations.

1. The accused or investigated person has the right to be informed of the existence of the investigation as soon as possible, to receive information about the facts attributed to him or her and to be heard at any time.

2. However, the delay of such notification for a reasonable period of time shall be justified if there is a real risk that this would jeopardise the investigation. The objective of this measure is to preserve the evidence in order to prevent its alteration or destruction by the accused or investigated. However, it will be carried out in a restrictive manner on a case-by-case basis and weighing up the interests at risk.

3. The accused or investigated person has the right to the presumption of innocence, to the right of defence, his identity being preserved and the confidentiality of the facts and data of the internal investigation being guaranteed.

4. The accused or investigated person has the right to be informed of all the rights and obligations arising from his or her situation as a defendant or under investigation.

5. The accused or investigated party has the duty to appear before the System Manager, having the right not to answer all or part of the questions put to him/her.

6. The accused or investigated party shall be informed of his or her right to be assisted by a lawyer and/or workers’ representative, when the facts may constitute a criminal offence. If it is discovered that the facts may constitute a criminal offence during an interview with the accused, the declarant will be informed, the interview will be suspended at that time and the accused will be offered the possibility of being assisted by the workers’ representation and/or their lawyer – whose fees will be borne by the accused or investigated. The interview will be resumed once the designated representatives can appear or, where appropriate, after having made an express waiver – which must be made in writing and incorporated into the file.

7. The accused or investigated person has the right to defend himself and, therefore, can provide his version of the facts and the exculpatory evidence at any time during the investigation.

8. The investigation will be carried out with the utmost respect for the honour and presumption of innocence of the accused or investigated.

9. The person under investigation may request a copy of the result of his or her appearance before the System Manager.

10. The accused or investigated party must maintain confidentiality in relation to the existence of the investigation and may not threaten or coerce any person who is collaborating with the internal investigation. Failure to comply with these two obligations may lead to the imposition of disciplinary sanctions within the Company, without prejudice to other criminal, civil or administrative responsibilities that the defendant may incur in these cases.

11. The reported or investigated party has the right to be informed of the treatment that will be given to their data, to the complaint, and to their rights in terms of data protection. To this end, AZ Capital provides a privacy notice that jointly describes the processing carried out in the context of the Internal Reporting System and the development of any internal investigations. This privacy notice is available at all times on the intranet and on the AZ Capital website. The aforementioned privacy notice will be provided to the reported parties within a reasonable period of time, and no later than one month after the collection of their personal data through the complaint. However, the delay in providing the aforementioned privacy notice for a reasonable period of time will be justified if there is a real risk that this will jeopardise the research.

12. In the event that the investigation requires access to the Technological Resources used by the accused or investigated, to their personal effects or locker, the investigated person has the right to be present at the access and may request the presence of a representative of the workers or witness, unless this jeopardizes the course of the investigation. In this case, once the danger disappears, the person under investigation will be informed of the access made.

13. When the person under investigation has been informed of the existence of the internal investigation and the facts attributed to him, the person under investigation shall be informed of the outcome of the investigation. In any case, when a disciplinary measure is to be imposed as a result of the investigations carried out, the person under investigation will be informed of the result of the investigation and the measures that the Company is going to adopt as a result of it, all in accordance with the applicable legislation.

14. In the event that the complaint turns out to be false after the investigation, the accused or investigated person has the right to have it so recorded in the register of complaints.

15. In the event that it is proven during the investigation that the complaint has been made in bad faith, the accused will be informed so that he can exercise the legal actions that correspond to his right.

1. Processing of reports received

Complaints received through the Internal Reporting System will be processed as follows:

1. Complaints directed against persons other than the System Manager

• (i) The System Manager must acknowledge receipt of the communication to the whistleblower within a maximum period of seven (7) calendar days following its receipt, provided that the confidentiality of the communication is not jeopardized. In the event that the report is not included in section 1.A. to be considered a complaint, the whistleblower will be informed of this.
• (ii) Likewise, it will carry out a preliminary assessment of the subsumption of the information received in the objective scope of application of the Internal Information System, on whether the complaint falls within the scope of protection and application of the regulations on the protection of the whistleblower, as well as on the consistency and plausibility of the facts reported, and may request additional information from the whistleblower if deemed necessary (if identified, unless the whistleblower has waived receiving communications).
• (iii) Once this preliminary analysis has been carried out, the System Manager will decide, within a period of no more than fifteen (15) business days from the date of entry of the information in the registry, whether to admit the complaint for processing.
• (iv) If the complaint is inadmissible, such inadmissibility shall be communicated to the whistleblower within fifteen (15) working days of its receipt, unless the communication is anonymous or the whistleblower has waived his or her right to receive communications.
• (v) Once the complaint has been admitted for processing, the System Manager will carry out an internal investigation of the facts in accordance with the Company’s internal regulations and in compliance with the principles, guarantees and rights set out in this document.
• (vi) The period for responding to the investigation proceedings may not exceed 3 months from the acknowledgement of receipt or, if it was not sent, 3 months from the expiry of the period of 7 days after the complaint is made, except in cases of special complexity that require an extension of the period up to 3 additional months.
• (vii) Upon completion of the investigation, if it is proven that the reported infringement is justified, appropriate action will be taken in accordance with the Company’s procedures and applicable law.

The whistleblower may request additional information through the same channels provided for the formulation of reports.

1. Complaints directed against the System Manager

When the respondent is the Head of the System, the complaint shall be sent by letter to the attention of the other members of the Company’s Supervisory and Control Body at the postal address of the Company’s registered office as it appears at any time published on the Company’s website or by email to the address of a member of the Supervisory and Control Body. In this case, the entire process of processing the complaint, as well as the internal investigation, will be carried out by the non-conflicted personnel designated by the Company’s Supervisory and Control Body and may be completely outsourced to appropriate professionals.