I.- INTERNAL INFORMATION SYSTEM
In compliance with Law 2/2023, of February 20, regulating the protection of people who report regulatory infractions and the fight against corruption (hereinafter, “Law 2/2023”), the companies of the ALVIC group (specifically, SERVICOMPUT, S.A.U. and DEVELOPMENT FACTORY & RESEARCH, S.L.) state that they have an Internal Information System, the company being SERVICOMPUT, S.A.U. (hereinafter, “SERVICOMPUT”) the person responsible for the processing of personal data in accordance with the provisions of current legislation in this area.
With the aim of strengthening the information culture and integrity infrastructures of the Group and promoting the culture of communication as a mechanism for preventing activities or omissions that may constitute infringements within the EU, criminal or administrative sphere. serious or very serious (including in matters of safety and health at work), the indicated companies of the Group have a person Responsible for Criminal Compliance (RCP) who is also Responsible for the internal information system (RSII) (hereinafter, the person “CPR/RSII”). For these purposes, the ALVIC group has appointed as such the person responsible for SAP of SERVICOMPUT.
The aforementioned information can be sent to the RCP/RSII by any of the following means:
Likewise, the indicated ALVIC group companies have an alternative person in charge in the event that the information indicates that the person responsible for the aforementioned infractions is RCP and RSII, who is currently the General Director of SERVICOMPUT. In this case, the aforementioned information can be sent by any of the following means:
At the request of the reporting person, the communication may also be presented through a face-to-face meeting with the RCP/RSII (or, where appropriate, with the alternative person in charge), within a period of seven days.
Verbal information provided through a face-to-face meeting with the CPR/RSII person (or, where applicable, the alternative person in charge) must be documented in one of the following ways, with prior consent from the reporting person:
a) by recording the conversation in a secure, durable and accessible format, or
(*) The reporting person will be warned that the communication will be recorded, and they will be informed of the processing of their data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (GDPR or General Data Protection Regulation).
b) through a complete and accurate transcription of the conversation carried out by the CPR/RSII person.
(*) Without prejudice to the rights that correspond to them in accordance with data protection regulations, the reporting person will be offered the opportunity to check, rectify and accept the transcription of the conversation by signing.
The Internal Information System of the ALVIC Group companies complies with the requirements of article 5.2 of Law 2/2023, that is:
a) Allows the people to whom the aforementioned Law 2/2023 applies to communicate information, by various means, about the infractions provided for in its article 2.
b) It is managed securely, guaranteeing that communications can be treated effectively within the company, as well as the confidentiality of the identity of the reporting person and any third person mentioned in the communication and the actions that are carried out in the management and processing of this, as well as data protection, preventing access by unauthorized personnel.
c) It has a Protocol for the use of the ethical channel (as an internal information channel) and for the actions of the person responsible for Criminal Compliance and the Internal Information System that establishes guarantees for the protection of informants, essentially:
- Proof of receipt within seven calendar days following receipt of the information.
- Ordinary maximum period of three months to respond to the investigation proceedings, in the terms of article 9 of Law 2/2023, diligently completing and safeguarding an Information Record Book.
- Possibility of maintaining communication with the reporting person.
- Establishment of the right of the affected person to be informed of the actions or omissions attributed to him or her and to be heard.
- Guarantee of confidentiality when the communication is sent through reporting channels other than those established or to personnel not responsible for its treatment, as well as the obligation for the person who receives it to immediately send it to the CPR/RSII person.
- Respect for the presumption of innocence and the honour of the affected persons.
- Respect for the provisions on Data Protection (Title VI Law 2/2023).
- Commitment to forward the information to the Public Prosecutor's Office immediately, when the facts could indirectly constitute a crime.
II.- PROCESSING OF PERSONAL DATA
SERVICOMPUT, S.A.U. will process the personal data included in the communications that are received and are covered by Law 2/2023, as responsible for the treatment, to be able to manage them and initiate, where appropriate, the corresponding investigation procedure and adopt the corrective measures that, if applicable, proceed.
The legal basis of the treatment will be compliance with a legal obligation, derived from Law 2/2023. If the communication contains data of a special nature, these will only be processed when it is strictly necessary for the adoption of corrective measures and/or the initiation of the corresponding investigation procedure and/or the processing of sanctioning or criminal procedures that, where appropriate, proceed in accordance with current legislation and, in these cases, the legal basis will be the essential public interest. The processing of personal data will be essential when without them the objectives and obligations stipulated by Law 2/2023 cannot be met.
Personal data may be processed and transferred by personnel authorized to do so only when it is necessary for the investigation of violations in the field of European Union Law, serious or very serious criminal or administrative violations, as well as labour violations in the field of safety and health at work, for the adoption of corrective measures, or for the processing of sanctioning or criminal procedures that, where appropriate, may apply. Likewise, personal data may be communicated to third parties in the event of legal obligation, and may be communicated to the judicial authority, the Public Prosecutor's Office or the competent administrative authority within the framework of the aforementioned investigation.
Personal data will be kept for the time necessary to decide whether to initiate an investigation into the reported events. If it is appropriate to adopt corrective measures, the data will be kept for the entire duration of the application of these measures. On the other hand, in the event that it is necessary to initiate the processing of sanctioning or criminal procedures, the data will be kept for the entire period that the sanctioning or criminal procedure lasts.
In any case, if the decision on whether to initiate an investigation into the reported facts is not adopted within a period of three months, the personal data contained in the communication will be deleted, except for those data that are strictly necessary to be kept blocked for maintain evidence of the operation of the SII in accordance with Law 2/2023.
Those personal data that reveal behaviours that are not included in the scope of application of Law 2/2023 will also be deleted, as well as those personal data not considered truthful, except that this lack of truthfulness may constitute a criminal offense, in which In this case, the information will be kept for the necessary time during which the judicial procedure is processed.
Finally, it is stated that, at any time, the communicating person may request the data controller to access their personal data, its rectification or deletion, or the limitation of its processing, or to object, as well as the right to portability of data. the data, sending a letter to the post office Avda. del Forn de la Calç, 3, P.I. Congost, 08540 (Centelles) or email info@alvic.net. In case of disagreement with the processing of your data, you may file a claim with the Spanish Data Protection Agency, the body that holds the control authority in the matter, located at C/ Jorge Juan, 6 (28001) Madrid (www.aepd.es).
III.- NON-RETALIATION
The companies of the ALVIC Group expressly undertake not to carry out acts that constitute retaliation, including threats or attempts at retaliation against people who submit a communication in accordance with the provisions of Law 2/2023, and to apply protection measures during processing. of a file, with respect to the people affected by a possible communication.
IV.- EXEMPTION AND REDUCTION OF THE SANCTION
In accordance with the provisions of Law 2/2023, when a person who has participated in the commission of the administrative offense that is the subject of the information is the one who reports its existence by presenting the information, and provided that it has been presented Before the initiation of the investigation or sanctioning procedure has been notified, the administrative body competent to resolve the procedure, by means of a reasoned resolution, may exempt you from compliance with the administrative sanction that corresponds to you as long as the extremes mentioned in the article are proven. 40 of Law 2/2023.
(*) The Ethical Channel allows the presentation of anonymous communications.
(**) Although whenever possible the use of the internal channel will be preferential, depending on the circumstances and severity of the information, communications may also be sent, where appropriate, to the Independent Authority for the Protection of Informants (in the Autonomous Community of Catalonia, before the Anti-Fraud Office of Catalonia), or to the corresponding authorities or autonomous bodies, to the Public Prosecutor's Office, to the European Public Prosecutor's Office, or to the competent authority as appropriate.